Blog

Dual View Portable: The Ultimate On-the-Go Dual-Screen Solution

Staying productive and entertained while away from a desk used to mean compromises. The Dual View Portable changes that: it’s a lightweight, foldable dual-screen accessory that turns a single laptop, tablet, or smartphone into a flexible two-screen workstation. Below is a concise guide to what it is, who it’s for, key features, pros and cons, and tips to get the most out of it.

What it is

Dual View Portable is a slim, attachable second screen designed for mobility. It usually connects via USB-C, HDMI, or wireless mirroring, and folds flat for travel. Some models include adjustable kickstands, touchscreen support, and protective covers that double as stands.

Who it’s for

• Remote workers and digital nomads who need extra screen real estate for multitasking.
• Students managing research, note-taking, and video lectures simultaneously.
• Content creators and editors needing preview windows while working in primary apps.
• Gamers and streamers who want chat, monitoring tools, or secondary game views.
• Presenters who want a private control screen while casting the main display.

Key features to look for

• Compatibility: USB-C with DisplayPort Alt Mode is ideal; check driver support for macOS, Windows, Android, and iPadOS.
• Resolution & size: 1080p at 13–15.6 inches offers a balance of clarity and portability.
• Weight & thickness: Aim for under 800 g and under 8 mm thickness for true portability.
• Touch & pen support: Useful for tablet users and creatives.
• Refresh rate: 60 Hz is standard; higher rates benefit gaming.
• Power delivery pass-through: Lets you charge the host device while using the screen.
• Foldable protective case / kickstand: For stable positioning and screen protection.
• Color accuracy: Important for photo/video editing — look for sRGB coverage ≥95%.

Pros

• Boosts productivity with extra screen space for multitasking.
• Compact and travel-friendly compared to a full monitor.
• Flexible mounting and orientation options (landscape/portrait).
• Often lower cost than a second laptop or full monitor.

Cons

• Smaller size means less usable space than desktop monitors.
• Some models require adapters or drivers for full functionality.
• Limited ergonomics — may need stands or risers for comfortable long-term use.
• Wireless modes can introduce latency for fast-paced tasks.

Setup & usage tips

1. Check compatibility first: Confirm your device supports the screen’s input (USB-C DP Alt Mode, HDMI, or wireless casting).
2. Use dual-monitor settings: On macOS/Windows, arrange displays and set scaling for comfortable text size.
3. Optimize workflow: Place reference material or communication apps on the Dual View Portable and primary work on the main screen.
4. Reduce neck strain: Raise screens to eye level using a small laptop stand or stackable riser.
5. Calibrate color: If you edit images, use a colorimeter or built-in calibration tools.
6. Carry protection: Use the included case; consider a sleeve if you toss it in a backpack with other gear.

Buying checklist

• Does it support your device’s connection type?
• Is the weight and size acceptable for your travel style?
• Are drivers available for your OS?
• Does it include power pass-through if you need it?
• What’s the warranty and return policy?

Final verdict

For people who need extra screen space while mobile, Dual View Portable devices are a practical, affordable way to add multitasking capability without the bulk of a full monitor. Choose a model that matches your device compatibility, size preferences, and use case (productivity vs. creative vs. gaming) to get the most value.

Mastering CodeParser: Tips for Fast, Accurate Syntax Analysis

Parsing source code quickly and accurately is essential for compilers, linters, code formatters, and many developer tools. This article covers practical tips to get the most from CodeParser—whether you’re using an existing library or building your own parser. It focuses on design choices, performance optimizations, accuracy improvements, and tooling practices that scale from small scripts to large codebases.

1. Choose the right parsing strategy

• Tokenization-first (lex + parse): Use a lexer to convert raw text into tokens, then feed tokens to a parser. This separation simplifies grammar handling and often improves speed.
• Recursive descent: Simple to implement, great for hand-written parsers and grammars with limited backtracking.
• LL/LR parser generators: Use tools like ANTLR or Bison when grammar complexity grows—generators produce robust, tested parsers.
• PEG parsers: Offer expressive grammars and prioritized choices; useful when you need deterministic behavior without separate lexer.

2. Design a clean grammar

• Keep rules unambiguous: Refactor rules to avoid overlapping patterns that force backtracking.
• Use precedence and associativity: Explicitly encode operator precedence to simplify parsing and avoid costly conflict resolution.
• Modularize: Break large grammars into smaller, reusable components (expressions, types, declarations).
• Limit recursion depth: Prefer iterative constructs for deep nesting to avoid stack overflow.

3. Optimize for speed

• Efficient token streams: Implement a token buffer with lookahead support rather than re-scanning text.
• Minimize allocations: Reuse token and AST node objects via object pools or arena allocators.
• Lazy parsing: Parse only what’s necessary (e.g., parse function bodies on demand) for tools like IDEs.
• Incremental parsing: Re-parse only changed regions for large files to provide near-instant feedback.
• Profile hotspots: Use profilers to find slow paths (lexing, certain grammar rules) and optimize selectively.

4. Improve accuracy and error handling

• Clear error messages: Track source locations and provide contextual hints (expected tokens, likely fixes).
• Error recovery strategies: Implement panic-mode recovery, resynchronization on statement delimiters, or production-based recovery to continue parsing after errors.
• Validation passes: After parsing, run semantic checks (type resolution, symbol table validation) to catch issues the grammar can’t express.
• Fuzz testing: Feed random and malformed inputs to find parser crashes or incorrect behavior.

5. Produce a useful AST

• Keep AST minimal and stable: Represent only necessary semantics; avoid embedding raw text unless needed.
• Annotate with metadata: Attach source ranges, comments, and inferred types for downstream tools.
• Design for transformations: Make nodes easy to traverse and modify for refactoring, formatting, and codegen tasks.
• Immutable core, mutable wrappers: Use immutable AST nodes for safety and versioning; provide mutable views for editors.

6. Tooling and integration tips

• Provide language server support: Implement LSP features (hover, completions, go-to-definition) using CodeParser’s incremental capabilities.
• Integrate with formatters and linters: Share a canonical AST to ensure consistency across tooling.
• Expose a debug mode: Allow dumping tokens, parse trees, and recovery traces for diagnosing tough cases.
• Version your grammar: Track grammar changes separately from code to manage compatibility across tool versions.

7. Testing and CI

• Unit tests for grammar rules: Test both valid and invalid inputs per rule.
• Golden tests for ASTs: Compare parsed ASTs or serialized outputs to approved snapshots.
• Performance regression tests: Monitor parse times on large files and fail builds if regressions cross thresholds.
• Cross-language fixtures: If CodeParser targets multiple languages, maintain a comprehensive corpus of real-world projects.

8. Advanced techniques

• Speculative parsing and backtracking limits: Allow limited backtracking for ambiguous constructs with safeguards to prevent exponential blowup.
• Parallel parsing: Split files into independent units (modules, functions) and parse concurrently when dependencies allow.
• Grammar inference tools: Use corpus analysis to refine grammar rules based on real-world code patterns.
• Hybrid parsing: Combine parser generator output with handwritten routines for performance-critical constructs.

Conclusion

Mastering CodeParser requires balancing design clarity, performance engineering, and robust error handling. Start with a clean grammar and tokenization strategy, instrument and profile aggressively, and adopt incremental and lazy parsing where responsiveness matters. With solid AST design, thorough testing, and practical tooling integration, CodeParser can power fast, accurate syntax analysis across compilers, IDEs, and developer tools.

Windowed Security: Modern Solutions for Safe, Stylish Windows

Windows should do more than let light in—they must protect your home while complementing its style. Modern window security blends advanced materials, smart technology, and thoughtful design so your windows remain both attractive and secure. Below are practical solutions and choices to help you upgrade safety without sacrificing aesthetics.

1. Reinforced glazing options

• Laminated glass: Two or more glass layers bonded with a PVB or SGP interlayer. Holds together when shattered, resisting forced entry and reducing injury from broken glass.
• Tempered glass: Heat-treated to increase strength; breaks into small, less dangerous pieces. Good for reducing injury risk but less resistant to penetration than laminated glass.
• Security film: A clear polyester film applied to existing panes to slow glass penetration and keep shards contained. Budget-friendly retrofit.

