Splunk 7.x Quick Start Guide

Conventions used

There are a number of text conventions used throughout this book.

CodeInText: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: "The rpm will install Splunk in the /opt/splunk directory"

A block of code is set as follows:

index=<index> <filter> <"text string to match"> | command1 <arguments> | command2 <arguments> | visualization commands & arguments

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

hot bucket (files being written to)/opt/splunk/var/lib/splunk/myindex/db/hot_v1_41warm bucket (closed for writing, searchable)/opt/splunk/var/lib/splunk/myindex/ ...