Category: Search Command of the Week

Are you looking for a way to manipulate field names in your Splunk data? Look no further than the powerful Splunk Rename command. This command

What is the Splunk Where Command? The Splunk where command is one of several options used to filter search results. It uses eval-expressions that return

One of the most important elements of indexing and searching for logs in Splunk is properly dealing with timestamps.

What is the Splunk dedup Command?  The Splunk dedup command, short for “deduplication”, is an SPL command that eliminates duplicate values in fields, thereby reducing

Your dilemma: You have XML or JSON data indexed in Splunk as standard event-type data. Sure, you’d prefer to have brought it in as an

When searching across your data, you may find it necessary to pull fields and values from two different data sources. But is it possible to

    Need some help zipping up your data in Splunk? This week’s Search Command should do the trick. The Splunk Search Command, mvzip, takes

    Halloween is hands down my favorite time of the year. Candy, costumes, scary movies, cold weather, haunted houses (or hayrides), what’s not to love. Every time

Have you ever been stuck with a single field that needed to provide you with a little more… value? The makemv command adds that value. 

    The power of Splunk comes from the insights we pull from our data. And to emphasize… I mean searchable data. Now, Splunk isn’t perfect