2. Robust frame and lock systems

• Material choice: Aluminum offers a slim, modern profile with good strength; vinyl is low-maintenance but can be reinforced with steel; wood is classic but should be paired with reinforced hardware.
• Multi-point locking: Locks at several points along the frame for greater resistance to prying compared with a single latch.
• Hinge protection: Security hinges or hinge bolts prevent removal of casement or awning windows from the outside.

3. Window sensors and smart integration

• Contact sensors: Trigger alarms when a window is opened or tampered with.
• Glass-break sensors: Detect the acoustic signature or vibration of breaking glass and alert your system faster than contact sensors alone.
• Smart locks and automations: Allow remote locking/unlocking, schedule-based locking, or linking windows to lighting and cameras for deterrence.
• Integration tip: Choose systems compatible with your smart-home hub (e.g., Matter, Z-Wave, Zigbee, or native integrations from your security provider).

4. Physical deterrents and architectural solutions

• Window grilles and bars: Steel or wrought-iron bars provide strong protection. Choose decorative designs or retractable/grab bars to balance security and curb appeal.
• Security screens: High-tensile stainless-steel mesh that resists cutting and impacts while preserving outward visibility and airflow.
• Exterior shutters: Solid shutters (rolling or hinged) offer storm- and intrusion-resistance while also improving insulation and light control.
• Planting strategically: Thorny shrubs under ground-floor windows act as a passive deterrent without looking fortress-like.

5. Visibility, lighting, and surveillance

• Exterior lighting: Motion-activated fixtures reveal activity near windows—effective deterrent when combined with sensors.
• Cameras with good sightlines: Place cameras to cover window approaches; choose discreet models that blend with architecture.
• Signage: Visible alarm system decals and yard signs deter opportunistic burglars even if used subtly.

6. Balancing safety with style

• Match finishes and profiles: Select locks, grilles, and screens in finishes that complement window frames (e.g., black matte, brushed nickel).
• Custom solutions: Commission bespoke grilles or shutters that echo architectural details for a cohesive look.
• Minimalist hardware: Modern multi-point locks and slimline reinforced frames maintain clean sightlines while adding protection.

7. Practical installation and maintenance tips

• Professional assessment: Have a security-minded window specialist evaluate vulnerability points—hinges, sills, and lock types.
• Retrofit first: Start with cost-effective upgrades (security film, sensors, window locks) before replacing whole units.
• Regular checks: Exercise locks, inspect seals and fastenings, and test sensors/cameras quarterly.
• Codes and egress: Ensure security measures (bars/shutters) comply with local building codes and do not obstruct emergency escape routes.

Conclusion

Modern window security no longer requires trade-offs between protection and appearance. By combining reinforced glazing, strong frames and locks, smart sensors, discreet physical deterrents, and thoughtful design choices, you can achieve windows that are both safe and stylish. Start with an assessment of high-risk openings, prioritize retrofits with the best cost-to-impact ratio, and integrate smart technology to create a layered, visually cohesive defense.

CSVTable Tutorial: Load, Edit, and Export CSV Data Easily

Overview

CSVTable is a lightweight JavaScript utility for working with CSV data in web apps. This tutorial shows a concise workflow: load CSV, display/edit in a table UI, validate changes, and export back to CSV.

Prerequisites

• Browser or Node.js environment
• Basic JavaScript/HTML knowledge
• Optional: React or plain DOM for UI

1. Load CSV

• From file input: Use FileReader to read .csv file as text.
• From URL: Fetch CSV text with fetch() and handle CORS.
• From string: Pass CSV string directly to CSVTable parser.

Example (conceptual):

js
Copy CodeCopied
const csvText = await fetch(url).then(r => r.text());
const table = CSVTable.parse(csvText);

2. Parse & Display

• Parsing: CSVTable.parse(csvText, { delimiter: ‘,’, header: true }) → returns rows array and header list.
• Display: Render rows into an HTML table or a React component; include editable cells (contenteditable or inputs).

Rendering tips:

• Keep a copy of original rows for undo.
• Use virtualization for large files.

3. Editing UX

• Inline edits: Track cell edits and mark rows as “dirty”.
• Row operations: Add, duplicate, delete rows.
• Column operations: Rename, reorder, change type.
• Validation: Apply schema checks (required, numeric, date formats) while editing.

Example validation flow:

1. On edit, run cell validator.
2. If invalid, show inline error and prevent export unless fixed.

4. Validation & Cleaning

• Trim whitespace, normalize newline characters.
• Detect and coerce types (numbers, booleans, dates) if configured.
• Report parsing errors (unescaped quotes, inconsistent columns) with row numbers.

5. Export

• To CSV string: CSVTable.stringify(rows, { header: true, delimiter: ‘,’ })
• Download file: Create a Blob and trigger download.

js
Copy CodeCopied
const csvOut = CSVTable.stringify(rows);
const blob = new Blob([csvOut], { type: ‘text/csv’ });
const url = URL.createObjectURL(blob);
anchor.href = url; anchor.download = ‘edited.csv’; anchor.click();

• To Excel: Convert to XLSX via a library (SheetJS) if needed.

6. Performance Tips

• Stream parsing for very large files instead of full in-memory parse.
• Batch updates and debounce validation during rapid typing.
• Use worker threads or Web Workers for CPU-bound parsing/validation.

7. Error Handling

• Provide clear messages for parse errors and export failures.
• Offer autosave/restore to avoid data loss during edits.

8. Example Use Cases

• Quick CSV cleanup and normalization.
• Admin tools for editing dataset rows.
• Import/export pipelines for small data migrations.

Summary

Follow this workflow: load → parse → display → edit → validate → export. Use streaming and workers for large files, keep validation user-friendly, and provide clear export/download options.

Behind the Scenes of Slips7ream: Creators, Trends, and Tips

Creators

• Types: solo streamers (gaming, IRL, niche hobbies), co-op teams, production studios hosting serialized shows.
• Roles: host/performer, moderator, editor, technical operator, community manager.
• Monetization mix: subscriptions, tips/gifts, sponsorships, merchandise, paid events.

Trends (2026)

• Short-form highlight clips drive discovery across socials.
• Shoppable livestreams—real-time product links during broadcasts.
• AI-assisted production: real-time captions, scene switching, automated highlights.
• Creator-brand partnerships focused on authentic integrations and creator-owned IP.
• Community-first formats: membership-only shows, interactive polls, multi-guest co-streams.

Quick production checklist (minimum viable stream)

1. Gear: camera (1080p+), USB mic, stable lighting, wired Ethernet.
2. Software: encoder (OBS/Streamlabs), chat moderation tools, overlay pack.
3. Assets: intro/outro, lower-thirds, scene transitions, music (licensed/creator-safe).
4. Moderation: 2–3 active mods, clear chat rules, spam filters.
5. Backup plan: local recording + cloud backup, spare cables, fallback stream key.

Growth & engagement tips

• Clip-first strategy: publish 20–60s highlights to social within 1 hour.
• predictable schedule:** same days/times; announce next shows mid-stream.
• Cross-promote: collab with 2 similar creators monthly; swap clips.
• Interactive hooks: polls, on-stream challenges, limited-time rewards.
• Monetization ladder: free content → low-cost perks → exclusive paid events.

Creator tooling recommendations

• Editing: Descript or CapCut for fast clips.
• AI highlights: Runway or Twitch Clip Tools.
• Commerce: Shopify + livestream plugin or platform-native shop.
• Music: use creator-safe libraries (ensure license matches use).

Step-by-Step Guide to Using PDF Password Cracker Pro

Warning: Only use this on PDFs you own or have explicit permission to modify.

1. Download & install

1. Visit the official vendor site and download the installer for your OS.
2. Run the installer and follow on-screen prompts.
3. Allow any required permissions (admin rights may be needed).

2. Open the program and load the PDF

1. Launch PDF Password Cracker Pro.
2. Click Open or Add File and select the locked PDF.

3. Choose attack type

• Dictionary attack: Try this first if you suspect a common password. Load a wordlist (built-in or custom).
• Mask attack: Use when you remember parts of the password (length, charset, known prefix/suffix).
• Brute-force attack: Use if no hints exist; configure charset (lower/upper/digits/symbols) and length range.
• Smart/Hybrid attack: Combines dictionary with variations—good balance of speed and effectiveness.

4. Configure performance options

• Threads/CPU cores: Set to number of cores you can spare.
• GPU acceleration: Enable if supported for much faster cracking.
• Rate limits: Lower resources if you need to keep the machine responsive.

