T

Also called "tables," table datasets ara a dataset type that you can create and curate over time with the Table Editor, if you have the Splunk Datasets Add-on installed. You can derive the initial data for a table dataset from a combination or indexes and source types, an existing dataset, or a search string. Table datasets have all of the features of other dataset types. You additionally can clone them as well as extend them. You can also accelerate table datasets, using the same process as data model acceleration .

Related Products: Platform

A feature that lets you create and curate table datasets . The Table Editor translates sophisticated search commands into simple UI editor interactions. This enables users with little to no SPL expertise to create datasets by filtering events, adding new fields, editing field values, and more. The Table Editor includes a Summarize Fields view that provides analytical information about the fields in the dataset. The Table Editor is available to all Splunk Cloud Platform users by default. Users of Splunk Enterprise get the Table Editor when they download and install the Splunk Datasets Add-on.

Related Products: Platform

Term formerly used for "drilldown". See instead drilldown .

Related Products: Platform

In Platform, a knowledge object that enables you to search for events that contain particular field values. You can assign one or more tags to any field/value combination, including event types , hosts , sources , and source types .

In Observability Cloud, tags can be thought of as labels or keywords assigned to dimensions, metrics, and other objects. They are not key/value pairs. The primary use case for tags is when there is a one-to-many relationship between the tag and the object you are assigning it to. For example, suppose you have hosts that are running multiple apps. You can create a tag for...

Related Products: Platform, Observability Cloud

A set of events that a forwarder collects to route to a particular receiver . For example, you can instruct a forwarder to collect all events that include the word "error" into a target group, and then route that target group to a specific receiver.

Related Products: Platform

Searches generated in your network environment with threat intelligence that enrich machine data to help analysts investigate threats using Splunk Enterprise Security.

Related Products: Platform, Enterprise Security

An observable , such as a URL, file hash, or email address, that poses an increased security risk or is at risk of being the target of a threat.

Related Products: Platform

Related Terms: indicator

Reduce the frequency at which an alert triggers. An alert can trigger frequently based on similar results that the search returns. The schedule to run an alert can also cause the alert to trigger frequently. To reduce the frequency of the alert firing, you can configure a time period in which to suppress results or specify field values that the search returns.

Related Products: Platform

A feature that runs a search to retrieve events with timestamps close to an event you select. _time accelerator runs a secondary search that returns events with timestamps just before, just after, or at the same time as the event you select.

Related Products: Platform

A tool to select and define the time range of a search when using Splunk Web . In the Search and Reporting app , the time range picker appears as a menu on the right side of the search bar. You can also define time range pickers with custom sets of time ranges for forms in views and dashboards . The time range picker lets you run a search for a preset specified time period, such as Last 15 minutes or Yesterday. You can also use the time range picker to define your own custom time range for a search or set up a data collection window for a real-time search . The time range picker is set to Last 24 hours by default. This setting searches for recent events and limits the time range of your search to improve performance. This setting searches the entire set of data in your index , from the oldest events to the most current. For large volumes of data, narrowing the time range of your search can improve its performance.

Related Products: Platform

The window of time for which a real-time search gathers events . For example, if you set up a real-time search with a 30-second window, the search timeline and results area displays the number of matching events that have come in over the past 30 seconds. You can use the time range picker to select a preset time range window or to specify a custom time range window.

Related Products: Platform

See series .

Related Products: Platform

See tsidx file .

Related Products: Platform

A visual representation of the number of events returned by a search over a selected time range. The timeline is a type of histogram, where the range is broken up into smaller time intervals (such as seconds, minutes, hours, or days), and the count of events for each interval appears in column form. When you use the timeline to display the results of real-time searches , the timeline represents the sliding time range window covered by the real-time search.

Related Products: Platform

Related Terms: timeline view

A search view that includes a timeline .

Related Products: Platform

A default field that represents time information in an event . Most events contain timestamps. In cases where an event does not contain timestamp information, the Splunk platform attempts to assign a timestamp value to the event at index time . The Splunk platform uses timestamps to correlate events by time, to create the timeline histogram in Splunk Web, and to set time ranges for searches . In the Knowledge Manager Manual : In Getting Data In :

Related Products: Platform

A way to correct timestamp differences for events in different time zones. You configure timezone offsets in props.conf , using the TZ attribute.

