S

A search that a user makes available for later use. There are many types of saved searches, including reports , alerts , scheduled searches , swimlane searches, and KPIs. All of these saved search types are configured in savedsearches.conf . Saved searches are knowledge objects .

Related Products: Platform

A scheduled alert is an alert that runs on a regular interval, making it a type of scheduled search . You can specify the schedule and trigger conditions, and you can define the alert actions that take place when the alert is triggered. For example, you can monitor sales using a scheduled alert that searches daily for purchase events. The alert can trigger an alert action when there are fewer than 500 purchases. Scheduled alerts are similar to scheduled reports , which also run on regular intervals. The difference is that scheduled reports initialize one or more alert actions each time they run, while scheduled alerts only initialize alert actions when they are triggered.

Related Products: Platform

A report that is scheduled to run on a regular interval, making it a type of scheduled search . Scheduled reports typically initialize one or more alert actions each time they run, such as sending the results of the report run to a set of recipients, logging and indexing custom log events, or adding the results to a CSV lookup. You can also use scheduled reports to populate summary indexes .

Related Products: Platform

Related Terms: real-time search

A scheduled search is a saved search that runs on a specific interval, such as daily, every two hours, two hours after midnight on the first of the month, and so on. Scheduled reports , scheduled alerts , and correlation searches are types of scheduled searches.

Related Products: Platform

A Splunk software process that prioritizes concurrently-running search jobs. It enforces rules that are meant to reduce the number of scheduled report runs that are skipped when the concurrent search limit is reached. Scheduler options are set in limits.conf and savedsearches.conf .

Related Products: Platform

Related Terms: search scheduler

An option for Splunk Enterprise authentication. You can use an authentication system that you have in place (such as PAM or RADIUS) by configuring authentication.conf to use a script instead of using LDAP or Splunk Enterprise default authentication.

Related Products: Platform

An executable script that feeds event data to a Splunk Enterprise instance from APIs and other remote data interfaces and message queues. Use scripted inputs to index the data or to prepare data from a nonstandard source so that events and extracted fields can be properly parsed. You can use shell scripts, python scripts, Windows batch files, PowerShell, or any other utility that can format and stream the data that you want to index. You can stream the data or write the data from a script to a file. Use scripted inputs to get data from Active Directory, WMI (Windows Management Interface), Registry, and other Windows data sources. You can also download additional apps from Splunk Apps that use scripted inputs to enable data collection from other applications.

Related Products: Platform

The primary way users navigate data in Splunk Enterprise and Splunk Cloud Platform. You can write a search to retrieve events from an index, use statistical commands to calculate metrics and generate reports , search for specific conditions within a rolling time range window , identify patterns in your data, predict future trends, and so on. You can save searches as reports and use them to power dashboard panels.

Related Products: Platform

Related Terms: ad hoc search, saved search, search processing language

The ability to configure a multisite indexer cluster so that each search head gets its search results from peer nodes on its local site only, as long as the site is valid . Search affinity has the benefit of reducing network traffic while still providing access to the full set of data.

Related Products: Platform

Related Terms: indexer cluster

The common name for the Search & Reporting app, which is the default interface for searching and analyzing IT data in Splunk Enterprise. You can use the Search & Reporting app to index data, manage knowledge objects , build reports , configure alerts , and create dashboards .

Related Products: Platform

The results and associated metadata from a completed search job . You can inspect the artifact of a search job in the Job Inspector and the Jobs page in Splunk Web. Artifacts are stored in the dispatch directory in $SPLUNK_HOME$/var/run/splunk/dispatch/ .

Related Products: Platform

A reference guide for the Search Processing Language commands and syntax that you can access from the search bar. When search assistant is active it displays typeahead information as you type terms into the bar. When you type a search command into the bar, search assistant displays information for how to use the command, usage examples, a history of recent searches you built that use the command, and so on. Search assistant also includes a link to the search command's documentation. In the Search Manual :

Related Products: Platform

An instruction that can be used to define how the search will be executed. A search execution directive does not actually apply to a specific term in the search, but to how search is executed. It is primarily used to optimize performance.