5. Start the attack

1. Click Start or Run.
2. Monitor progress and estimated time-to-complete. Pause/resume as needed.

6. When password is found

1. The app will display the recovered password.
2. Use it to open the PDF in your reader and remove or change the password if desired.

7. If attack fails

• Try a different attack type or expand charset/length.
• Use larger or more targeted dictionaries.
• Consider that strong modern encryption may be practically uncrackable.

8. Save/export results (optional)

• Export recovered password or a log file if the software provides that feature.

9. Security & legal notes

• Keep the software updated.
• Do not use on files without permission—cracking protected files may be illegal.

If you want, I can produce a ready-to-use mask/dictionary configuration for a specific password hint (assume reasonable defaults).

How to Get Started with Splunk — Installation to Dashboards

Overview

Splunk is a platform for collecting, indexing, searching, and visualizing machine-generated data (logs, metrics, events). This guide walks through a practical, end-to-end setup: install Splunk Enterprise on a single machine, ingest sample data, run basic searches, create saved searches and alerts, and build dashboards. Assumes Linux (Ubuntu 22.04) as the host — Windows/macOS steps differ but concepts are the same.

Prerequisites

• A machine with at least 4 GB RAM, 2 vCPU, and 20 GB free disk (development/test). Production needs more.
• Ubuntu 22.04 LTS (or compatible). Commands are shown for Debian-based systems.
• A non-root user with sudo privileges.
• Basic familiarity with shell and web browsers.

1) Download and install Splunk Enterprise

1. Update packages:

bash
Copy CodeCopied
sudo apt update && sudo apt upgrade -y 

2. Download Splunk (choose the latest Linux .deb from Splunk downloads). Example using curl (replace URL with current .deb link):

bash
Copy CodeCopied
curl -O -L “https://download.splunk.com/products/splunk/releases/9.1.0/linux/splunk-9.1.0-ae7bf9f3a4f7-linux-2.6-amd64.deb”
sudo dpkg -i splunk-9.1.0-*.deb 

3. Start Splunk and accept the license:

bash
Copy CodeCopied
sudo /opt/splunk/bin/splunk start –accept-license 

4. Set the admin password when prompted. By default Splunk web listens on port 8000.

5. Enable Splunk to start at boot (optional):

bash
Copy CodeCopied
sudo /opt/splunk/bin/splunk enable boot-start 

2) Access Splunk Web and initial setup

• Open a browser to: http://:8000
• Log in with username: admin and the password you created.
• Complete the initial setup prompts (time zone, default apps).

3) Add data (indexing)

Use “Add Data” in Splunk Web for simple ingestion. Example methods:

• Upload a file
• Monitor files and directories
• Configure a TCP/UDP input
• Use the Universal Forwarder for remote hosts

Quick example: upload a sample log file

1. Go to Settings → Add Data → Upload.
2. Select a sample log file (e.g., syslog).
3. Set the source type (e.g., “syslog”) and index (use default “main” or create “demo_index”).
4. Review and submit.

