Splunk Cheat Sheet: Essential SPL Commands for Beginners

Bookmark this. This Splunk cheat sheet covers the SPL commands you'll actually use day to day as a beginner, with a quick explanation and a working example for each one. No fluff, just the commands that matter.

Every search in Splunk follows the same pattern: start with a base search to filter events, then pipe (|) the results into one or more commands that transform them. Once you know that, this whole cheat sheet is just variations on a theme.

The Basic Search

Every SPL query starts here. Filter down to the data you care about before doing anything else.

index=web_logs sourcetype=access_combined status=404 earliest=-24h

This finds every 404 error in the web_logs index from the last 24 hours. Keep your base search as specific as possible. It's the single biggest factor in search performance.

stats: Aggregate Your Data

Use stats to count, sum, average, or otherwise aggregate events into a summary.

index=web_logs
| stats count, avg(response_time) AS avg_response BY host

Counts events and averages response time, grouped by host. Full breakdown in our stats command tutorial.

eval: Create or Transform Fields

Use eval to build new fields from existing ones with expressions, conditionals, and functions.

index=web_logs
| eval response_category=if(status>=500, "server_error", "ok")

Full breakdown in our eval command tutorial.

timechart: Trends Over Time

Use timechart when you want a time-bucketed chart instead of a single summary number.

index=web_logs
| timechart span=1h count BY status

Full breakdown in our timechart command tutorial.

top and rare: Most and Least Common Values

Quickly find your most frequent or rarest values without writing a stats query by hand.

index=web_logs
| top limit=10 uri_path

Full breakdown in our top and rare commands guide.

dedup: Remove Duplicate Events

Keep only the first (or first N) events for each unique combination of fields.

index=web_logs
| dedup client_ip

Full breakdown in our dedup command tutorial.

transaction: Correlate Related Events

Group related events into a single transaction, useful for tracking a user session or a multi-step process across log lines.

index=web_logs
| transaction session_id maxspan=30m

Full breakdown in our transaction command explained.

join: Combine Data From Multiple Sources

Merge results from two different searches on a shared field, similar to a SQL join.

index=web_logs
| join user_id [ search index=auth_logs ]

Full breakdown in our join command guide.

lookup: Enrich Events With External Data

Add fields from a static CSV or external table to your events, for example mapping an error code to a human-readable description.

index=web_logs
| lookup error_codes.csv status OUTPUT description

Full breakdown in understanding Splunk lookups.

rex and Field Extraction Basics

Not every field is extracted automatically. Use rex to pull a new field out of raw text using a regular expression.

index=web_logs
| rex field=_raw "user=(?<username>\w+)"

If field extraction feels unfamiliar, start with our guide on Splunk field extraction.

Quick Reference Table

How to Actually Use This Cheat Sheet

Don't try to memorise every command in one sitting. Instead:

1. Learn search, stats, and table first. That covers the majority of everyday questions.
2. Add eval and timechart once basic search feels comfortable.
3. Reach for dedup, transaction, join, and lookup as specific problems come up.

That's roughly the order we teach these concepts in the Introduction to Splunk course too, since it mirrors how most people actually pick this up in the real world.

Want to see every one of these commands run against real sample data, with a proper explanation of why and when to use each one? The Introduction to Splunk course includes a full module on Basic Search and SPL, so you're not just copying commands, you actually understand them.