[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-573791-105":53,"doc-detail-573791-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","splunk-quick-reference-guide","Splunk Quick Reference Guide","","Quick Reference Guide provides an overview of Splunk Cloud and Splunk Enterprise, introducing core concepts such as events, transactions, metrics, fields, tags, and the distinctions between host, source, and source type. It explains how index-time and search-time processing extract timestamps, apply line breaking, store data in indexes, and then retrieve and extract fields for searches. The guide also summarizes core features including search, reports, dashboards, and alerts, plus additional capabilities like datasets and data models.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/splunk-quick-reference-guide/573791/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/splunk-quick-reference-guide/573791.png","ImageObject",442,249,{"name":88,"@type":89},"Sophia Brooks","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-16","2026-10-14",true,{"@type":98,"interactionType":99,"userInteractionCount":9},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is an event in Splunk?","Question",{"text":108,"@type":109},"An event is a set of values associated with a timestamp and represents a single entry of data. It can include one or multiple lines and examples range from text documents to configuration files and stack traces.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How do index-time and search-time processing differ?",{"text":113,"@type":109},"During index-time, data is read from a host source, classified into a source type, timestamps are extracted, and events are segmented and written to an index. During search-time, indexed events are retrieved from disk and fields are extracted from the raw text for the event.",{"name":115,"@type":106,"acceptedAnswer":116},"What are Splunk core features like search, reports, dashboards, and alerts used for?",{"text":117,"@type":109},"Search helps retrieve events from indexes and supports calculations, pattern identification, and trend prediction using SPL. Reports are saved searches that can be scheduled and used to power dashboards, while alerts trigger actions when search results meet specified conditions.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},573791,1792117723,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":9,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":47},962084925636,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","QUICK REFERENCE GUIDE  \nThis guide describes key concepts and features, as well as commonly used commands and functions for Splunk Cloud and Splunk Enterprise.  \nConcepts  \nEvents  \nAn event is a set of values associated with a timestamp. It is a single entry of data and can have one or multiple lines. An event can be a text document, a configuration file, an entire stack trace, and so on. This is an example of an event in a web activity log:  \n[173.26.34.223](173.26.34.223) - - [01/Mar/2021:12:05:27 -0700]\"GET /trade/app?action=logout [HTTP/1.1](HTTP/1.1) \" 200 2953  \nYou can also define transactions to search for and group together events that are conceptually related but span a duration of time. Transactions can represent a multistep business-related activity, such as all events related to a single customer session on a retail website.  \nMetrics  \nA metric data point consists of a timestamp and one or more measurements. It can also contain dimensions. A measurement is a metric name and corresponding numeric value. Dimensions provide additional information about the measurements. Sample metric data point:  \nTimestamp: 08-05-2020 16:26:42 .025 -0700  \nMeasurement: metric_name:os .cpu .user=42 . 12, metric_name:max .size .kb=345  \nDimensions: hq=us-west-1, group=queue, name=azd  \nMetric data points and events can be searched and correlated together, but are stored in separate types of indexes.  \nHost, Source, and Source Type  \nA host is the name of the physical or virtual device where an event originates. It can be used to find all data originating from a specific device. A source is the name of the file, directory, data stream, or other input from which a particular event originates. Sources are classified into source types, which can be either well known formats or formats defined by the user. Some  \ncommon source types are [HTTP web server](HTTP web server) logs and Windows event logs.  \nEvents with the same source types can come from different sources. For example, events from the file source=/var/log/messages and from a syslog input port source=UDP:514 often share the source type, sourcetype=linux_syslog.  \nFields  \nFields are searchable name and value pairings that distinguish one event from another. Not all events have the same fields and field values. Using fields, you can write tailored searches to retrieve the specific events that you want. When Splunk software processes events at index-time and search-time, the software extracts fields based on configuration file definitions and userdefined patterns.  \nUse the Field Extractor tool to automatically generate and validate field extractions at search-time using regular expressions or delimiters such as spaces, commas, or other characters.  \nTags  \nA tag is a knowledge object that enables you to search for events that contain particular field values. You can assign one or more tags to any field/value combination, including event types, hosts, sources, and source types. Use tags to group related field values together, or to track abstract field values such as IP addresses or ID numbers by giving them more descriptive names.  \nIndex-Time and Search-Time  \nDuring index-time processing, data is read from a source on a host and is classified into a source type. Timestamps are extracted, and the data is parsed into individual events. Line-breaking rules are applied to segment the events to display in the search results. Each event is written to an index on disk, where the event is later retrieved with a search request.  \nWhen a search starts, referred to as search-time, indexed events are retrieved from disk. Fields are extracted from the raw text for the event.  \nQUICK REFERENCE GUIDE  \nIndexes  \nWhen data is added, Splunk software parses the data into individual events, extracts the timestamp, applies line-breaking rules, and stores the events in an index. You can create new indexes for different inputs. By default, data is stored in the “main” index. Events are retrieved fr","cbCairQJJ38TYRRD","https://ap.wps.com/l/cbCairQJJ38TYRRD","pdf",260855,13,"English","# Concepts\n## Events\n## Metrics\n## Host, Source, and Source Type\n## Fields\n## Tags\n## Index-Time and Search-Time\n# Indexes\n# Core Features\n## Search\n## Reports\n## Dashboards\n## Alerts\n# Additional Features\n## Datasets\n## Data Model","[{\"question\":\"What is an event in Splunk?\",\"answer\":\"An event is a set of values associated with a timestamp and represents a single entry of data. It can include one or multiple lines and examples range from text documents to configuration files and stack traces.\"},{\"question\":\"How do index-time and search-time processing differ?\",\"answer\":\"During index-time, data is read from a host source, classified into a source type, timestamps are extracted, and events are segmented and written to an index. During search-time, indexed events are retrieved from disk and fields are extracted from the raw text for the event.\"},{\"question\":\"What are Splunk core features like search, reports, dashboards, and alerts used for?\",\"answer\":\"Search helps retrieve events from indexes and supports calculations, pattern identification, and trend prediction using SPL. Reports are saved searches that can be scheduled and used to power dashboards, while alerts trigger actions when search results meet specified conditions.\"}]","Splunk Quick Reference Guide | PDF",1791946081]