Command-line monitor example (monitor /var/log): Edit inputs.conf under \(SPLUNK_HOME/etc/system/local/ or use Splunk Web:</p> <pre><div class="XG2rBS5V967VhGTCEN1k"><div class="nHykNMmtaaTJMjgzStID"><div class="HsT0RHFbNELC00WicOi8"><i><svg width="16" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M15.434 7.51c.137.137.212.311.212.49a.694.694 0 0 1-.212.5l-3.54 3.5a.893.893 0 0 1-.277.18 1.024 1.024 0 0 1-.684.038.945.945 0 0 1-.302-.148.787.787 0 0 1-.213-.234.652.652 0 0 1-.045-.58.74.74 0 0 1 .175-.256l3.045-3-3.045-3a.69.69 0 0 1-.22-.55.723.723 0 0 1 .303-.52 1 1 0 0 1 .648-.186.962.962 0 0 1 .614.256l3.541 3.51Zm-12.281 0A.695.695 0 0 0 2.94 8a.694.694 0 0 0 .213.5l3.54 3.5a.893.893 0 0 0 .277.18 1.024 1.024 0 0 0 .684.038.945.945 0 0 0 .302-.148.788.788 0 0 0 .213-.234.651.651 0 0 0 .045-.58.74.74 0 0 0-.175-.256L4.994 8l3.045-3a.69.69 0 0 0 .22-.55.723.723 0 0 0-.303-.52 1 1 0 0 0-.648-.186.962.962 0 0 0-.615.256l-3.54 3.51Z"></path></svg></i><p class="li3asHIMe05JPmtJCytG wZ4JdaHxSAhGy1HoNVja cPy9QU4brI7VQXFNPEvF">conf</p></div><div class="CF2lgtGWtYUYmTULoX44"><button type="button" class="st68fcLUUT0dNcuLLB2_ ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf" data-copycode="true" role="button" aria-label="Copy Code"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M9.975 1h.09a3.2 3.2 0 0 1 3.202 3.201v1.924a.754.754 0 0 1-.017.16l1.23 1.353A2 2 0 0 1 15 8.983V14a2 2 0 0 1-2 2H8a2 2 0 0 1-1.733-1H4.183a3.201 3.201 0 0 1-3.2-3.201V4.201a3.2 3.2 0 0 1 3.04-3.197A1.25 1.25 0 0 1 5.25 0h3.5c.604 0 1.109.43 1.225 1ZM4.249 2.5h-.066a1.7 1.7 0 0 0-1.7 1.701v7.598c0 .94.761 1.701 1.7 1.701H6V7a2 2 0 0 1 2-2h3.197c.195 0 .387.028.57.083v-.882A1.7 1.7 0 0 0 10.066 2.5H9.75c-.228.304-.591.5-1 .5h-3.5c-.41 0-.772-.196-1-.5ZM5 1.75v-.5A.25.25 0 0 1 5.25 1h3.5a.25.25 0 0 1 .25.25v.5a.25.25 0 0 1-.25.25h-3.5A.25.25 0 0 1 5 1.75ZM7.5 7a.5.5 0 0 1 .5-.5h3V9a1 1 0 0 0 1 1h1.5v4a.5.5 0 0 1-.5.5H8a.5.5 0 0 1-.5-.5V7Zm6 2v-.017a.5.5 0 0 0-.13-.336L12 7.14V9h1.5Z"></path></svg>Copy Code</button><button type="button" class="st68fcLUUT0dNcuLLB2_ WtfzoAXPoZC2mMqcexgL ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ GnLX_jUB3Jn3idluie7R"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" d="M20.618 4.214a1 1 0 0 1 .168 1.404l-11 14a1 1 0 0 1-1.554.022l-5-6a1 1 0 0 1 1.536-1.28l4.21 5.05L19.213 4.382a1 1 0 0 1 1.404-.168Z" clip-rule="evenodd"></path></svg>Copied</button></div></div><div class="mtDfw7oSa1WexjXyzs9y" style="color: var(–sds-color-text-01); font-family: var(–sds-font-family-monospace); direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: var(–sds-font-size-label); line-height: 1.2em; tab-size: 4; hyphens: none; padding: var(–sds-space-x02, 8px) var(–sds-space-x04, 16px) var(–sds-space-x04, 16px); margin: 0px; overflow: auto; border: none; background: transparent;"><code class="language-text" style="color: rgb(57, 58, 52); font-family: Consolas, "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: 0.9em; line-height: 1.2em; tab-size: 4; hyphens: none;"><span>[monitor:///var/log] </span>disabled = false index = main sourcetype = syslog </code></div></div></pre> <p>Then restart Splunk:</p> <pre><div class="XG2rBS5V967VhGTCEN1k"><div class="nHykNMmtaaTJMjgzStID"><div class="HsT0RHFbNELC00WicOi8"><i><svg width="16" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M15.434 7.51c.137.137.212.311.212.49a.694.694 0 0 1-.212.5l-3.54 3.5a.893.893 0 0 1-.277.18 1.024 1.024 0 0 1-.684.038.945.945 0 0 1-.302-.148.787.787 0 0 1-.213-.234.652.652 0 0 1-.045-.58.74.74 0 0 1 .175-.256l3.045-3-3.045-3a.69.69 0 0 1-.22-.55.723.723 0 0 1 .303-.52 1 1 0 0 1 .648-.186.962.962 0 0 1 .614.256l3.541 3.51Zm-12.281 0A.695.695 0 0 0 2.94 8a.694.694 0 0 0 .213.5l3.54 3.5a.893.893 0 0 0 .277.18 1.024 1.024 0 0 0 .684.038.945.945 0 0 0 .302-.148.788.788 0 0 0 .213-.234.651.651 0 0 0 .045-.58.74.74 0 0 0-.175-.256L4.994 8l3.045-3a.69.69 0 0 0 .22-.55.723.723 0 0 0-.303-.52 1 1 0 0 0-.648-.186.962.962 0 0 0-.615.256l-3.54 3.51Z"></path></svg></i><p class="li3asHIMe05JPmtJCytG wZ4JdaHxSAhGy1HoNVja cPy9QU4brI7VQXFNPEvF">bash</p></div><div class="CF2lgtGWtYUYmTULoX44"><button type="button" class="st68fcLUUT0dNcuLLB2_ ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf" data-copycode="true" role="button" aria-label="Copy Code"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M9.975 1h.09a3.2 3.2 0 0 1 3.202 3.201v1.924a.754.754 0 0 1-.017.16l1.23 1.353A2 2 0 0 1 15 8.983V14a2 2 0 0 1-2 2H8a2 2 0 0 1-1.733-1H4.183a3.201 3.201 0 0 1-3.2-3.201V4.201a3.2 3.2 0 0 1 3.04-3.197A1.25 1.25 0 0 1 5.25 0h3.5c.604 0 1.109.43 1.225 1ZM4.249 2.5h-.066a1.7 1.7 0 0 0-1.7 1.701v7.598c0 .94.761 1.701 1.7 1.701H6V7a2 2 0 0 1 2-2h3.197c.195 0 .387.028.57.083v-.882A1.7 1.7 0 0 0 10.066 2.5H9.75c-.228.304-.591.5-1 .5h-3.5c-.41 0-.772-.196-1-.5ZM5 1.75v-.5A.25.25 0 0 1 5.25 1h3.5a.25.25 0 0 1 .25.25v.5a.25.25 0 0 1-.25.25h-3.5A.25.25 0 0 1 5 1.75ZM7.5 7a.5.5 0 0 1 .5-.5h3V9a1 1 0 0 0 1 1h1.5v4a.5.5 0 0 1-.5.5H8a.5.5 0 0 1-.5-.5V7Zm6 2v-.017a.5.5 0 0 0-.13-.336L12 7.14V9h1.5Z"></path></svg>Copy Code</button><button type="button" class="st68fcLUUT0dNcuLLB2_ WtfzoAXPoZC2mMqcexgL ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ GnLX_jUB3Jn3idluie7R"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" d="M20.618 4.214a1 1 0 0 1 .168 1.404l-11 14a1 1 0 0 1-1.554.022l-5-6a1 1 0 0 1 1.536-1.28l4.21 5.05L19.213 4.382a1 1 0 0 1 1.404-.168Z" clip-rule="evenodd"></path></svg>Copied</button></div></div><div class="mtDfw7oSa1WexjXyzs9y" style="color: var(–sds-color-text-01); font-family: var(–sds-font-family-monospace); direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: var(–sds-font-size-label); line-height: 1.2em; tab-size: 4; hyphens: none; padding: var(–sds-space-x02, 8px) var(–sds-space-x04, 16px) var(–sds-space-x04, 16px); margin: 0px; overflow: auto; border: none; background: transparent;"><code class="language-bash" style="color: rgb(57, 58, 52); font-family: Consolas, "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: 0.9em; line-height: 1.2em; tab-size: 4; hyphens: none;"><span class="token" style="color: rgb(57, 58, 52);">sudo</span><span> /opt/splunk/bin/splunk restart </span></code></div></div></pre> <h3>4) Basic searching with SPL (Search Processing Language)</h3> <ul> <li>Open Search & Reporting app.