Anurag Sharma

## Understanding and Writing Splunk Searches: Basic to Advanced SPL Queries

### Basics of Splunk Searches

#### 1. **Search Command**
The foundation of any SPL query. It retrieves events from the specified index.

```spl
index=<index_name> search_term
```
Example:
```spl
index=web_logs error
```

#### 2. **Fields and Filters**
Specify fields and apply filters to narrow down search results.

```spl
index=web_logs status=404
```

#### 3. **Time Range**
You can specify a time range using `earliest` and `latest`.

```spl
index=web_logs error earliest=-1h
```

### Intermediate SPL Queries

#### 1. **Stats Command**
The `stats` command is used to aggregate data.

```spl
index=web_logs | stats count by status
```

#### 2. **Table Command**
Use `table` to display specific fields.

```spl
index=web_logs | table _time, status, uri_path
```

#### 3. **Sort Command**
Sort results by a specific field.

```spl
index=web_logs | sort -_time
```

### Advanced SPL Queries

#### 1. **Eval Command**
The `eval` command creates new fields or transforms existing fields.

```spl
index=web_logs | eval status_code_group=if(status>=500, "5xx", "Other")
```

#### 2. **Timechart Command**
Use `timechart` for time-based data aggregation.

```spl
index=web_logs | timechart count by status
```

#### 3. **Join Command**
Join data from different searches.

```spl
index=web_logs | join type=inner user_id [search index=user_info | fields user_id, username]
```

#### 4. **Subsearches**
Execute a search within another search.

```spl
index=web_logs [search index=error_logs | return 100 _raw]
```

### Practical Examples

1. **Finding Top 10 Error URLs**

```spl
index=web_logs status=500 | stats count by uri_path | sort -count | head 10
```

2. **Average Response Time by Host**

```spl
index=web_logs | stats avg(response_time) by host
```

3. **Comparing Traffic Over Two Periods**

```spl
index=web_logs earliest=-30d@d latest=-15d@d | stats count as last_15_30_days
| appendcols [ search index=web_logs earliest=-15d@d latest=now | stats count as last_15_days ]
| eval percent_change=((last_15_days-last_15_30_days)/last_15_30_days)*100
```

### Tips for Effective SPL Queries

1. **Use Indexes Wisely:** Always start your search with the appropriate index to improve performance.
2. **Filter Early:** Apply filters early in your query to limit the amount of data Splunk has to process.
3. **Field Selection:** Use `fields` to include only necessary fields and improve search efficiency.
4. **Leverage Summary Indexing:** For large datasets, consider using summary indexing to store precomputed summaries.