Search Reference


Search command cheatsheet

Search command cheatsheet

Use the cheatsheet for learning the Splunk Search Processing Language (SPL).

Cheatsheet PDF

The search command cheatsheet is a quick command reference complete with descriptions and examples. The cheatsheet is an eight-page PDF file. You can open the PDF and save the file on your computer.

Open the Search command cheatsheet

Note: The examples in this cheatsheet use a leading ellipsis (...) to indicate that there is a search before the pipe operator. A leading pipe indicates that the search command is a generating command and prevents the command-line interface and Splunk Web from prepending the search command to your search.

See also

Splunk Answers

If you can't find what you're looking for here, check out Splunk Answers and see what questions and answers other Splunk users had about the search language.

This documentation applies to the following versions of Splunk: 6.1 , 6.1.1 , 6.1.2 , 6.1.3 , 6.1.4 , 6.1.5 , 6.1.6 , 6.1.7 , 6.1.8 , 6.1.9 , 6.2.0 , 6.2.1 , 6.2.2 , 6.2.3 , 6.2.4 , 6.2.5 View the Article History for its revisions.


Where above it says...

Extract field/value pairs that are delimited by |;, and values of fields that are delimited by =:

I would recommend you change it to...

Extract field/value pairs that are delimited by | or ;, and values of fields that are delimited by = OR :

Which is how it behaves. This caused a fair amount of confusion because we were trying to handle situations with multi-character delimiters. Eventually found another way using transforms to handle that use case.

March 31, 2015

You must be logged into in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!