What are commands in Splunk?

Commands in Splunk are the building blocks of queries written in the Splunk Processing Language (SPL). They are used to search, filter, transform, analyze, and visualize data. Commands allow you to perform specific actions on the data, such as calculating statistics, formatting output, or creating visualizations.

Real-world example

Imagine you're running a customer support platform, and you want to analyze logs to find:

1. How many error messages were logged.
2. The most common type of error.
3. A chart showing error trends over time.

You would use Splunk commands to filter error messages, count their occurrences, and create the chart—all in one query.

Types of Splunk commands

1. Search commands

These filter and retrieve data from the Splunk index.

Examples:

• search: Filters data based on criteria.
• fields: Selects specific fields to display.
• table: Formats the output into a table.

Example:

index=logs status=500 | fields error_message, timestamp

This retrieves logs with status 500 and only displays the error_message and timestamp fields.

2. Transforming commands

These aggregate, calculate, and manipulate data.

Examples:

• stats: Performs calculations like count, sum, average.
• timechart: Creates time-based visualizations.
• chart: Produces charts based on categorical data.

Example:

index=logs | stats count by status

This counts the occurrences of each HTTP status code.

3. Filtering commands

These narrow down results based on conditions.

Examples:

• where: Filters results using expressions.
• dedup: Removes duplicate entries.

Example:

index=logs | where duration > 5

This filters logs where the duration field is greater than 5.

4. Generating commands

These create new data or events.

Examples:

• inputlookup: Pulls data from a lookup table.
• makeresults: Generates artificial results for testing.

Example:

| makeresults count=5

This generates five dummy events.

5. Reporting and visualization commands

These generate insights and visual outputs.

Examples:

• top: Lists the most frequent values in a field.
• rare: Finds the least frequent values.
• geostats: Creates geographic visualizations.

Example:

index=logs | top 5 status

This lists the top 5 most frequent HTTP status codes.

Learn more about Splunk and its commands

To deepen your understanding of how Splunk fits into system design and data monitoring workflows, check out Grokking System Design Fundamentals for beginners. For advanced use cases, the System Design Primer blog is an excellent complement. These resources will help you master data processing with Splunk.