Splunk SPL Mastery: Essential Commands and Data Modeling

Aggregation and Charting Commands

• Stats vs. Eventstats vs. Streamstats: stats collapses events for aggregation; eventstats retains events for per-event comparison; streamstats performs rolling, order-sensitive calculations.
• Chart vs. Timechart: Use chart for non-time data with over/by; use fillnull to handle gaps. timechart bins _time automatically; define intervals using span=12h. Note: chart count over X by Y differs from chart count by X,Y.

Data Manipulation and Filtering

• Eval: Use tostring(field, "duration") for numeric time formatting; case() for multi-condition logic; and coalesce(field1, field2, …) to prevent null values.
• Where vs. Search: where is a post-pipe, type-sensitive command. Strings treated as numbers result in nulls; cast using tonumber(field).
• Fillnull: Operates per-field (e.g., fillnull value=0 count value="unknown" status). It cannot combine types globally.

Transaction Logic

• Transactions: Use | transaction field maxspan=X maxpause=Y. duration represents the span, and eventcount tracks the number of events. closed_txn=0 identifies orphaned events; keepevicted=true includes incomplete events. Use transaction for small, ordered sets; for large volumes, prefer stats + eval.

Field Management

• Field Extraction (FX): Use regex (?pattern). The require clause includes only events with a match. Note: Manual edits in the FX UI cannot be reverted.
• Field Aliases: Search-time only; applied after extractions and before lookups.
• Calculated Fields: Search-time eval expressions; dashboard visibility depends on app permissions.

Knowledge Objects

• Tags: Assign field=value, searchable as tag::=.
• Event Types: Search-based, taggable, and compatible with Pivot.
• Macros: Require name + definition; optional arguments use ($arg$). Macros can be piped and require sharing/permissions for global use.
• Workflow Actions: GET retrieves info (query string); POST modifies external systems (body); Search performs subsearches. All require label + URI/search + fields.

Data Models and CIM

• Data Models: The root event dataset requires at least one constraint. Child datasets inherit fields and constraints. Accelerated DMs require the admin/accelerate_datamodel capability.
• CIM Add-On: Normalizes fields across sourcetypes (e.g., src_ip → source) using pre-configured objects. Pivot queries attributes (fields + constraints).

Quick Troubleshooting Tips

• Eventstats: Use when you need to compare events to an average/total without reducing the event count.
• Root Event Dataset: Always requires a constraint.
• Pivot Visibility: Ensure fields have friendly names or are auto-extracted.
• Dashboard Nulls: Check permissions, search mode, and calculated field availability.
• Orphaned Transactions: Use closed_txn=0 to identify incomplete sessions.