</li> <li>Simple search to show recent events:</li> </ul> <pre><div class="XG2rBS5V967VhGTCEN1k"><div class="nHykNMmtaaTJMjgzStID"><div class="HsT0RHFbNELC00WicOi8"><i><svg width="16" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M15.434 7.51c.137.137.212.311.212.49a.694.694 0 0 1-.212.5l-3.54 3.5a.893.893 0 0 1-.277.18 1.024 1.024 0 0 1-.684.038.945.945 0 0 1-.302-.148.787.787 0 0 1-.213-.234.652.652 0 0 1-.045-.58.74.74 0 0 1 .175-.256l3.045-3-3.045-3a.69.69 0 0 1-.22-.55.723.723 0 0 1 .303-.52 1 1 0 0 1 .648-.186.962.962 0 0 1 .614.256l3.541 3.51Zm-12.281 0A.695.695 0 0 0 2.94 8a.694.694 0 0 0 .213.5l3.54 3.5a.893.893 0 0 0 .277.18 1.024 1.024 0 0 0 .684.038.945.945 0 0 0 .302-.148.788.788 0 0 0 .213-.234.651.651 0 0 0 .045-.58.74.74 0 0 0-.175-.256L4.994 8l3.045-3a.69.69 0 0 0 .22-.55.723.723 0 0 0-.303-.52 1 1 0 0 0-.648-.186.962.962 0 0 0-.615.256l-3.54 3.51Z"></path></svg></i><p class="li3asHIMe05JPmtJCytG wZ4JdaHxSAhGy1HoNVja cPy9QU4brI7VQXFNPEvF">Code</p></div><div class="CF2lgtGWtYUYmTULoX44"><button type="button" class="st68fcLUUT0dNcuLLB2_ ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf" data-copycode="true" role="button" aria-label="Copy Code"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M9.975 1h.09a3.2 3.2 0 0 1 3.202 3.201v1.924a.754.754 0 0 1-.017.16l1.23 1.353A2 2 0 0 1 15 8.983V14a2 2 0 0 1-2 2H8a2 2 0 0 1-1.733-1H4.183a3.201 3.201 0 0 1-3.2-3.201V4.201a3.2 3.2 0 0 1 3.04-3.197A1.25 1.25 0 0 1 5.25 0h3.5c.604 0 1.109.43 1.225 1ZM4.249 2.5h-.066a1.7 1.7 0 0 0-1.7 1.701v7.598c0 .94.761 1.701 1.7 1.701H6V7a2 2 0 0 1 2-2h3.197c.195 0 .387.028.57.083v-.882A1.7 1.7 0 0 0 10.066 2.5H9.75c-.228.304-.591.5-1 .5h-3.5c-.41 0-.772-.196-1-.5ZM5 1.75v-.5A.25.25 0 0 1 5.25 1h3.5a.25.25 0 0 1 .25.25v.5a.25.25 0 0 1-.25.25h-3.5A.25.25 0 0 1 5 1.75ZM7.5 7a.5.5 0 0 1 .5-.5h3V9a1 1 0 0 0 1 1h1.5v4a.5.5 0 0 1-.5.5H8a.5.5 0 0 1-.5-.5V7Zm6 2v-.017a.5.5 0 0 0-.13-.336L12 7.14V9h1.5Z"></path></svg>Copy Code</button><button type="button" class="st68fcLUUT0dNcuLLB2_ WtfzoAXPoZC2mMqcexgL ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ GnLX_jUB3Jn3idluie7R"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" d="M20.618 4.214a1 1 0 0 1 .168 1.404l-11 14a1 1 0 0 1-1.554.022l-5-6a1 1 0 0 1 1.536-1.28l4.21 5.05L19.213 4.382a1 1 0 0 1 1.404-.168Z" clip-rule="evenodd"></path></svg>Copied</button></div></div><div class="mtDfw7oSa1WexjXyzs9y" style="color: var(–sds-color-text-01); font-family: var(–sds-font-family-monospace); direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: var(–sds-font-size-label); line-height: 1.2em; tab-size: 4; hyphens: none; padding: var(–sds-space-x02, 8px) var(–sds-space-x04, 16px) var(–sds-space-x04, 16px); margin: 0px; overflow: auto; border: none; background: transparent;"><code class="language-text" style="color: rgb(57, 58, 52); font-family: Consolas, "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: 0.9em; line-height: 1.2em; tab-size: 4; hyphens: none;"><span>index=main | head 20 </span></code></div></div></pre> <ul> <li>Search by keyword:</li> </ul> <pre><div class="XG2rBS5V967VhGTCEN1k"><div class="nHykNMmtaaTJMjgzStID"><div class="HsT0RHFbNELC00WicOi8"><i><svg width="16" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M15.434 7.51c.137.137.212.311.212.49a.694.694 0 0 1-.212.5l-3.54 3.5a.893.893 0 0 1-.277.18 1.024 1.024 0 0 1-.684.038.945.945 0 0 1-.302-.148.787.787 0 0 1-.213-.234.652.652 0 0 1-.045-.58.74.74 0 0 1 .175-.256l3.045-3-3.045-3a.69.69 0 0 1-.22-.55.723.723 0 0 1 .303-.52 1 1 0 0 1 .648-.186.962.962 0 0 1 .614.256l3.541 3.51Zm-12.281 0A.695.695 0 0 0 2.94 8a.694.694 0 0 0 .213.5l3.54 3.5a.893.893 0 0 0 .277.18 1.024 1.024 0 0 0 .684.038.945.945 0 0 0 .302-.148.788.788 0 0 0 .213-.234.651.651 0 0 0 .045-.58.74.74 0 0 0-.175-.256L4.994 8l3.045-3a.69.69 0 0 0 .22-.55.723.723 0 0 0-.303-.52 1 1 0 0 0-.648-.186.962.962 0 0 0-.615.256l-3.54 3.51Z"></path></svg></i><p class="li3asHIMe05JPmtJCytG wZ4JdaHxSAhGy1HoNVja cPy9QU4brI7VQXFNPEvF">Code</p></div><div class="CF2lgtGWtYUYmTULoX44"><button type="button" class="st68fcLUUT0dNcuLLB2_ ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf" data-copycode="true" role="button" aria-label="Copy Code"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M9.975 1h.09a3.2 3.2 0 0 1 3.202 3.201v1.924a.754.754 0 0 1-.017.16l1.23 1.353A2 2 0 0 1 15 8.983V14a2 2 0 0 1-2 2H8a2 2 0 0 1-1.733-1H4.183a3.201 3.201 0 0 1-3.2-3.201V4.201a3.2 3.2 0 0 1 3.04-3.197A1.25 1.25 0 0 1 5.25 0h3.5c.604 0 1.109.43 1.225 1ZM4.249 2.5h-.066a1.7 1.7 0 0 0-1.7 1.701v7.598c0 .94.761 1.701 1.7 1.701H6V7a2 2 0 0 1 2-2h3.197c.195 0 .387.028.57.083v-.882A1.7 1.7 0 0 0 10.066 2.5H9.75c-.228.304-.591.5-1 .5h-3.5c-.41 0-.772-.196-1-.5ZM5 1.75v-.5A.25.25 0 0 1 5.25 1h3.5a.25.25 0 0 1 .25.25v.5a.25.25 0 0 1-.25.25h-3.5A.25.25 0 0 1 5 1.75ZM7.5 7a.5.5 0 0 1 .5-.5h3V9a1 1 0 0 0 1 1h1.5v4a.5.5 0 0 1-.5.5H8a.5.5 0 0 1-.5-.5V7Zm6 2v-.017a.5.5 0 0 0-.13-.336L12 7.14V9h1.5Z"></path></svg>Copy Code</button><button type="button" class="st68fcLUUT0dNcuLLB2_ WtfzoAXPoZC2mMqcexgL ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ GnLX_jUB3Jn3idluie7R"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" d="M20.618 4.214a1 1 0 0 1 .168 1.404l-11 14a1 1 0 0 1-1.554.022l-5-6a1 1 0 0 1 1.536-1.28l4.21 5.05L19.213 4.382a1 1 0 0 1 1.404-.168Z" clip-rule="evenodd"></path></svg>Copied</button></div></div><div class="mtDfw7oSa1WexjXyzs9y" style="color: var(–sds-color-text-01); font-family: var(–sds-font-family-monospace); direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: var(–sds-font-size-label); line-height: 1.2em; tab-size: 4; hyphens: none; padding: var(–sds-space-x02, 8px) var(–sds-space-x04, 16px) var(–sds-space-x04, 16px); margin: 0px; overflow: auto; border: none; background: transparent;"><code class="language-text" style="color: rgb(57, 58, 52); font-family: Consolas, "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: 0.9em; line-height: 1.2em; tab-size: 4; hyphens: none;"><span>index=main error </span></code></div></div></pre> <ul> <li>Filter by time range using the time picker (Last 24 hours, Last 15 minutes).