Related Products: Platform

A placeholder for a value that can change, such as a user selection in a form input. Similar to programming variables, you can expand tokens in a search . For example, you can use the $click.value2$ token in a drilldown search to access the table cell value that a user selects.

Related Products: Platform

In Platform, a collection of operations, known as spans, that represents a unique transaction handled by an application and its constituent services.

In Observability Cloud, a trace is a collection of operations that represents a unique transaction handled by an application and its constituent services. Traces are made of spans, which are calls that microservices make to each other.

Related Products: Platform, Observability Cloud

Related Terms: span, splunk opentelemetry collector

A group of conceptually related events that spans time. Events grouped by a transaction often represent a complex, multistep, business-related activity, such as all events related to a single hotel customer reservation session or to a customer session on a retail website. You can use the transaction command to find transactions based on a transaction definition you created ad hoc, or you can use it to locate transactions based on a transaction type you configured in transactiontypes.conf .

Related Products: Platform

A named set of parameters that is passed to the transaction command to create a transaction . You define a transaction type in a transactions.conf configuration file . You use it by passing its name as an argument to the transaction command.

Related Products: Platform

A configuration that causes transformation of event data. You use transforms in several situations, including to create field transforms, to define custom index-time field extractions , and to setup lookups . You can also use transforms to route and filter data. For example, you can send data to alternative indexes, or you can mask sensitive event data, such as customer credit card numbers. You configure transforms in transforms.conf , usually in conjunction with a configuration in props.conf .

Related Products: Platform

A type of extraction that allows you to use a single regular expression across multiple hosts, sources, or source types, or apply multiple regular expressions to a single host, source, or source type. You can find information about when to use transform field extractions in the Configure custom fields at search time topic. In the Knowledge Manager Manual : In Getting Data In : In the Admin Manual :

Related Products: Platform

A type of search command that orders the results into a data table. Transforming commands "transform" the specified cell values for each event into numerical values that Splunk Enterprise can use for statistical purposes. Searches that use transforming commands are called transforming searches . Transforming commands include chart , timechart , stats , top , rare , contingency , and highlight . Transforming commands are required to transform search result data into the data structures required for visualizations such as column, bar, line, area, and pie charts. Note: In earlier versions of Splunk Enterprise, transforming commands were referred to as "reporting commands." In the Search Manual: In the Search Reference: In Dashboards and Visualizations:

Related Products: Platform

A search that uses transforming commands like stats , chart , and timechart to transform event data returned by a search into statistical tables that can be used as the basis for charts and other kinds of data visualizations. In the Search Manual : In the Search Reference : In the Dashboards and Visualizations manual:

Related Products: Platform

A time-series index file, also called an index file . A tsidx file associates each unique keyword in your data with location references to events , which are stored in a companion rawdata file . Together, the rawdata file and its related tsidx files make up the contents of an index bucket . Each search you run scans tsidx files for the search keywords and uses their location references to retrieve from the rawdata file the events to which those keywords refer. To speed up searches, bloom filters narrow the set of tsidx files that Splunk Enterprise must search to get accurate results. Splunk Enterprise creates a separate set of tsidx files for data model acceleration . In this case, it uses the tsidx files as summaries of the data returned by the data model. In Managing Indexers and Clusters of Indexers : In the Knowledge Manager Manual :

Related Products: Platform

A process that eliminates all full-size tsidx files in a bucket and replaces them with mini versions of those files. These mini versions contain only some essential metadata. The resulting reduced buckets are smaller in size but slower to search. In Managing Indexers and Clusters of Indexers :

Related Products: Platform

The tsidx retention policy determines how long the indexer retains the tsidx files that it uses to search efficiently and quickly across its data. By default, the indexer retains the tsidx files for all its indexed data for as long as it retains the data itself. By adjusting the policy, you can set the optimal trade-off between storage costs and search performance. In Managing Indexers and Clusters of Indexers :

Related Products: Platform

The typelearner command is deprecated as of Splunk Enterprise version 5.0. This means that although the command continues to function, it might be removed in a future version. Use the findtypes command instead. A search command that helps you discover and create event types . The typelearner command examines the events that result from a search and then suggests event types. In the Search Reference :

Related Products: Platform