Related Products: Platform

The number of searchable copies of data that an indexer cluster maintains. On a multisite indexer cluster , a special version of the search factor, known as the site search factor, determines not only the number of searchable copies that the entire cluster maintains but also the number of copies that each site maintains.

Related Products: Platform

Related Terms: searchability, replication factor

A field that is extracted at search time automatically or with the help of custom field extraction configurations, the field extractor , or search commands such as rex . Fields that are extracted during event data processing and indexing are referred to as default fields or indexed fields .

Related Products: Platform

A limited type of search string that is defined for and applied to a given role through Settings > Access controls > Roles or the authorize.conf file, thereby constraining what data users in the role can access by using search . Search filters are additive. If a user is a member of more than one role with search filters applied, all applicable search filters are joined with a Boolean 'OR'.

Related Products: Platform

In a distributed search environment, a Splunk Enterprise instance that handles search management functions, directing search requests to a set of search peers and then merging the results back to the user. A Splunk Enterprise instance can function as both a search head and a search peer. A search head that performs only searching, and not any indexing, is referred to as a dedicated search head. Search head clusters are groups of search heads that coordinate their activities. Search heads are also required components of indexer clusters.

Related Products: Platform

A group of Splunk Enterprise search heads that serve as a central resource for searching. The search heads in a cluster are interchangeable. You can run or access the same searches, dashboards, knowledge objects, and so on, from any member of the cluster. To achieve this interchangeability, the search heads in the cluster share configurations, apps, search artifacts, and job loads.

Related Products: Platform

Related Terms: search head clustering, indexer cluster

The member of a search head cluster that regulates the functioning of the cluster.

Related Products: Platform

Related Terms: dynamic captain, static captain

A search head that participates in a search head cluster. Note: The deployer is not a search head cluster member.

Related Products: Platform

Related Terms: search head cluster captain

A type of Splunk Enterprise deployment that consists of groups of search heads configured to serve as a central resource for searching.

Related Products: Platform

Related Terms: search head cluster, index replication

A type of Splunk Enterprise deployment that uses shared storage to configure multiple search heads so that they share configuration and user data. Note: Search head pooling was deprecated in Splunk Enterprise 6.2 and removed from the product in Splunk Enterprise 8.0.

Related Products: Platform

Related Terms: search head cluster

The act of targeting a specific search head or search head cluster when running an Admin Config Service (ACS) API operation in Splunk Cloud Platform. When targeting a search head, you must specify the URL prefix of the destination search head in the ACS endpoint request.

Related Products: Platform

see job

Related Products: Platform

A tool in Splunk Web that you can use to troubleshoot search performance and understand the behavior of knowledge objects such as event types , tags , lookups , and so on within the search. You can inspect search jobs that are currently running or that have finished recently. Click the Job menu and select Inspect job .

Related Products: Platform

A knowledge object that will be reused. It contains a portion of a search or a search function. A search macro has a unique name. When you reference a search macro in a search, you use back tick characters to denote the start and end of the macro reference. For example, to run a search with a search macro titled pageviews_per_second , type: `pageviews_per_second`

Related Products: Platform

The function of handling search requests and consolidating the results back to the user. In the case of distributed searches , a dedicated Splunk Enterprise component, called the search head , handles search management. It distributes search requests across a set of search peers , which perform the actual searching, and then merges the results back to the user. In the case of a single-instance installation, one Splunk Enterprise instance handles search management along with the indexing and searching functions.

Related Products: Platform

A setting that optimizes your search performance by controlling the amount or type of data that the search returns. Search mode has three settings: Fast, Verbose, and Smart.

Related Products: Platform

A Splunk platform instance that responds to search requests from a search head . The term "search peer" is usually synonymous with the indexer role in a distributed search topology. However, other instance types also have access to indexed data, particularly internal diagnostic data, and thus function as search peers when they respond to search requests for that data.

Related Products: Platform

A process that replicates search peer configurations among search head cluster members . With search peer replication, you need add a new search peer to one cluster member only. The cluster then adds the peer to all other members as well.

Related Products: Platform

The language designed by Splunk for use with Splunk software. There are 2 versions of the Search Processing Language. See SPL and SPL2 .

Related Products: Platform

See scheduler .

