Splunk Commands

The table below lists all of the search commands in alphabetical order. There is a short description of the command and links to related commands.

Desired to gain proficiency on Splunk? Explore the blog post on Splunk Training and Placement to become a pro in Splunk.

CommandDescriptionRelated commands
abstractProduces a summary of each search result.highlight
accumKeeps a running total of the specified numeric field.autoregress, delta, trendline, streamstats
addcoltotalsComputes an event that contains sum of all numeric fields for previous events.addtotals, stats
addinfoAdd fields that contain common information about the current search.search
addtotalsComputes the sum of all numeric fields for each result.addcoltotals, stats
analyzefieldsAnalyze numerical fields for their ability to predict another discrete field.anomalousvalue
anomaliesComputes an "unexpectedness" score for an event.anomalousvalue, cluster, kmeans, outlier
anomalousvalueFinds and summarizes irregular, or uncommon, search results.analyzefields, anomalies, cluster, kmeans, outlier
appendAppends subsearch results to current results.appendcols, appendcsv, appendlookup, join, set
appendcolsAppends the fields of the subsearch results to current results, first results to first result, second to second, etc.append, appendcsv, join, set
appendpipeAppends the result of the subpipeline applied to the current result set to results.append, appendcols, join, set
arulesFinds association rules between field values.associate, correlate
associateIdentifies correlations between fields.correlate, contingency
auditReturns audit trail information that is stored in the local audit index.
autoregressSets up data for calculating the moving average.accum, autoregress, delta, trendline, streamstats
bin (bucket)Puts continuous numerical values into discrete sets.chart, timechart
bucketdirReplaces a field value with higher-level grouping, such as replacing filenames with directories.cluster, dedup
chartReturns results in a tabular output for charting. See also, Statistical and charting functions.bin,sichart, timechart
clusterClusters similar events together.anomalies, anomalousvalue, cluster, kmeans, outlier
cofilterFinds how many times field1 and field2 values occurred together.associate, correlate
collectPuts search results into a summary index.overlap
concurrencyUses a duration field to find the number of "concurrent" events for each event.timechart
contingencyBuilds a contingency table for two fields.associate, correlate
convertConverts field values into numerical values.eval
correlateCalculates the correlation between different fields.associate, contingency
crawlCrawls the filesystem for new sources to index.
datamodelExamine data model or data model object and search a data model object.pivot
dbinspectReturns information about the specified index.
dedupRemoves subsequent results that match a specified criteria.uniq
deleteDelete specific events or search results.
deltaComputes the difference in field value between nearby results.accum, autoregress, trendline, streamstats
diffReturns the difference between two search results.
erexAllows you to specify example or counter example values to automatically extract fields that have similar values.extract, kvform, multikv, regex, rex, xmlkv
evalCalculates an expression and puts the value into a field. See also, Evaluation functions.where
eventcountReturns the number of events in an index.dbinspect
eventstatsAdds summary statistics to all search results.stats
extract (kv)Extracts field-value pairs from search results.kvform, multikv, xmlkv, rex
fieldformatExpresses how to render a field at output time without changing the underlying value.eval, where
fieldsRemoves fields from search results.
fieldsummaryGenerates summary information for all or a subset of the fields.analyzefields, anomalies, anomalousvalue, stats
filldownReplaces NULL values with the last non-NULL value.fillnull
fillnullReplaces null values with a specified value.
findtypesGenerates a list of suggested event types.typer
folderizeCreates a higher-level grouping, such as replacing filenames with directories.
foreachRun a templatized streaming subsearch for each field in a wildcarded field list.eval
formatTakes the results of a subsearch and formats them into a single result.
gaugeTransforms results into a format suitable for display by the Gauge chart types.
gentimesGenerates time-range results.
geostatsGenerate statistics which are clustered into geographical bins to be rendered on a world map.stats, xyseries
headReturns the first number n of specified results.reverse, tail
highlightHighlights the specified terms.iconify
historyReturns a history of searches formatted as an events list or as a table.search
inputAdds sources to Splunk or disables sources from being processed by Splunk.
inputcsvLoads search results from the specified CSV file.loadjob, outputcsv
inputlookupLoads search results from a specified static lookup table.inputcsv, join, lookup, outputlookup
iplocationExtracts location information from IP addresses.
joinCombine the results of a subsearch with the results of a main search.appendcols, lookup, selfjoin
kmeansPerforms k-means clustering on selected fields.anomalies, anomalousvalue, cluster, outlier
kvformExtracts values from search results, using a form template.extract, kvform, multikv, xmlkv, rex
loadjobLoads events or results of a previously completed search job.inputcsv
localizeReturns a list of the time ranges in which the search results were found.map, transaction
