Splunk® Enterprise

Analytics Workspace

Acrobat logo Download manual as PDF


Splunk Enterprise version 8.1 will no longer be supported as of April 19, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Acrobat logo Download topic as PDF

About the Analytics Workspace

The Analytics Workspace provides a user interface that enables you to monitor and analyze metrics and other time series without using SPL. Select data sources to create interactive charts in the workspace. Then, apply filters and aggregations to gain insight into your system's metrics and performance. The Analytics Workspace helps you to quickly identify and respond to any issues or anomalies in your data.

Analytics Workspace functions and operations

The Analytics Workspace comes with a set of analytic functions and operations to help you make sense of your data. These functions generate SPL in the background.

Depending on your data source, the following operations are available:

  • Aggregations summarize data points into meaningful values.
  • Time shifts modify the time range of a series.
  • Splits show results for a specific dimension.
  • Filters include or exclude certain results.

After refining your data, use the Analytics Workspace to perform the following actions:

  • Set up an alert to be notified of certain behavior in your data.
  • Create a dashboard to monitor or share your findings.

To learn about visualizing data, see Types of data in the Analytics Workspace.

To learn about the different parts of the workspace, see Navigate the Analytics Workspace.

To learn more about analytic functions and operations, see Analytics in the Analytics Workspace.

To learn more about alerts, see Alerts in the Analytics Workspace.

To learn more about dashboards, see Dashboards in the Analytics Workspace.

Last modified on 29 January, 2020
  NEXT
Requirements for the Analytics Workspace

This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.2.0, 9.2.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters