Joining the Splunk Family: A Guide to Getting Started with the Search App

Are you new to the world of Splunk? Or perhaps you're looking to refresh your skills in using the Search app? Either way, this tutorial is designed to help you get started with the basics of Splunk and its powerful Search app.

Before we dive in, it's essential to clarify that there are different versions of Splunk software available. If you have a free version of the software, some features may not be accessible, such as changing preferences in the user account menu. Additionally, using a free trial version ensures that tutorial data is kept separate from your work data.

In this tutorial, we'll be working with specific data to ensure consistency in search results and the features you're learning about. If you already have access to Splunk software, feel free to use a free trial version for this tutorial. Keep in mind that some screenshots may show previous versions of the Search app, but these minor differences won't impact your successful completion of the tutorial.

You might notice minor differences between the screen shots in this tutorial and those in your Splunk software deployment. Additionally, specific differences between Splunk Enterprise and Splunk Cloud Platform are highlighted throughout this guide.

The Search & Reporting application (Search app) is the primary interface for using the Splunk software to run searches, save reports, and create dashboards. This tutorial is designed specifically for users who are new to the Splunk platform and the Search app.

By the end of this tutorial, you'll have a solid understanding of how to use the Search app and be well on your way to becoming a proficient Splunk user. So, let's get started!

Splunk join documentation