localopTells Splunk to run subsequent commands, that is all commands following this, locally and not on a remote peer(s).
lookupExplicitly invokes field value lookups.
makecontinuousMakes a field that is supposed to be the x-axis continuous (invoked by chart/timechart)chart, timechart
makemvChange a specified field into a multivalued field during a search.mvcombine, mvexpand, nomv
mapA looping operator, performs a search over each search result.
metadataReturns a list of source, sourcetypes, or hosts from a specified index or distributed search peer.dbinspect
metasearchRetrieves event metadata from indexes based on terms in the logical expression.metadata, search
multikvExtracts field-values from table-formatted events.
multisearchRun multiple streaming searches at the same time.append, join
mvcombineCombines events in search results that have a single differing field value into one result with a multivalue field of the differing field.mvexpand, makemv, nomv
mvexpandExpands the values of a multivalue field into separate events for each value of the multivalue field.mvcombine, makemv, nomv
nomvChanges a specified multivalued field into a single-value field at search time.makemv, mvcombine, mvexpand
outlierRemoves outlying numerical values.anomalies, anomalousvalue, cluster, kmeans
outputcsvOutputs search results to a specified CSV file.inputcsv, outputtext
outputlookupWrites search results to the specified static lookup table.inputlookup, lookup, outputcsv,outputlookup
outputtextOutputs the raw text field (_raw) of results into the _xml field.outputtext
overlapFinds events in a summary index that overlap in time or have missed events.collect
pivotRun pivot searches against a particular data model object.datamodel
predictEnables you to use time series algorithms to predict future values of fields.x11
rangemapSets RANGE field to the name of the ranges that match.
rareDisplays the least common values of a field.sirare, stats, top
regexRemoves results that do not match the specified regular expression.rex, search
relevancyCalculates how well the event matches the query.
reltimeConverts the difference between 'now' and '_time' to a human-readable value and adds adds this value to the field, 'reltime', in your search results.convert
renameRenames a specified field; wildcards can be used to specify multiple fields.
replaceReplaces values of specified fields with a specified new value.
restAccess a REST endpoint and display the returned entities as search results.
returnSpecify the values to return from a subsearch.format, search
reverseReverses the order of the results.head, sort, tail
rexSpecify a Perl regular expression named groups to extract fields while you search.extract, kvform, multikv, xmlkv, regex
rtorderBuffers events from real-time search to emit them in ascending time order when possible.
savedsearchReturns the search results of a saved search.
script, runRuns an external Perl or Python script as part of your search.
scrubAnonymizes the search results.
searchSearches Splunk Enterprise indexes for matching events.
searchtxnFinds transaction events within specified search constraints.transaction
selfjoinJoins results with itself.join
sendemailEmails search results to a specified email address.
setPerforms set operations (union, diff, intersect) on subsearches.append, appendcols, join, diff
setfieldsSets the field values for all results to a common value.eval, fillnull, rename
sichartSummary indexing version of chart.chart, sitimechart, timechart
sirareSummary indexing version of rare.rare
sistatsSummary indexing version of stats.stats
sitimechartSummary indexing version of timechart.chart, sichart, timechart
sitopSummary indexing version of top.top
sortSorts search results by the specified fields.reverse
spathProvides a straightforward means for extracting fields from structured data formats, XML and JSON.xpath
statsProvides statistics, grouped optionally by fields. See also, Statistical and charting functions.eventstats, top, rare
strcatConcatenates string values.
streamstatsAdds summary statistics to all search results in a streaming manner.eventstats, stats
tableCreates a table using the specified fields.fields
tagsAnnotates specified fields in your search results with tags.eval
tailReturns the last number n of specified results.head, reverse
timechartCreate a time series chart and corresponding table of statistics. See also, Statistical and charting functions.chart, bucket
topDisplays the most common values of a field.rare, stats
transactionGroups search results into transactions.
transposeReformats rows of search results as columns.
trendlineComputes moving averages of fields.timechart
tscollectWrites results into tsidx file(s) for later use bytstats command.collect, stats, tstats
tstatsCalculates statistics over tsidx files created with the tscollect command.stats, tscollect
typeaheadReturns typeahead information on a specified prefix.
typelearnerGenerates suggested eventtypes.typer
typerCalculates the eventtypes for the search results.typelearner
uniqRemoves any search that is an exact duplicate with a previous result.dedup
untableConverts results from a tabular format to a format similar to stats output. Inverse ofxyseries and maketable.
wherePerforms arbitrary filtering on your data. See also, Evaluations functions.eval
x11Enables you to determine the trend in your data by removing the seasonal pattern.predict
xmlkvExtracts XML key-value pairs.extract, kvform, multikv, rex
xmlunescapeUnescapes XML.
xpathRedefines the XML path.
xyseriesConverts results into a format suitable for graphing.

For an Indepth knowledge on Splunk, click on below