</li> <li>Use fields and stats:</li> </ul> <pre><div class="XG2rBS5V967VhGTCEN1k"><div class="nHykNMmtaaTJMjgzStID"><div class="HsT0RHFbNELC00WicOi8"><i><svg width="16" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M15.434 7.51c.137.137.212.311.212.49a.694.694 0 0 1-.212.5l-3.54 3.5a.893.893 0 0 1-.277.18 1.024 1.024 0 0 1-.684.038.945.945 0 0 1-.302-.148.787.787 0 0 1-.213-.234.652.652 0 0 1-.045-.58.74.74 0 0 1 .175-.256l3.045-3-3.045-3a.69.69 0 0 1-.22-.55.723.723 0 0 1 .303-.52 1 1 0 0 1 .648-.186.962.962 0 0 1 .614.256l3.541 3.51Zm-12.281 0A.695.695 0 0 0 2.94 8a.694.694 0 0 0 .213.5l3.54 3.5a.893.893 0 0 0 .277.18 1.024 1.024 0 0 0 .684.038.945.945 0 0 0 .302-.148.788.788 0 0 0 .213-.234.651.651 0 0 0 .045-.58.74.74 0 0 0-.175-.256L4.994 8l3.045-3a.69.69 0 0 0 .22-.55.723.723 0 0 0-.303-.52 1 1 0 0 0-.648-.186.962.962 0 0 0-.615.256l-3.54 3.51Z"></path></svg></i><p class="li3asHIMe05JPmtJCytG wZ4JdaHxSAhGy1HoNVja cPy9QU4brI7VQXFNPEvF">Code</p></div><div class="CF2lgtGWtYUYmTULoX44"><button type="button" class="st68fcLUUT0dNcuLLB2_ ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf" data-copycode="true" role="button" aria-label="Copy Code"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M9.975 1h.09a3.2 3.2 0 0 1 3.202 3.201v1.924a.754.754 0 0 1-.017.16l1.23 1.353A2 2 0 0 1 15 8.983V14a2 2 0 0 1-2 2H8a2 2 0 0 1-1.733-1H4.183a3.201 3.201 0 0 1-3.2-3.201V4.201a3.2 3.2 0 0 1 3.04-3.197A1.25 1.25 0 0 1 5.25 0h3.5c.604 0 1.109.43 1.225 1ZM4.249 2.5h-.066a1.7 1.7 0 0 0-1.7 1.701v7.598c0 .94.761 1.701 1.7 1.701H6V7a2 2 0 0 1 2-2h3.197c.195 0 .387.028.57.083v-.882A1.7 1.7 0 0 0 10.066 2.5H9.75c-.228.304-.591.5-1 .5h-3.5c-.41 0-.772-.196-1-.5ZM5 1.75v-.5A.25.25 0 0 1 5.25 1h3.5a.25.25 0 0 1 .25.25v.5a.25.25 0 0 1-.25.25h-3.5A.25.25 0 0 1 5 1.75ZM7.5 7a.5.5 0 0 1 .5-.5h3V9a1 1 0 0 0 1 1h1.5v4a.5.5 0 0 1-.5.5H8a.5.5 0 0 1-.5-.5V7Zm6 2v-.017a.5.5 0 0 0-.13-.336L12 7.14V9h1.5Z"></path></svg>Copy Code</button><button type="button" class="st68fcLUUT0dNcuLLB2_ WtfzoAXPoZC2mMqcexgL ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ GnLX_jUB3Jn3idluie7R"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" d="M20.618 4.214a1 1 0 0 1 .168 1.404l-11 14a1 1 0 0 1-1.554.022l-5-6a1 1 0 0 1 1.536-1.28l4.21 5.05L19.213 4.382a1 1 0 0 1 1.404-.168Z" clip-rule="evenodd"></path></svg>Copied</button></div></div><div class="mtDfw7oSa1WexjXyzs9y" style="color: var(–sds-color-text-01); font-family: var(–sds-font-family-monospace); direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: var(–sds-font-size-label); line-height: 1.2em; tab-size: 4; hyphens: none; padding: var(–sds-space-x02, 8px) var(–sds-space-x04, 16px) var(–sds-space-x04, 16px); margin: 0px; overflow: auto; border: none; background: transparent;"><code class="language-text" style="color: rgb(57, 58, 52); font-family: Consolas, "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: 0.9em; line-height: 1.2em; tab-size: 4; hyphens: none;"><span>index=main sourcetype=syslog | stats count by host </span></code></div></div></pre> <ul> <li>Extract fields automatically using Interactive Field Extractor (IFX) or regex:</li> </ul> <pre><div class="XG2rBS5V967VhGTCEN1k"><div class="nHykNMmtaaTJMjgzStID"><div class="HsT0RHFbNELC00WicOi8"><i><svg width="16" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M15.434 7.51c.137.137.212.311.212.49a.694.694 0 0 1-.212.5l-3.54 3.5a.893.893 0 0 1-.277.18 1.024 1.024 0 0 1-.684.038.945.945 0 0 1-.302-.148.787.787 0 0 1-.213-.234.652.652 0 0 1-.045-.58.74.74 0 0 1 .175-.256l3.045-3-3.045-3a.69.69 0 0 1-.22-.55.723.723 0 0 1 .303-.52 1 1 0 0 1 .648-.186.962.962 0 0 1 .614.256l3.541 3.51Zm-12.281 0A.695.695 0 0 0 2.94 8a.694.694 0 0 0 .213.5l3.54 3.5a.893.893 0 0 0 .277.18 1.024 1.024 0 0 0 .684.038.945.945 0 0 0 .302-.148.788.788 0 0 0 .213-.234.651.651 0 0 0 .045-.58.74.74 0 0 0-.175-.256L4.994 8l3.045-3a.69.69 0 0 0 .22-.55.723.723 0 0 0-.303-.52 1 1 0 0 0-.648-.186.962.962 0 0 0-.615.256l-3.54 3.51Z"></path></svg></i><p class="li3asHIMe05JPmtJCytG wZ4JdaHxSAhGy1HoNVja cPy9QU4brI7VQXFNPEvF">Code</p></div><div class="CF2lgtGWtYUYmTULoX44"><button type="button" class="st68fcLUUT0dNcuLLB2_ ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf" data-copycode="true" role="button" aria-label="Copy Code"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M9.975 1h.09a3.2 3.2 0 0 1 3.202 3.201v1.924a.754.754 0 0 1-.017.16l1.23 1.353A2 2 0 0 1 15 8.983V14a2 2 0 0 1-2 2H8a2 2 0 0 1-1.733-1H4.183a3.201 3.201 0 0 1-3.2-3.201V4.201a3.2 3.2 0 0 1 3.04-3.197A1.25 1.25 0 0 1 5.25 0h3.5c.604 0 1.109.43 1.225 1ZM4.249 2.5h-.066a1.7 1.7 0 0 0-1.7 1.701v7.598c0 .94.761 1.701 1.7 1.701H6V7a2 2 0 0 1 2-2h3.197c.195 0 .387.028.57.083v-.882A1.7 1.7 0 0 0 10.066 2.5H9.75c-.228.304-.591.5-1 .5h-3.5c-.41 0-.772-.196-1-.5ZM5 1.75v-.5A.25.25 0 0 1 5.25 1h3.5a.25.25 0 0 1 .25.25v.5a.25.25 0 0 1-.25.25h-3.5A.25.25 0 0 1 5 1.75ZM7.5 7a.5.5 0 0 1 .5-.5h3V9a1 1 0 0 0 1 1h1.5v4a.5.5 0 0 1-.5.5H8a.5.5 0 0 1-.5-.5V7Zm6 2v-.017a.5.5 0 0 0-.13-.336L12 7.14V9h1.5Z"></path></svg>Copy Code</button><button type="button" class="st68fcLUUT0dNcuLLB2_ WtfzoAXPoZC2mMqcexgL ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ GnLX_jUB3Jn3idluie7R"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" d="M20.618 4.214a1 1 0 0 1 .168 1.404l-11 14a1 1 0 0 1-1.554.022l-5-6a1 1 0 0 1 1.536-1.28l4.21 5.05L19.213 4.382a1 1 0 0 1 1.404-.168Z" clip-rule="evenodd"></path></svg>Copied</button></div></div><div class="mtDfw7oSa1WexjXyzs9y" style="color: var(–sds-color-text-01); font-family: var(–sds-font-family-monospace); direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: var(–sds-font-size-label); line-height: 1.2em; tab-size: 4; hyphens: none; padding: var(–sds-space-x02, 8px) var(–sds-space-x04, 16px) var(–sds-space-x04, 16px); margin: 0px; overflow: auto; border: none; background: transparent;"><code class="language-text" style="color: rgb(57, 58, 52); font-family: Consolas, "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: 0.9em; line-height: 1.2em; tab-size: 4; hyphens: none;"><span>index=main | rex "user=(?<user>\w+)" </span></code></div></div></pre> <h3>5) Saved searches and alerts</h3> <ul> <li>Create a saved search: <ol> <li>Build a search that returns the desired results.</li> <li>Save As → Report. Name it (e.g., "Error Count Last Hour").</li> </ol> </li> <li>Convert to an alert: <ol> <li>Save As → Alert.</li> <li>Set trigger conditions (per result, number of results, or custom).</li> <li>Configure schedule (real-time or cron).</li> <li>Set actions: email, webhook, or script.