Splunk® Enterprise

Search Tutorial

Download manual as PDF

About the Search Tutorial

The Search & Reporting application (Search app) is the primary interface for using the Splunk software to run searches, save reports, and create dashboards. This Search Tutorial is written for the user who is new to the Splunk software and the Search app.

You can use this tutorial to learn how to use the Search app, regardless of the Splunk platform you use. The differences between Splunk Enterprise and Splunk Cloud are specified throughout this tutorial.

Already have access to Splunk software?

For this tutorial, use a free trial version of the Splunk software.

Why? Because this tutorial uses a specific set of data to ensure consistency in your search results and the features that you are learning about. In the tutorial, you will upload this tutorial-specific data to the Splunk platform. You might not have permission to upload data in your production, work environment. Additionally, using a free trial version of the software ensures that the tutorial data is not mixed in with your work data.

The steps for downloading a free trial version of Splunk Enterprise or Splunk Cloud are described in the tutorial.

What's in this tutorial?

You will learn how to use the Search app to add data to your Splunk platform, search the data, save the searches as reports, and create dashboards. If you are new to the Search app, this tutorial is the place to start.

How to use this tutorial

Each Part in the Search Tutorial builds on the previous Part. For example, the searches that you create in Part 5 are used to create reports and charts in Part 7. It is important that you don't skip a Part.

Using the PDF version of the tutorial

You can copy and paste search strings or regular expressions directly into the Search & Reporting App from this online tutorial in your web browser.

Do not copy and paste search strings or regular expressions directly from the electronic PDF into the Search app. Pasting data from the PDF can cause errors in searches, because of hidden characters that are included in the PDF formatting.

See also sections

At the end of most of the topics in this tutorial is a section called See also. These sections contain links to Splunk documentation that is related to the information discussed in that topic.

Additional resources

See Additional resources at the end of this tutorial for information about:

  • The Splunk community
  • Links to the Splunk documentation
  • Providing feedback
What you need for this tutorial

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1 View the Article History for its revisions.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole
Feedback you enter here will be delivered to the documentation team

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters