Splunk® Enterprise

Search Reference

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Command quick reference

Search command quick reference table

The table below lists all of the search commands in alphabetical order. There is a short description of the command and links to related commands. For the complete syntax, usage, and detailed examples, click the command name to display the specific topic for that command.

Some of these commands share functions. For a list of the functions with descriptions and examples, see Evaluation functions and Statistical and charting functions.

Command Description Related commands
abstract Produces a summary of each search result. highlight
accum Keeps a running total of the specified numeric field. autoregress, delta, trendline, streamstats
addcoltotals Computes an event that contains sum of all numeric fields for previous events. addtotals, stats
addinfo Add fields that contain common information about the current search. search
addtotals Computes the sum of all numeric fields for each result. addcoltotals, stats
analyzefields Analyze numerical fields for their ability to predict another discrete field. anomalousvalue
anomalies Computes an "unexpectedness" score for an event. anomalousvalue, cluster, kmeans, outlier
anomalousvalue Finds and summarizes irregular, or uncommon, search results. analyzefields, anomalies, cluster, kmeans, outlier
anomalydetection Identifies anomalous events by computing a probability for each event and then detecting unusually small probabilities. analyzefields, anomalies, anomalousvalue, cluster, kmeans, outlier
append Appends subsearch results to current results. appendcols, appendcsv, appendlookup, join, set
appendcols Appends the fields of the subsearch results to current results, first results to first result, second to second, etc. append, appendcsv, join, set
appendpipe Appends the result of the subpipeline applied to the current result set to results. append, appendcols, join, set
arules Finds association rules between field values. associate, correlate
associate Identifies correlations between fields. correlate, contingency
audit Returns audit trail information that is stored in the local audit index.
autoregress Sets up data for calculating the moving average. accum, autoregress, delta, trendline, streamstats
bin (bucket) Puts continuous numerical values into discrete sets. chart, timechart
bucketdir Replaces a field value with higher-level grouping, such as replacing filenames with directories. cluster, dedup
chart Returns results in a tabular output for charting. See also, Statistical and charting functions. bin,sichart, timechart
cluster Clusters similar events together. anomalies, anomalousvalue, cluster, kmeans, outlier
cofilter Finds how many times field1 and field2 values occurred together. associate, correlate
collect Puts search results into a summary index. overlap
concurrency Uses a duration field to find the number of "concurrent" events for each event. timechart
contingency Builds a contingency table for two fields. associate, correlate
convert Converts field values into numerical values. eval
correlate Calculates the correlation between different fields. associate, contingency
datamodel Examine data model or data model dataset and search a data model dataset. pivot
dbinspect Returns information about the specified index.
dedup Removes subsequent results that match a specified criteria. uniq
delete Delete specific events or search results.
delta Computes the difference in field value between nearby results. accum, autoregress, trendline, streamstats
diff Returns the difference between two search results.
erex Allows you to specify example or counter example values to automatically extract fields that have similar values. extract, kvform, multikv, regex, rex, xmlkv
eval Calculates an expression and puts the value into a field. See also, Evaluation functions. where
eventcount Returns the number of events in an index. dbinspect
eventstats Adds summary statistics to all search results. stats
extract (kv) Extracts field-value pairs from search results. kvform, multikv, xmlkv, rex
fieldformat Expresses how to render a field at output time without changing the underlying value. eval, where
fields Removes fields from search results.
fieldsummary Generates summary information for all or a subset of the fields. analyzefields, anomalies, anomalousvalue, stats
filldown Replaces NULL values with the last non-NULL value. fillnull
fillnull Replaces null values with a specified value.
findtypes Generates a list of suggested event types. typer
folderize Creates a higher-level grouping, such as replacing filenames with directories.
foreach Run a templatized streaming subsearch for each field in a wildcarded field list. eval
format Takes the results of a subsearch and formats them into a single result.
from Retrieves data from a dataset, such as a data model dataset, a CSV lookup, a KV Store lookup, a saved search, or a table dataset.
gauge Transforms results into a format suitable for display by the Gauge chart types.
gentimes Generates time-range results.
geom Adds a field, named "geom", to each event. This field contains geographic data structures for polygon geometry in JSON and is used for the choropleth map visualization. geomfilter
geomfilter Accepts two points that specify a bounding box for clipping a choropleth map. Points that fall outside of the bounding box are filtered out. geom
geostats Generate statistics which are clustered into geographical bins to be rendered on a world map. stats, xyseries
head Returns the first number n of specified results. reverse, tail
highlight Highlights the specified terms. iconify
history Returns a history of searches formatted as an events list or as a table. search
iconify Displays a unique icon for each different value in the list of fields that you specify. highlight
input Add or disable sources.
inputcsv Loads search results from the specified CSV file. loadjob, outputcsv
inputlookup Loads search results from a specified static lookup table. inputcsv, join, lookup, outputlookup
iplocation Extracts location information from IP addresses.
join Combine the results of a subsearch with the results of a main search. appendcols, lookup, selfjoin
kmeans Performs k-means clustering on selected fields. anomalies, anomalousvalue, cluster, outlier