</li> </ol> </li> </ul> <p>Example alert SPL:</p> <pre><div class="XG2rBS5V967VhGTCEN1k"><div class="nHykNMmtaaTJMjgzStID"><div class="HsT0RHFbNELC00WicOi8"><i><svg width="16" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M15.434 7.51c.137.137.212.311.212.49a.694.694 0 0 1-.212.5l-3.54 3.5a.893.893 0 0 1-.277.18 1.024 1.024 0 0 1-.684.038.945.945 0 0 1-.302-.148.787.787 0 0 1-.213-.234.652.652 0 0 1-.045-.58.74.74 0 0 1 .175-.256l3.045-3-3.045-3a.69.69 0 0 1-.22-.55.723.723 0 0 1 .303-.52 1 1 0 0 1 .648-.186.962.962 0 0 1 .614.256l3.541 3.51Zm-12.281 0A.695.695 0 0 0 2.94 8a.694.694 0 0 0 .213.5l3.54 3.5a.893.893 0 0 0 .277.18 1.024 1.024 0 0 0 .684.038.945.945 0 0 0 .302-.148.788.788 0 0 0 .213-.234.651.651 0 0 0 .045-.58.74.74 0 0 0-.175-.256L4.994 8l3.045-3a.69.69 0 0 0 .22-.55.723.723 0 0 0-.303-.52 1 1 0 0 0-.648-.186.962.962 0 0 0-.615.256l-3.54 3.51Z"></path></svg></i><p class="li3asHIMe05JPmtJCytG wZ4JdaHxSAhGy1HoNVja cPy9QU4brI7VQXFNPEvF">Code</p></div><div class="CF2lgtGWtYUYmTULoX44"><button type="button" class="st68fcLUUT0dNcuLLB2_ ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf" data-copycode="true" role="button" aria-label="Copy Code"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M9.975 1h.09a3.2 3.2 0 0 1 3.202 3.201v1.924a.754.754 0 0 1-.017.16l1.23 1.353A2 2 0 0 1 15 8.983V14a2 2 0 0 1-2 2H8a2 2 0 0 1-1.733-1H4.183a3.201 3.201 0 0 1-3.2-3.201V4.201a3.2 3.2 0 0 1 3.04-3.197A1.25 1.25 0 0 1 5.25 0h3.5c.604 0 1.109.43 1.225 1ZM4.249 2.5h-.066a1.7 1.7 0 0 0-1.7 1.701v7.598c0 .94.761 1.701 1.7 1.701H6V7a2 2 0 0 1 2-2h3.197c.195 0 .387.028.57.083v-.882A1.7 1.7 0 0 0 10.066 2.5H9.75c-.228.304-.591.5-1 .5h-3.5c-.41 0-.772-.196-1-.5ZM5 1.75v-.5A.25.25 0 0 1 5.25 1h3.5a.25.25 0 0 1 .25.25v.5a.25.25 0 0 1-.25.25h-3.5A.25.25 0 0 1 5 1.75ZM7.5 7a.5.5 0 0 1 .5-.5h3V9a1 1 0 0 0 1 1h1.5v4a.5.5 0 0 1-.5.5H8a.5.5 0 0 1-.5-.5V7Zm6 2v-.017a.5.5 0 0 0-.13-.336L12 7.14V9h1.5Z"></path></svg>Copy Code</button><button type="button" class="st68fcLUUT0dNcuLLB2_ WtfzoAXPoZC2mMqcexgL ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ GnLX_jUB3Jn3idluie7R"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" d="M20.618 4.214a1 1 0 0 1 .168 1.404l-11 14a1 1 0 0 1-1.554.022l-5-6a1 1 0 0 1 1.536-1.28l4.21 5.05L19.213 4.382a1 1 0 0 1 1.404-.168Z" clip-rule="evenodd"></path></svg>Copied</button></div></div><div class="mtDfw7oSa1WexjXyzs9y" style="color: var(–sds-color-text-01); font-family: var(–sds-font-family-monospace); direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: var(–sds-font-size-label); line-height: 1.2em; tab-size: 4; hyphens: none; padding: var(–sds-space-x02, 8px) var(–sds-space-x04, 16px) var(–sds-space-x04, 16px); margin: 0px; overflow: auto; border: none; background: transparent;"><code class="language-text" style="color: rgb(57, 58, 52); font-family: Consolas, "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: 0.9em; line-height: 1.2em; tab-size: 4; hyphens: none;"><span>index=main "authentication failure" | stats count by src_ip </span></code></div></div></pre> <p>Trigger when count > 10 in 30 minutes.</p> <h3>6) Creating dashboards and visualizations</h3> <ol> <li>Open Dashboards → Create New Dashboard.</li> <li>Add panels using existing searches or inline SPL.</li> <li>Choose visualization type: Table, Timechart, Column, Pie, Single Value, Map.</li> <li>Example panel SPL for timeseries:</li> </ol> <pre><div class="XG2rBS5V967VhGTCEN1k"><div class="nHykNMmtaaTJMjgzStID"><div class="HsT0RHFbNELC00WicOi8"><i><svg width="16" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M15.434 7.51c.137.137.212.311.212.49a.694.694 0 0 1-.212.5l-3.54 3.5a.893.893 0 0 1-.277.18 1.024 1.024 0 0 1-.684.038.945.945 0 0 1-.302-.148.787.787 0 0 1-.213-.234.652.652 0 0 1-.045-.58.74.74 0 0 1 .175-.256l3.045-3-3.045-3a.69.69 0 0 1-.22-.55.723.723 0 0 1 .303-.52 1 1 0 0 1 .648-.186.962.962 0 0 1 .614.256l3.541 3.51Zm-12.281 0A.695.695 0 0 0 2.94 8a.694.694 0 0 0 .213.5l3.54 3.5a.893.893 0 0 0 .277.18 1.024 1.024 0 0 0 .684.038.945.945 0 0 0 .302-.148.788.788 0 0 0 .213-.234.651.651 0 0 0 .045-.58.74.74 0 0 0-.175-.256L4.994 8l3.045-3a.69.69 0 0 0 .22-.55.723.723 0 0 0-.303-.52 1 1 0 0 0-.648-.186.962.962 0 0 0-.615.256l-3.54 3.51Z"></path></svg></i><p class="li3asHIMe05JPmtJCytG wZ4JdaHxSAhGy1HoNVja cPy9QU4brI7VQXFNPEvF">Code</p></div><div class="CF2lgtGWtYUYmTULoX44"><button type="button" class="st68fcLUUT0dNcuLLB2_ ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf" data-copycode="true" role="button" aria-label="Copy Code"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M9.975 1h.09a3.2 3.2 0 0 1 3.202 3.201v1.924a.754.754 0 0 1-.017.16l1.23 1.353A2 2 0 0 1 15 8.983V14a2 2 0 0 1-2 2H8a2 2 0 0 1-1.733-1H4.183a3.201 3.201 0 0 1-3.2-3.201V4.201a3.2 3.2 0 0 1 3.04-3.197A1.25 1.25 0 0 1 5.25 0h3.5c.604 0 1.109.43 1.225 1ZM4.249 2.5h-.066a1.7 1.7 0 0 0-1.7 1.701v7.598c0 .94.761 1.701 1.7 1.701H6V7a2 2 0 0 1 2-2h3.197c.195 0 .387.028.57.083v-.882A1.7 1.7 0 0 0 10.066 2.5H9.75c-.228.304-.591.5-1 .5h-3.5c-.41 0-.772-.196-1-.5ZM5 1.75v-.5A.25.25 0 0 1 5.25 1h3.5a.25.25 0 0 1 .25.25v.5a.25.25 0 0 1-.25.25h-3.5A.25.25 0 0 1 5 1.75ZM7.5 7a.5.5 0 0 1 .5-.5h3V9a1 1 0 0 0 1 1h1.5v4a.5.5 0 0 1-.5.5H8a.5.5 0 0 1-.5-.5V7Zm6 2v-.017a.5.5 0 0 0-.13-.336L12 7.14V9h1.5Z"></path></svg>Copy Code</button><button type="button" class="st68fcLUUT0dNcuLLB2_ WtfzoAXPoZC2mMqcexgL ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ GnLX_jUB3Jn3idluie7R"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" d="M20.618 4.214a1 1 0 0 1 .168 1.404l-11 14a1 1 0 0 1-1.554.022l-5-6a1 1 0 0 1 1.536-1.28l4.21 5.05L19.213 4.382a1 1 0 0 1 1.404-.168Z" clip-rule="evenodd"></path></svg>Copied</button></div></div><div class="mtDfw7oSa1WexjXyzs9y" style="color: var(–sds-color-text-01); font-family: var(–sds-font-family-monospace); direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: var(–sds-font-size-label); line-height: 1.2em; tab-size: 4; hyphens: none; padding: var(–sds-space-x02, 8px) var(–sds-space-x04, 16px) var(–sds-space-x04, 16px); margin: 0px; overflow: auto; border: none; background: transparent;"><code class="language-text" style="color: rgb(57, 58, 52); font-family: Consolas, "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: 0.9em; line-height: 1.2em; tab-size: 4; hyphens: none;"><span>index=main sourcetype=syslog | timechart span=1h count </span></code></div></div></pre> <ol start="5"> <li>Use dashboard tokens to make panels interactive (time range, host selector).</li> <li>Arrange layout and save. Use Simple XML for advanced customizations.