Splunk Basic Commands Cheat Sheet
Common Splunk Commands:
search
Finds events based on keywords or conditions.
fields
Selects which fields to keep or remove.
table
Displays fields in table format.
stats
Calculates things like count, sum, avg, etc.
eval
Creates or modifies fields.
where
Filters results based on a condition.
sort
Sorts results.
dedup
Removes duplicate events.
top
Lists top values of a field.
rare
Lists least common values.
rex
Extracts fields using regex.
lookup
Pulls extra fields from a lookup table.
join
Joins two searches together.
Splunk Basic Commands Cheat Sheet
transaction
Groups events into transactions.
head / tail
Returns first N or last N results.
eventstats / streamstats
Adds statistics to each event or streams row-by-row.