About the Search Tutorial
The Search & Reporting application (Search app) is the primary interface for using the Splunk software to run searches, save reports, and create dashboards. This Search Tutorial is for users who are new to the Splunk platform and the Search app.
Use this tutorial to learn how to use the Search app. Differences between Splunk Enterprise and Splunk Cloud are specified throughout this tutorial.
Already have access to Splunk software?
For this tutorial, use a free Trial version of the Splunk software.
Why? Because this tutorial uses a specific set of data to ensure consistency in your search results and the features that you are learning about. In the tutorial, you will upload this tutorial-specific data to the Splunk platform. You might not have permission to upload data in your production, work environment. Additionally, using a free Trial version of the software ensures that the tutorial data is not mixed in with your work data.
The Trial version of the software converts to a Free version after 30 days. If you have a Free version of the Splunk software, some of the features, such as changing Preferences in the User account menu, are not available. See About Splunk Free in the Admin manual.
The steps for downloading a free Trial version of Splunk Enterprise or Splunk Cloud are described in the tutorial.
What's in this tutorial?
You will learn how to use the Search app to add data to your Splunk deployment, search the data, save the searches as reports, and create dashboards. If you are new to the Search app, this tutorial is the place to start.
How to use this tutorial
Each Part in the Search Tutorial builds on the previous Part. For example, the searches that you create in Part 5 are used to create reports and charts in Part 7. It is important that you don't skip a Part.
- Part 1: Getting started
- Part 2: Uploading the tutorial data
- Part 3: Using the Splunk Search app
- Part 4: Searching the tutorial data
- Part 5: Enriching events with lookups
- Part 6: Creating reports and charts
- Part 7: Creating dashboards
Using the PDF version of the tutorial
You can copy and paste search strings or regular expressions directly into the Search & Reporting App from this online tutorial in your web browser.
Do not copy and paste search strings or regular expressions directly from the electronic PDF into the Search app. Pasting data from the PDF can cause errors in searches, because of hidden characters that are included in the PDF formatting.
See also sections
At the end of most of the topics in this tutorial is a section called See also. These sections contain links to Splunk documentation that is related to the information discussed in that topic.
See Additional resources at the end of this tutorial for information about:
- The Splunk community
- Links to the Splunk documentation
- Providing feedback
What you need for this tutorial
This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.1.0, 7.1.1, 7.1.2, 7.1.3