Related Products: Platform

Refers to the period of time beginning when a search is launched and ending when it finishes. During search time, certain types of event processing take place, such as search time field extraction , field aliasing , source type renaming, event type matching, and so on. In the context of Splunk Observability Cloud, use search-time rules to transform your data, or a designated subset of your data, during a unique search in Log Observer. The transformation is temporary, occurring only in the search results, not in the data itself.

Related Products: Platform

See timeline .

Related Products: Platform

A type of view that you can use to run a search . A search view can consist of the following modules : a search bar or form search elements, a time range picker , and a display of the search results. In Developing Views and Apps for Splunk Web :

Related Products: Platform

The state of a bucket copy in an indexer cluster that determines whether the copy includes index files and is immediately searchable. A copy of a bucket can be either searchable or non-searchable . A complete cluster has search factor number of searchable copies of each bucket. One of the searchable copies is also primary .

Related Products: Platform

A searchable copy of a bucket in an indexer cluster is a copy that includes index files and is immediately searchable. For each bucket, one of the searchable copies is marked primary .

Related Products: Platform

Related Terms: searchability, non-searchable

A searchable part of an event. Splunk Enterprise breaks events into segments, a process known as "segmentation," at index time and at search time. Segmentation is highly configurable. Index-time segmentation affects indexing and search speed, disk compression, and the ability to use typeahead functionality. Search-time segmentation affects search speed and the ability to create searches by selecting items from search results.

Related Products: Platform

The act of making a currently running search run "in the background" while you work on other projects in the "foreground" of the Search view . When a backgrounded search finishes running, Splunk Web displays a notification. Sending a search to the background saves the resulting search job for seven days, exactly as if you had saved the search job from within the Job Manager.

Related Products: Platform

A workflow that runs correlation searches in an order of your choice, specifying which notable events must occur to proceed to the next step.

Related Products: Platform

Also referred to as a "data series." Series is a sequence of related data points that are plotted in a chart. For example, if you have a bar chart that shows the sum of kilobytes processed per hour by three web servers over the past six hours, each of the three web servers represents a series. Certain visualization types can support only a single series, while others can support multiple series. When a series is plotted over a time range, it is referred to as a "time series." A time series displays statistical trends over time.

Related Products: Platform

In the Splunk Enterprise context, a term that refers to an instance of Splunk Enterprise. See instance .

Related Products: Platform

A group of deployment clients . Server classes facilitate the management of a set of deployment clients as a single unit. A server class can group deployment clients by application, operating system, data type to be indexed, or any other feature of a Splunk Enterprise deployment. A deployment server uses server classes to determine what content to deploy to groups of deployment clients. The forwarder management interface offers an easy way to create, edit, and manage server classes.

Related Products: Platform

A special section of Splunk Web where you can create configurations and knowledge objects or edit existing ones. Most of the settings in the Splunk Enterprise configuration files are also available in Settings. You can use Settings to monitor license usage, configure inputs, set up forwarding and receiving, create and administrate users and roles , set up permissions enabling those users and roles to view and interact with knowledge objects, and more. Before Splunk Enterprise 6.0.0, this section was called the Manager .

Related Products: Platform

The language in Splunk Observability Cloud used to describe analytics computations. SignalFlow programs filter, transform, and do statistical computations on incoming data. Observability Cloud uses SignalFlow programs to generate charts and detectors from incoming metrics. Users can also send SignalFlow programs to Observability Cloud using the API.

Related Products: Platform

The SignalFx Smart Agent receiver is an OpenTelemetry component that gets data into the Splunk Distribution of the OpenTelemetry Collector using existing Smart Agent monitors.

Related Products: Platform

Related Terms: splunk distribution of opentelemetry collector

Simple XML source code defines dashboard and form structure, elements, and behavior. Use the Dashboard Editor to build or edit dashboards in Simple XML. You can also export Simple XML dashboards to HTML if you are building apps with the Splunk Web Framework .

Related Products: Platform

A deployment that consists of a single Splunk Enterprise instance , which handles all data processing functions, including data input , indexing , and search management . A single-instance deployment can be useful for a small organization or testing purposes.

Related Products: Platform

An indexer cluster in which all nodes reside on a single site. This is the basic cluster configuration and, prior to Splunk Enterprise 6.1, was the only configuration available.