kvform Extracts values from search results, using a form template. extract, kvform, multikv, xmlkv, rex
loadjob Loads events or results of a previously completed search job. inputcsv
localize Returns a list of the time ranges in which the search results were found. map, transaction
localop Run subsequent commands, that is all commands following this, locally and not on remote peers.
lookup Explicitly invokes field value lookups.
makecontinuous Makes a field that is supposed to be the x-axis continuous (invoked by chart/timechart) chart, timechart
makemv Change a specified field into a multivalued field during a search. mvcombine, mvexpand, nomv
makeresults Creates a specified number of empty search results.
map A looping operator, performs a search over each search result.
metadata Returns a list of source, sourcetypes, or hosts from a specified index or distributed search peer. dbinspect
metasearch Retrieves event metadata from indexes based on terms in the logical expression. metadata, search
mstats Calculates statistics for the measurement, metric_name, and dimension fields in metric indexes. stats, tstats
multikv Extracts field-values from table-formatted events.
multisearch Run multiple streaming searches at the same time. append, join
mvcombine Combines events in search results that have a single differing field value into one result with a multivalue field of the differing field. mvexpand, makemv, nomv
mvexpand Expands the values of a multivalue field into separate events for each value of the multivalue field. mvcombine, makemv, nomv
nomv Changes a specified multivalued field into a single-value field at search time. makemv, mvcombine, mvexpand
outlier Removes outlying numerical values. anomalies, anomalousvalue, cluster, kmeans
outputcsv Outputs search results to a specified CSV file. inputcsv, outputtext
outputlookup Writes search results to the specified static lookup table. inputlookup, lookup, outputcsv, outputlookup
outputtext Outputs the raw text field (_raw) of results into the _xml field. outputtext
overlap Finds events in a summary index that overlap in time or have missed events. collect
pivot Run pivot searches against a particular data model dataset. datamodel
predict Enables you to use time series algorithms to predict future values of fields. x11
rangemap Sets RANGE field to the name of the ranges that match.
rare Displays the least common values of a field. sirare, stats, top
regex Removes results that do not match the specified regular expression. rex, search
reltime Converts the difference between 'now' and '_time' to a human-readable value and adds adds this value to the field, 'reltime', in your search results. convert
rename Renames a specified field; wildcards can be used to specify multiple fields.
replace Replaces values of specified fields with a specified new value.
rest Access a REST endpoint and display the returned entities as search results.
return Specify the values to return from a subsearch. format, search
reverse Reverses the order of the results. head, sort, tail
rex Specify a Perl regular expression named groups to extract fields while you search. extract, kvform, multikv, xmlkv, regex
rtorder Buffers events from real-time search to emit them in ascending time order when possible.
savedsearch Returns the search results of a saved search.
script (run) Runs an external Perl or Python script as part of your search.
scrub Anonymizes the search results.
search Searches indexes for matching events.
searchtxn Finds transaction events within specified search constraints. transaction
selfjoin Joins results with itself. join
sendemail Emails search results to a specified email address.
set Performs set operations (union, diff, intersect) on subsearches. append, appendcols, join, diff
setfields Sets the field values for all results to a common value. eval, fillnull, rename
sichart Summary indexing version of chart. chart, sitimechart, timechart
sirare Summary indexing version of rare. rare
sistats Summary indexing version of stats. stats
sitimechart Summary indexing version of timechart. chart, sichart, timechart
sitop Summary indexing version of top. top
sort Sorts search results by the specified fields. reverse
spath Provides a straightforward means for extracting fields from structured data formats, XML and JSON. xpath
stats Provides statistics, grouped optionally by fields. See also, Statistical and charting functions. eventstats, top, rare
strcat Concatenates string values.
streamstats Adds summary statistics to all search results in a streaming manner. eventstats, stats
table Creates a table using the specified fields. fields
tags Annotates specified fields in your search results with tags. eval
tail Returns the last number n of specified results. head, reverse
timechart Create a time series chart and corresponding table of statistics. See also, Statistical and charting functions. chart, bucket
timewrap Displays, or wraps, the output of the timechart command so that every timewrap-span range of time is a different series. timechart
top Displays the most common values of a field. rare, stats
transaction Groups search results into transactions.
transpose Reformats rows of search results as columns.
trendline Computes moving averages of fields. timechart
tscollect Writes results into tsidx file(s) for later use by tstats command. collect, stats, tstats
tstats Calculates statistics over tsidx files created with the tscollect command. stats, tscollect
typeahead Returns typeahead information on a specified prefix.
typelearner Generates suggested eventtypes. typer
typer Calculates the eventtypes for the search results. typelearner
union Merges the results from two or more datasets into one dataset.
uniq Removes any search that is an exact duplicate with a previous result. dedup
untable Converts results from a tabular format to a format similar to stats output. Inverse of xyseries and maketable.
where Performs arbitrary filtering on your data. See also, Evaluations functions. eval
x11 Enables you to determine the trend in your data by removing the seasonal pattern. predict
xmlkv Extracts XML key-value pairs. extract, kvform, multikv, rex
xmlunescape Unescapes XML.
xpath Redefines the XML path.
xyseries Converts results into a format suitable for graphing.
Last modified on 17 September, 2021
Splunk Quick Reference Guide   Commands by category

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters