Extracting insights from Cloud Platform
Getting your data in is just the beginning — it's what you do with it that counts.
Search
Understanding how to search in Splunk is the basis for almost everything you build, so we recommend taking your time to get familiar with our web-based interface (Splunk Web), the command line interface (CLI), and Splunk SPL.
- Take a look at our handy Search Manual, which outlines the keys of parts of getting started with search. It also includes a Search Tutorial for step-by-step guidance to try it out yourself.
- For another learning style, you can watch our Search Basic Tech Talk, a 20 minute webinar introduction to searching in Splunk.
Pro Tip: Keep this Splunk Quick Reference Guide by your side at the start of your Splunk Journey for a convenient reference card with the most important fundamentals.
Splunk Search Language (SPL)
SPL is the Splunk search language. Use our Search Reference Guide to find a catalog of the search commands with complete syntax, descriptions, and examples. Additionally, this manual includes quick reference information about the categories of commands, the functions you can use with commands, and how SPL relates to SQL. Take some time to understand how to specify time ranges as restricting, or filtering, your search criteria using a time range is the easiest and most effective way to optimize your searches.
Splunk Platform REST API
Use these tutorials to see how you can use the Splunk Platform REST API and learn about available endpoints and operations for accessing, creating, updating, or deleting resources.
Reports
Once you have conducted a search, you can save it as a report for later reuse. Once you have a report, you can do things such as:
- Manually create and edit reports. Add reports to the Report listing page from either Search or Pivot. In Splunk Enterprise, configure a report manually in
savedsearches.conf. Convert a dashboard panel to a report. Share your report with others by changing its permissions. - Accelerate slow-completing reports, either during the report creation process or at a later point in time.
- Set up scheduled reports, which are reports that run on a regular interval and which trigger an alert action (such as the sending of an email with search results) each time they run. Scheduled reports are also used for summary indexing.
- Configure the priority of scheduled reports. Learn how the Report Scheduler manages multiple concurrent reports and learn how to configure your Report Scheduler options.
- Learn how to generate PDFs of reports, dashboards, searches, and pivots. Enable non-Latin fonts in PDFs. In Splunk Enterprise, configure PDF generation by editing .conf files. Review the exceptions to this functionality.
Dashboards
You can also save searches and reports to dashboards. Creating powerful dashboards is important, as it lets you share insights that turn your data into doing. We have two dashboard-building experiences for you to use:
- Classic (Simple XML). Our original dashboarding experience that uses Simple XML as the source code and has a limited user interface but offers flexibility for custom code and complex interactivity.
- Dashboard Studio. Our intuitive, point-and-click experience with customizable formats and advanced visualization tools best for quickly and easily building story-telling dashboards.
For more information on their differences, check out these side-by-side capability comparisons.
For a brief overview on dashboard building, read through our Dashboards Quick Start Guide to learn the most important fundamentals. Make sure to keep this guide handy as you build your dashboards.
Splunk dashboard tips
- When you’re getting started with dashboards, be sure to follow these dashboarding best practices for long-term success once your dashboards are in production.
- As you continue to grow your dashboarding skills, be sure to check out our plethora of .conf (our annual user conference!) sessions with advanced tips and techniques to customize your dashboards for any use.
Alerts
Use alerts to monitor for and respond to specific events. Alerts use a saved search to look for events in real time or on a schedule. Alerts trigger when search results meet specific conditions. You can use alert actions to respond when alerts trigger. Review the alerting workflow to understand the different parts of setting up alerts.
Pro Tip: You will continue to see how powerful alerts can be, which will make you want to set up many more! But beware of alert fatigue. Learn how to prevent and address alert fatigue.