Getting Started

Your First Search

Ingest sample data, write SPL, and turn raw events into a dashboard.

20 min Beginner splsearchdashboards

SPL is the language Splunk speaks. It reads left-to-right like a Unix pipeline, and you’ll be fluent enough to build a dashboard before this page ends.

Walkthrough #

Ingest the sample data

3 min

Splunk ships with a tutorial dataset. Upload it from the Add Data screen, or use the CLI:

bash
splunk add oneshot $SPLUNK_HOME/etc/apps/search/lookups/tutorial.csv \
  -sourcetype tutorial \
  -index main

Once the upload finishes, switch to Search & Reporting and pick Last 24 hours as the time range.

Run your first SPL query

5 min

Type the following into the search bar:

search.spl
index=main sourcetype=tutorial
| stats count by status
| sort -count

Each pipe transforms the previous result. Read the search like a sentence: “From everything in main of sourcetype tutorial, count events grouped by status, and sort the result descending.”

You should see something like this:

Status	Count
200	24,531
404	1,148
500	312

Visualize it

4 min

Click the Visualization tab, choose Column Chart, and Splunk renders your aggregation immediately. No JS required.

Save it as a report

3 min

Hit Save As → Report. Give it a name, set a default time range, and save. You can now schedule it, share it, or pin it to a dashboard.

Try it yourself #

Exercise

Find the top 5 user agents

Modify the query above to count events grouped by useragent instead of status, and limit the output to the top five.

Show solution

text
index=main sourcetype=tutorial
| stats count by useragent
| sort -count
| head 5

head 5 truncates the result to the first five rows after sorting.

Quick check #

Quick check

Which command aggregates events into a single row?

stats is Splunk’s aggregation workhorse. timechart is also an aggregator, but it always groups by time — useful for line charts, not for collapsing to a single row.

Where to next? #

The full SPL reference

Every command, every modifier — searchable and bookmark-friendly.

Build your first dashboard

Combine three saved searches into a live dashboard with auto-refresh.

SPL is what makes Splunk feel less like a database and more like a conversation with your data.

BETA v9.2 macOS

That’s the end of the Getting Started workshop. From here, pick a topic that matches what you want to build.