Related Products: Platform

Related Terms: multisite indexer cluster

An indexer feature that provides a way to use remote object stores, such as Amazon S3, to store indexed data. By reducing reliance on local storage, SmartStore allows you to scale compute and storage resources separately, thus improving the efficiency of resource usage.

Related Products: Platform

A default field that identifies the source of an event , that is, where the event originated. In the case of data monitored from files and directories, the source consists of the full pathname of the file or directory. In the case of a network-based source, the source field consists of the protocol and port, such as UDP:514. Each event has a source field. The indexer generates the source field at index time. Searches often use the source as a criterion.

Related Products: Platform

Related Terms: source type

A default field that identifies the data structure of an event . A source type determines how the Splunk platform formats the data during the indexing process. Example source types include access_combined and cisco_syslog . The Splunk platform comes with a large set of predefined source types, and it assigns a source type to your data. You can override this assignment by assigning an existing source type or creating a custom source type. The indexer identifies and adds the source type field when it indexes the data. As a result, each indexed event has a sourcetype field. Use the sourcetype field in searches to find all data of a certain type (as opposed to all data from a certain source).

Related Products: Platform

Related Terms: source

In Platform, a single operation within a system of applications and services. Spans include span tags, which provide metadata such as the location and duration of the operations they represent. A group of related spans makes up a trace.

In Observability Cloud, a span is a single operation within a trace. A session is made up of a collection of spans and traces.

Related Products: Platform, Observability Cloud

Related Terms: span tag, trace

A piece of metadata attached to a span that provides more information about the operation the span represents. Examples of span tags include service.name and http.operation. You can add span tags to spans during instrumentation or in the Splunk OpenTelemetry Collector. Span tags are also known as "attributes" in the OpenTelemetry context.

Related Products: Platform

Related Terms: trace, splunk opentelemetry collector

SPL is the abbreviation for the Splunk Search Processing Language. The Search Processing Language is a set of commands that you use to search your data. There are 2 versions of the Search Processing Language: SPL and SPL2. SPL encompasses all the search commands and their functions, arguments, and clauses. The SPL syntax was originally based on the UNIX pipeline and SQL. The scope of SPL includes data searching, filtering, modification, manipulation, insertion, and deletion.

Related Products: Platform

Related Terms: spl2, search

SPL2 is the abbreviation for Splunk Search Processing Language, version 2. Search Processing Language is a set of commands that you use to search your data. There are 2 versions of the Search Processing Language: SPL and SPL2. SPL2 is a product-agnostic, intuitive language that includes the best of both query and scripting languages. SPL2 supports both SPL and SQL syntax patterns. SPL2 is designed to work with the variety of runtimes in the Splunk product portfolio. SPL2 is backwards compatible with SPL, and can operate in parallel with SPL.

Related Products: Platform

Related Terms: spl, search

SPL2 searches and other types of data-related code that you create inside an SPL2 module. There are several different types of SPL2 statements:

Related Products: Platform

Related Terms: module (spl2)

Splunk Answers is a community site where you can ask and answer specific questions relating to Splunk Enterprise and apps. For Splunk Answers go to: https://community.splunk.com .

Related Products: Platform

In Platform, the Splunk Observability Cloud version of the open-source OpenTelemetry Collector. This service provides a unified way to receive, process, and export traces, metrics, and logs for Splunk Observability Cloud. Splunk Distribution of OpenTelemetry Collector is hosted on a public GitHub repository. See https://github.com/signalfx/splunk-otel-collector on GitHub.

In Observability Cloud, the Splunk Distribution of OpenTelemetry Collector is a package that bundles the Splunk Distribution of OpenTelemetry Collector with additional components to provide integrated collection and forwarding of traces, metrics, and logs for a specific platform. Configuring the Splunk Distribution of OpenTelemetry Collector uses the agent deployment method.

Related Products: Platform, Observability Cloud

Related Terms: splunk opentelemetry collector

A package that bundles Splunk Distribution of OpenTelemetry Collector with additional components. The package provides integrated collection and forwarding of traces, metrics, and logs for a specific platform, such as Kubernetes, Linux, and Windows.

