VMware ESXi and vSphere Cluster Management

Splunk Search Rules and Basic SPL Syntax

Learn fundamental Splunk search rules, including case-insensitive terms, phrases, Boolean logic, and introductory SPL commands such as sort and table.

The Splunk Search app is the interface used to run searches and inspect matching events or generated results. Enter a search expression in the search bar, select an appropriate time range, and run the search.

An event is a record of machine-generated data indexed by Splunk. Events commonly contain a timestamp, raw text, and extracted fields. A search returns events that match the criteria in the search expression.

SPL, or Search Processing Language, is Splunk's language for searching data, filtering events, processing results, and presenting information in useful formats.

Searching in the Splunk Search app

A search term is a word, value, phrase, or condition used to identify relevant events. A simple search can contain one term:

error

Splunk searches the selected data and time range for events matching that term. You can add terms, phrases, Boolean operators, and field conditions to make the search more specific.

After the initial search, a pipe character (|) can pass the results to an SPL command. This creates a pipeline: the output from one search or command becomes the input to the next command.

failed login | sort - _time

In this example, the initial search identifies matching events, and sort orders the results. SPL has many commands, options, arguments, and clauses beyond these introductory examples.

Case-insensitive search behavior

Ordinary search terms are generally case insensitive. This means that letter capitalization is treated as equivalent when Splunk matches a normal term. You usually do not need separate searches for uppercase, lowercase, and mixed-case versions.

For the same data and time range, these three ordinary searches are intended to produce equivalent matching results.

Combining multiple search terms

Multiple terms can appear in one search expression. When adjacent unqualified terms are written without another Boolean operator, Splunk treats them as an implicit AND.

failed login

This search requires matching events to contain both failed and login. It is more restrictive than searching for either word alone.

Implicit AND is useful when several concepts must be present in every matching event. If either concept should qualify an event, use OR instead.

Exact phrase searches

A phrase search places consecutive words inside double quotation marks. The words must appear together in the specified order as a phrase.

"failed login"

This searches for the message fragment failed login as a phrase. It differs from the unquoted search:

failed login

The unquoted form uses implicit AND. It can match an event containing both words even when they are separated or appear in a different context. Quotation marks are appropriate when the exact consecutive wording matters.

Boolean logic

Boolean logic combines or excludes search conditions. The main introductory operators are AND, OR, and NOT.

AND and implicit AND

AND states that both conditions must match:

failed AND login

Adjacent terms usually express the same requirement more concisely:

failed login

Both forms communicate that an event must satisfy both conditions. The adjacent form is called implicit AND because the operator is understood even though it is not written.

OR for alternatives

OR broadens a search. An event can match either alternative:

error OR warning

This returns events containing error, events containing warning, or events containing both.

NOT for exclusions

NOT excludes events containing the unwanted term:

login NOT success

This searches for login-related events while excluding events that contain success.

Parentheses for grouping

Parentheses make mixed Boolean expressions easier to read and help control which alternatives belong together.

(error OR warning) host=web01

Here, the event must match either error or warning, and it must also match host=web01. Grouping the alternatives makes the intended logic explicit.

Introduction to SPL commands

The initial part of a search filters event data. Commands after a pipe can transform or present the resulting data.

• Event filtering: The initial terms identify which events qualify.
• Result transformation: Commands can calculate, reshape, or reorder results.
• Result presentation: Commands can select fields and arrange output for easier reading.

The pipe character separates stages:

base search | command arguments

For example, the initial search filters events and table changes the displayed result into selected columns:

failed login | table _time host user

Sorting results with sort

The sort command orders result rows by one or more selected fields. A field is a named value in an event or result, such as _time, host, or count.

Basic ascending sorting uses the field name:

base_search | sort field

For example:

failed login | sort host

Prefix a field with a minus sign to request descending order:

failed login | sort - _time

This example orders matching events by _time in descending order, placing later times before earlier times.

Displaying selected fields with table

The table command produces a column-oriented, report-style result view. List fields after the command to choose both which fields appear and the order of the columns.

failed login | table _time host user

The result contains columns for _time, host, and user, in that order. This is useful after a search or transforming command when raw event text contains more information than needed for a comparison.

For example, sorting and selecting fields can be combined:

failed login | sort - _time | table _time host user

The pipeline first orders the matching results by time and then presents only the selected fields.

Troubleshooting common search problems

Two-word searches return fewer events than expected

Adjacent terms use implicit AND, so every matching event must contain both words. Use OR when either term should qualify:

error OR warning

If the words must occur together, use a quoted phrase instead:

"failed login"

A phrase-oriented search matches separated words

The terms may have been entered without quotation marks. Put the intended phrase inside double quotation marks:

"failed login"

Unwanted categories appear in the results

Add an exclusion condition with NOT:

login NOT success

Mixed OR logic gives unexpected matches

Without clear grouping, the alternatives may not be combined with other conditions as intended. Use parentheses:

(error OR warning) host=web01

Raw events are difficult to compare

Append table and list the fields needed for comparison:

failed login | table _time host user

Results are in the wrong order

Use sort with the relevant field. Add a minus sign before the field when descending order is required:

failed login | sort - _time

Exam-relevant points

• Ordinary search terms are generally case insensitive.
• Adjacent unqualified terms use implicit AND; all of them must match.
• Double quotation marks create a phrase search for consecutive words in order.
• OR matches alternatives, while NOT excludes an unwanted term.
• Parentheses group Boolean alternatives and make mixed conditions explicit.
• The pipe character passes results to the next SPL command.
• sort field sorts ascending; sort - field requests descending order.
• table selects and orders fields in a concise column-based result.

For related study, continue with Splunk search rules, then explore search-time field extraction, field-value searches, search modes, time-range selection, transforming commands, where, stats, result limiting, and saved searches.