</li> </ol> <h3>7) Field extractions and props/transforms</h3> <ul> <li>For recurring sources, define field extractions in props.conf and transforms.conf (on indexer or heavy forwarder). Example props.conf:</li> </ul> <pre><div class="XG2rBS5V967VhGTCEN1k"><div class="nHykNMmtaaTJMjgzStID"><div class="HsT0RHFbNELC00WicOi8"><i><svg width="16" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M15.434 7.51c.137.137.212.311.212.49a.694.694 0 0 1-.212.5l-3.54 3.5a.893.893 0 0 1-.277.18 1.024 1.024 0 0 1-.684.038.945.945 0 0 1-.302-.148.787.787 0 0 1-.213-.234.652.652 0 0 1-.045-.58.74.74 0 0 1 .175-.256l3.045-3-3.045-3a.69.69 0 0 1-.22-.55.723.723 0 0 1 .303-.52 1 1 0 0 1 .648-.186.962.962 0 0 1 .614.256l3.541 3.51Zm-12.281 0A.695.695 0 0 0 2.94 8a.694.694 0 0 0 .213.5l3.54 3.5a.893.893 0 0 0 .277.18 1.024 1.024 0 0 0 .684.038.945.945 0 0 0 .302-.148.788.788 0 0 0 .213-.234.651.651 0 0 0 .045-.58.74.74 0 0 0-.175-.256L4.994 8l3.045-3a.69.69 0 0 0 .22-.55.723.723 0 0 0-.303-.52 1 1 0 0 0-.648-.186.962.962 0 0 0-.615.256l-3.54 3.51Z"></path></svg></i><p class="li3asHIMe05JPmtJCytG wZ4JdaHxSAhGy1HoNVja cPy9QU4brI7VQXFNPEvF">conf</p></div><div class="CF2lgtGWtYUYmTULoX44"><button type="button" class="st68fcLUUT0dNcuLLB2_ ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf" data-copycode="true" role="button" aria-label="Copy Code"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M9.975 1h.09a3.2 3.2 0 0 1 3.202 3.201v1.924a.754.754 0 0 1-.017.16l1.23 1.353A2 2 0 0 1 15 8.983V14a2 2 0 0 1-2 2H8a2 2 0 0 1-1.733-1H4.183a3.201 3.201 0 0 1-3.2-3.201V4.201a3.2 3.2 0 0 1 3.04-3.197A1.25 1.25 0 0 1 5.25 0h3.5c.604 0 1.109.43 1.225 1ZM4.249 2.5h-.066a1.7 1.7 0 0 0-1.7 1.701v7.598c0 .94.761 1.701 1.7 1.701H6V7a2 2 0 0 1 2-2h3.197c.195 0 .387.028.57.083v-.882A1.7 1.7 0 0 0 10.066 2.5H9.75c-.228.304-.591.5-1 .5h-3.5c-.41 0-.772-.196-1-.5ZM5 1.75v-.5A.25.25 0 0 1 5.25 1h3.5a.25.25 0 0 1 .25.25v.5a.25.25 0 0 1-.25.25h-3.5A.25.25 0 0 1 5 1.75ZM7.5 7a.5.5 0 0 1 .5-.5h3V9a1 1 0 0 0 1 1h1.5v4a.5.5 0 0 1-.5.5H8a.5.5 0 0 1-.5-.5V7Zm6 2v-.017a.5.5 0 0 0-.13-.336L12 7.14V9h1.5Z"></path></svg>Copy Code</button><button type="button" class="st68fcLUUT0dNcuLLB2_ WtfzoAXPoZC2mMqcexgL ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ GnLX_jUB3Jn3idluie7R"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" d="M20.618 4.214a1 1 0 0 1 .168 1.404l-11 14a1 1 0 0 1-1.554.022l-5-6a1 1 0 0 1 1.536-1.28l4.21 5.05L19.213 4.382a1 1 0 0 1 1.404-.168Z" clip-rule="evenodd"></path></svg>Copied</button></div></div><div class="mtDfw7oSa1WexjXyzs9y" style="color: var(–sds-color-text-01); font-family: var(–sds-font-family-monospace); direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: var(–sds-font-size-label); line-height: 1.2em; tab-size: 4; hyphens: none; padding: var(–sds-space-x02, 8px) var(–sds-space-x04, 16px) var(–sds-space-x04, 16px); margin: 0px; overflow: auto; border: none; background: transparent;"><code class="language-text" style="color: rgb(57, 58, 52); font-family: Consolas, "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: 0.9em; line-height: 1.2em; tab-size: 4; hyphens: none;"><span>[source::…/myapp.log] </span>sourcetype = myapp:log REPORT-myfields = extract_myfields </code></div></div></pre> <p>Example transforms.conf:</p> <pre><div class="XG2rBS5V967VhGTCEN1k"><div class="nHykNMmtaaTJMjgzStID"><div class="HsT0RHFbNELC00WicOi8"><i><svg width="16" height="16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M15.434 7.51c.137.137.212.311.212.49a.694.694 0 0 1-.212.5l-3.54 3.5a.893.893 0 0 1-.277.18 1.024 1.024 0 0 1-.684.038.945.945 0 0 1-.302-.148.787.787 0 0 1-.213-.234.652.652 0 0 1-.045-.58.74.74 0 0 1 .175-.256l3.045-3-3.045-3a.69.69 0 0 1-.22-.55.723.723 0 0 1 .303-.52 1 1 0 0 1 .648-.186.962.962 0 0 1 .614.256l3.541 3.51Zm-12.281 0A.695.695 0 0 0 2.94 8a.694.694 0 0 0 .213.5l3.54 3.5a.893.893 0 0 0 .277.18 1.024 1.024 0 0 0 .684.038.945.945 0 0 0 .302-.148.788.788 0 0 0 .213-.234.651.651 0 0 0 .045-.58.74.74 0 0 0-.175-.256L4.994 8l3.045-3a.69.69 0 0 0 .22-.55.723.723 0 0 0-.303-.52 1 1 0 0 0-.648-.186.962.962 0 0 0-.615.256l-3.54 3.51Z"></path></svg></i><p class="li3asHIMe05JPmtJCytG wZ4JdaHxSAhGy1HoNVja cPy9QU4brI7VQXFNPEvF">conf</p></div><div class="CF2lgtGWtYUYmTULoX44"><button type="button" class="st68fcLUUT0dNcuLLB2_ ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf" data-copycode="true" role="button" aria-label="Copy Code"><svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M9.975 1h.09a3.2 3.2 0 0 1 3.202 3.201v1.924a.754.754 0 0 1-.017.16l1.23 1.353A2 2 0 0 1 15 8.983V14a2 2 0 0 1-2 2H8a2 2 0 0 1-1.733-1H4.183a3.201 3.201 0 0 1-3.2-3.201V4.201a3.2 3.2 0 0 1 3.04-3.197A1.25 1.25 0 0 1 5.25 0h3.5c.604 0 1.109.43 1.225 1ZM4.249 2.5h-.066a1.7 1.7 0 0 0-1.7 1.701v7.598c0 .94.761 1.701 1.7 1.701H6V7a2 2 0 0 1 2-2h3.197c.195 0 .387.028.57.083v-.882A1.7 1.7 0 0 0 10.066 2.5H9.75c-.228.304-.591.5-1 .5h-3.5c-.41 0-.772-.196-1-.5ZM5 1.75v-.5A.25.25 0 0 1 5.25 1h3.5a.25.25 0 0 1 .25.25v.5a.25.25 0 0 1-.25.25h-3.5A.25.25 0 0 1 5 1.75ZM7.5 7a.5.5 0 0 1 .5-.5h3V9a1 1 0 0 0 1 1h1.5v4a.5.5 0 0 1-.5.5H8a.5.5 0 0 1-.5-.5V7Zm6 2v-.017a.5.5 0 0 0-.13-.336L12 7.14V9h1.5Z"></path></svg>Copy Code</button><button type="button" class="st68fcLUUT0dNcuLLB2_ WtfzoAXPoZC2mMqcexgL ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ GnLX_jUB3Jn3idluie7R"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" fill-rule="evenodd" d="M20.618 4.214a1 1 0 0 1 .168 1.404l-11 14a1 1 0 0 1-1.554.022l-5-6a1 1 0 0 1 1.536-1.28l4.21 5.05L19.213 4.382a1 1 0 0 1 1.404-.168Z" clip-rule="evenodd"></path></svg>Copied</button></div></div><div class="mtDfw7oSa1WexjXyzs9y" style="color: var(–sds-color-text-01); font-family: var(–sds-font-family-monospace); direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: var(–sds-font-size-label); line-height: 1.2em; tab-size: 4; hyphens: none; padding: var(–sds-space-x02, 8px) var(–sds-space-x04, 16px) var(–sds-space-x04, 16px); margin: 0px; overflow: auto; border: none; background: transparent;"><code class="language-text" style="color: rgb(57, 58, 52); font-family: Consolas, "Bitstream Vera Sans Mono", "Courier New", Courier, monospace; direction: ltr; text-align: left; white-space: pre; word-spacing: normal; word-break: normal; font-size: 0.9em; line-height: 1.2em; tab-size: 4; hyphens: none;"><span>[extract_myfields] </span>REGEX = user=(?P<user>\w+)\s+action=(?P<action>\w+) FORMAT = user::\)1 action::\(2 </code></div></div></pre> <ul> <li>Or create extractions via Settings → Fields → Field Extractions in Splunk Web.</li> </ul> <h3>8) Performance basics and sizing tips</h3> <ul> <li>Use index-time vs. search-time field extractions wisely (prefer search-time).</li> <li>Keep hot/warm/cold buckets sized per retention needs.</li> <li>Use summary indexing and data model acceleration for large data sets.</li> <li>Monitor resource usage with Monitoring Console → Indexing and Search.</li> </ul> <h3>9) Common troubleshooting</h3> <ul> <li>Splunk service not starting: check \)SPLUNK_HOME/var/log/splunk/splunkd.log