Splunk Search Tips Cheatsheet

Searching in Splunk gets really interesting if you know the most commonly used and very useful command sets and tips. This Splunk Cheatsheet will be handy for your daily operations or during troubleshooting a problem. Type these commands in the splunk search bar to see the results you need.

List all the Index names in your Splunk Instance

| eventcount summarize=false index=* | dedup index | fields index

List all the Index names in your Splunk Instance

| eventcount summarize=false index=* index=_* | dedup index | fields index | rest /services/data/indexes | dedup title | table title

List all hosts that are logging to a particular index. In this example ,we use apachelog as the index.

index=apachelog| table host | dedup host

List all hosts that log to an index with eventcount per host. You can change the key word “host” to use “ip” too, based on your need.

index=apachelog | stats count by host

Sort by a field in the event output log

index=apachelog | sort host

Print the output event log in reverse order (ascending order based on time)

index=apachelog | reverse

Print only the first 10 results from the eventlog

index=apachelog | head 10

Return only the last 10 results from the eventlog

index=apachelog | tail 10

How to search a pattern on multiple splunk indexes in a single query ? Examples :

index=apachelog OR index=jbosslog | stats count by host index=apachelog OR index=jbosslog | search error

How to search a pattern and sort by count. This query will sort the results based on the output field “count”.

index=apachelog OR index=jbosslog | stats count by host | sort - count | head 15 index=apachelog OR index=jbosslog | top limit=15 host