You can retrieve information from a Splunk platform. To do this:

1. In the Create a new data model box, click the Splunk button in the Reports section.
   
   ➡ The Splunk dialog box appears.
2. Select the desired connection mode.

• Manual connection mode
  The connection will be visible in the data source only.
  1. Enter the supplied platform connection information:
     • Server URL in the form <protocol>://<host>:<port> (for example, https://localhost:8089).
     • User : this is your Splunk login.
     • Password: this is your Splunk password.
  2. Click the Connect button.
      
• Named connection mode
  The connection will be visible in the connection manager and usable by all data sources.
  1. Click Select: the Database Connection Manager appears.
  2. You can :
     • Select an existing connection from the list. Click OK.
     • Create a new connection as described on the Add a connection named.
  3. Click the Connection button.

3. In the Splunk Search section, the Index drop-down list displays an overview of all indexes on the Splunk server after authentication.
   Splunk information is retrieved via DigDash using command lines in the search box below. Guidance is provided by clicking on the context-sensitive help button .
   The syntax is very similar to the way search works on the Web version. http://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CLIsearchsyntax
   However, there are a few things to bear in mind. See paragraph Search syntax paragraph for more details.
   ➡ A preview of the result is displayed in the Preview section and data Selection options are available. See the Preview page and the paragraph Data selection for more details.
4. You can also add data transformations. See the Transform data page for more details.
5. Once you are happy with the result, click Next to configure the data model.

Search syntax

search command

Splunk searches must begin with the search command. However, you can omit (or not) this command, since the search command is implicitly taken into account by DigDash when writing your Splunk search.

Example:

Entering the search

"index=_internal * | head 10

is equivalent to the search

"search index=_internal * | head 10".

Index selection

Selecting an index automatically inserts the " index=<index-name> " filter into your query after the search command.

Examples: We assume that the "_internal" index is selected in the list of indexes.

1/ Entering the search

"* | head 10

is equivalent to the search

"search index=_internal * | head 10".

2/ Entering the search

"search * | head 10

is equivalent to the search

"search index=_internal * | head 10".

If no index is selected, you can enter the name of the index directly in your search.

Example: We assume that no index is selected in the list of indexes.

Entering the search

"index=_internal * | head 10" search

is equivalent to the search

"search index=_internal * | head 10".

Dates

As with the Web version, you can filter your results by a given period by specifying two filters in your search: earliest and latest.

If neither of these two filters is mentioned in your search, the earliest=-1h and latest=now filters will be taken into account.

As in the web version, you can enter two types of time period:

• Absolute dates
• Relative time periods

You can find the different syntaxes in the official Splunk documentation:

https://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Specifytimemodifiersinyoursearch

Number of lines returned

By default, and for the sake of speed of response, the maximum number of lines returned is 10,000. However, you can customise this number by including the " head <integer>" operation in your search, as follows:

Example: entering the search "search index=_internal * | head 10" returns the first 10 results of the search.