Related Products: Platform

Related Terms: splunk distribution of opentelemetry collector

The Splunk platform refers to both Splunk Cloud Platform and Splunk Enterprise.

Related Products: Platform

A toolkit for creating custom user interfaces for Splunk apps using React components, JSON dashboards , charts, and other visualizations . You can use tools such as React UI, Unified Dashboard Framework, and visualizations through the Splunk UI Toolkit.

Related Products: Platform

The interactive graphical user interface in Splunk software. You access Splunk Web through a web browser. Splunk Web is the primary interface for problem investigation, reporting on results, and administration of one or more Splunk Enterprise deployments. You can also manage Splunk software at the command-line using splunkd , a distributed C/C++ server.

Related Products: Platform

A framework for creating custom Splunk Enterprise apps and dashboards with tables, charts, forms, and other visualizations . The Splunk Web Framework includes tools such as the Dashboard Editor and simple XML in Splunk Web, and has the ability to add custom CSS, HTML, and JavaScript by using SplunkJS Stack .

Related Products: Platform

A site where users can share and access apps and add-ons with the Splunk community'. If you create an app or an add-on, you can publish it on Splunkbase to share it with the Splunk community. You can also download apps and add-ons on Splunkbase to install on a Splunk platform instance.

Related Products: Platform

The system process that handles indexing, searching, forwarding, and (as of Splunk Enterprise version 6.2) the Web interface that you log into Splunk Enterprise with. The process is a distributed C/C++ binary that accesses, processes, and indexes streaming data and handles search requests. It also handles the Splunk Web interface as of Splunk Enterprise version 6.2. You can configure the splunkd service without the Splunk Web component by configuring the instance as a light or heavy forwarder. Universal forwarders also run splunkd , but those instances cannot provide Splunk Web and can forward only unparsed data.

Related Products: Platform

A web stack component of the Splunk Web Framework for web developers who want to create Splunk apps in a familiar JavaScript environment. SplunkJS Stack includes prebuilt components for search managers and visualizations, along with JavaScript libraries such as Backbone, RequireJS, and jQuery.

Related Products: Platform

A report option in Splunk Enterprise. If you are using an area or column chart to report on multiple field values, you can specify one of two stack modes: stacked or 100% stacked. The example shows a stacked chart in which each colored chunk represents an HTTP status code.

Related Products: Platform

A single independent search head that is not part of a search head cluster. You can configure a standalone search head to run ad hoc searches , scheduled searches , or both.

Related Products: Platform

A section of a configuration file . Stanzas begin with a text string enclosed in brackets and contain one or more configuration parameters defined by key/value pairs. For example, if you edit inputs.conf to add an input, name the stanza with the source of the input. Then specify settings for that input, either the source type or host name. The following is an example of a stanza in props.conf.

Related Products: Platform

Related Terms: attribute

A search head cluster captain that is designated by the administrator. Static captains do not change dynamically. They change only through explicit reconfiguration by the administrator. The main use for a static captain is to work around some problem that prevents the cluster from electing a dynamic captain.

Related Products: Platform

Related Terms: dynamic captain

A command that runs on the indexer and can be applied to subsets of index data in a parallel manner. A streaming command applies a transformation to each event returned by a search. For example, the rex command is streaming because it extracts and adds fields to events at search time. Streaming commands run in a distributed manner in parallel on individual indexers, unless the streaming command occurs after a non-streaming command. In contrast, non-streaming commands are centralized and run at the search head . These commands analyze the entire set of data available at the search head, and then derive the search result output from that set.

Related Products: Platform

A search pipeline that is enclosed in square brackets, the result of which is used as an argument in an outer or primary search. The result of a subsearch is often one distinct result, such as a top value. You can use subsearches to match subsets of your data that you cannot describe directly in a search expression, but which can be generated from a search. For example, to find the most active host in the last hour:

Related Products: Platform

A special index that stores the results of a scheduled report , when you enable summary indexing for the report. Summary indexing lets you run fast searches over large data sets by spreading out the cost of a computationally expensive report over time. To achieve this, the search that populates the summary index runs on a frequent, recurring basis and extracts the specific data that you require. You can then run fast and efficient searches against this small subset of data in the summary index.

Related Products: Platform