decrypting… # Splunk Query Language (SPL) Cheatsheet 🚀 #CS #logs Welcome to the ultimate Splunk Query Language (SPL) Cheatsheet! 🎉 Whether you're a seasoned Splunk user or just getting started, this page is packed with all the essential commands, tips, and tricks to supercharge your SPL skills. 💡 --- ## 🗂️ Table of Contents 1. [Getting Started with SPL](#getting-started-with-spl) 2. [Basic Commands](#basic-commands) 3. [Filtering and Searching](#filtering-and-searching) 4. [Transforming Commands](#transforming-commands) 5. [Statistical Analysis](#statistical-analysis) 6. [Data Visualization](#data-visualization) 7. [Advanced Techniques](#advanced-techniques) 8. [Pro Tips & Best Practices](#pro-tips--best-practices) 9. [Helpful Resources](#helpful-resources) --- ## 🚀 Getting Started with SPL Splunk Query Language (SPL) is used to query and manipulate data within Splunk. Here's a quick overview: - **Search Commands**: Retrieve events from indexes. - **Pipeline (`|`)**: Chain multiple commands together. - **Fields**: Extract, filter, and manipulate fields. ### Basic Syntax: ```spl <search string> | command1 [arguments] | command2 [arguments] ``` Example: ```spl index=web_logs | stats count by status_code ``` --- ## 🔍 Basic Commands | **Command** | **Description** | **Example** | |---------------|---------------------------------------------|-------------| | `search` | Filters events based on keywords. | `search error` | | `fields` | Includes/excludes specific fields. | `fields host, status` | | `table` | Displays results in table format. | `table user, status` | | `dedup` | Removes duplicate events. | `dedup user` | | `sort` | Sorts results by fields. | `sort - count` | --- ## 🛠️ Filtering and Searching ### Use Field-Based Searching: ```spl index=web_logs status_code=200 ``` ### Exclude Data: ```spl index=web_logs NOT status_code=404 ``` ### Wildcards: ```spl index=web_logs user=*admin* ``` --- ## 🔄 Transforming Commands | **Command** | **Description** | **Example** | |---------------|---------------------------------------------|-------------| | `eval` | Creates or transforms fields. | `eval status=if(status_code==200,"OK","Error")` | | `rename` | Renames fields. | `rename host AS hostname` | | `replace` | Replaces field values. | `replace "404" WITH "Not Found" IN status_code` | | `rex` | Extracts fields using regex. | `rex field=_raw "(?<user>\w+)"` | --- ## 📊 Statistical Analysis | **Command** | **Description** | **Example** | |---------------|---------------------------------------------|-------------| | `stats` | Provides statistical summaries. | `stats count by user` | | `timechart` | Generates time-based visualizations. | `timechart avg(response_time)` | | `eventstats` | Adds summary statistics to each event. | `eventstats avg(bytes) as avg_bytes` | | `tstats` | Performs accelerated searches. | `tstats count WHERE index=* BY host` | --- ## 📈 Data Visualization ### Chart Command: ```spl index=web_logs | chart count by status_code ``` ### Timechart Command: ```spl index=web_logs | timechart span=1h avg(response_time) ``` --- ## 🧙 Advanced Techniques ### Using Subsearches: ```spl index=web_logs [search index=users user=admin | fields session_id] ``` ### Custom Regex Extraction: ```spl index=web_logs | rex "(?<method>GET|POST|PUT|DELETE)" ``` ### Transaction Command: ```spl index=web_logs | transaction session_id startswith="login" endswith="logout" ``` --- ## 💡 Pro Tips & Best Practices 1. **Use Indexing Wisely**: Always specify an index for faster searches. 2. **Limit Fields**: Use `fields` to include only necessary data. 3. **Use `eval` for Calculations**: Simplify complex logic. 4. **Leverage Dashboards**: Save and visualize queries for repeated use. 5. **Profile Your Queries**: Use `Job Inspector` to analyze performance. --- ## 📚 Helpful Resources - [Splunk Documentation](https://docs.splunk.com/) - [Splunk YouTube Channel](https://www.youtube.com/user/splunkvideos) - [SPL Query Examples](https://splunktool.com/) 🎉 Happy Splunking! 💻