Splunk® Enterprise

Splunk Enterprise is the data collection, indexing, and visualization engine for operational intelligence.

Splunk Enterprise Overview
A technical overview of Splunk platform features and documentation.

Release Notes
Includes information about new features, known issues, and fixed problems.

Installation Manual
How to install or migrate Splunk Enterprise. Includes system migration requirements and licensing information.

Search Tutorial
If you are new to Splunk search, start here. Guides you through adding data, searching data, and creating simple dashboards.

Data Model and Pivot Tutorial
Introduction to adding data, building simple data models, and creating new pivots.

Splunk Enterprise Scenarios
Contains scenario-based topics. Each topic illustrates a complex use case that is comprised of several tasks involving multiple product features. Some of these scenarios may involve Splunk apps and add-ons.

Translated Documentation
Some Splunk manuals are available in Japanese, Korean, Simplified Chinese, and Traditional Chinese.

Getting Data In
How to get your machine data into your Splunk deployment and ensure that it is indexed efficiently and effectively.

Alerting Manual
How to create and dispatch alerts that are triggered when specific conditions are met.

Dashboards and Visualizations
Capture, monitor, and share data insights. Learn how to generate visualizations and build dashboards. Add interactivity, manage permissions, and export dashboards. Edit dashboards and use Simple XML to customize user experience.

Pivot Manual
How to use Pivot to create tables and charts without the use of the Splunk Search Processing Language (SPL).

Reporting Manual
How to save and manage searches and pivots as a report. Includes report acceleration, report scheduling, and printing reports as PDFs.

Search Manual
How to search and use the Splunk Search Processing Language. Includes examples of searches to calculate statistics, evaluate fields, and report on search results.

Search Reference
Catalog of the search commands that make up the Splunk Search Processing Language with complete syntax, descriptions, and examples for each search command. Includes an SPL™ Command Cheat Sheet for quick reference.

Admin Manual
Starting point for Splunk Enterprise administration. Includes information about managing licenses, configuring Splunk Enterprise, and using the command-line interface. Includes a complete reference to all Splunk Enterprise configuration files.

Getting Data In
How to get your machine data into your Splunk deployment and ensure that it is indexed efficiently and effectively.

Knowledge Manager Manual
How to create, use and manage event types, tags, lookups, field extractions, workflow actions, reports, views, and data models.

Securing Splunk Enterprise
How to create and authenticate users, configure SSL, use audit features to secure your data, and harden Splunk deployments to reduce vulnerability and risk.

Troubleshooting Manual
How to analyze activity and diagnose problems with your Splunk deployment.

Splunk Analytics for Hadoop
License Splunk Analytics for Hadoop, configure virtual indexes, and search your Hadoop data.

Monitoring Splunk Enterprise
Monitor your Splunk deployment.

REST API Reference Manual
Reference documentation for Splunk REST API endpoints.

Capacity Planning Manual
This manual provides high-level guidance on how to plan resource capacity for a Splunk Enterprise deployment and helps you decide when to add resources and distribute Splunk Enterprise services to maintain performance.

Distributed Deployment Manual
Scale Splunk Enterprise by distributing functionality across multiple forwarders, indexers, and search heads.

Distributed Search
Scale search functionality with search heads and search head clusters.

Monitoring Splunk Enterprise
Monitor your Splunk deployment.

Forwarding Data
How to use forwarders to get data into your Splunk deployment.

Managing Indexers and Clusters of Indexers
How to configure and manage Splunk Enterprise indexers and clusters of indexers.

Updating Splunk Enterprise Instances
How to use deployment server and forwarder management to update Splunk Enterprise distributed instances, such as forwarders and indexers.

Developing Views and Apps for Splunk Web
Extend your Splunk deployment with custom visualizations, custom alert actions, and modular inputs.

Module System Reference
Includes the module system extension dictionary and APIs.

Module System User Manual
Includes the Splunk Web infrastructure layer for building custom apps using the module system.

REST API Reference Manual
Reference documentation for Splunk REST API endpoints.

REST API User Manual
How to use public Splunk REST API endpoints.

REST API Tutorials
Tutorials about using the Splunk REST API.