Splunk Tutorial: Learn Log Analysis from Scratch (2026)
Splunk is the platform for searching, monitoring, and analyzing machine-generated data. I have used it to centralize logs from thousands of servers, build real-time operational dashboards, and set up alerts that fire when error rates exceed thresholds. Splunk power comes from its search language (SPL) and its ability to ingest any data format via forwarders.
This tutorial covers data ingestion with forwarders, SPL search fundamentals, dashboard creation for operations teams, and knowledge objects that make data easier to query.
Data Ingestion with Universal Forwarders
The universal forwarder is a lightweight agent that collects log files, Windows event logs, and metrics, then forwards to indexers. Forwarders use compression and SSL for efficient transport. Heavy forwarders provide additional parsing before indexing.
inputs.conf configures what data to monitor. The deployment server pushes configurations to all forwarders centrally.
# inputs.conf:
[monitor:///var/log/app/*.log]
sourcetype = app_log
index = main
disabled = false
[WinEventLog://Application]
index = windowsSPL: The Search Processing Language
SPL is a pipeline search language. Events flow through commands separated by pipes. The search command filters, then subsequent commands transform, aggregate, and format. Common commands: stats (aggregation), timechart (time-based), top (most common values), eval (field creation).
I use eval for calculated fields and conditionals. Subsearches run a query and pass results to the outer search.
index=web_logs status=500
| stats count by uri, method
| sort -count
| head 20
index=app_logs ERROR
| timechart count by host span=5m
| where count > 100Dashboards and Reports
Splunk dashboards are composed of panels powered by saved searches. Each panel can be a chart, table, single value, or map. Dashboards support drill-down — clicking a panel element opens another search filtered by that context.
I build operational dashboards with time range pickers and input tokens for dynamic filtering.
Errors by Service
index=prod ERROR | stats count by service
Alerts and Thresholds
Alerts trigger when a saved search returns results matching conditions. Alert types: scheduled (runs on a schedule) and real-time (continuously evaluates). Actions include email, webhook, or script execution.
I use throttling to prevent alert fatigue — once an alert fires for an entity, wait N minutes before firing again for the same entity.
// Alert search:
index=prod sourcetype=app_log ERROR
| stats count as error_count by service, host
| where error_count > 100
// Trigger when result count > 0
// Throttle: 1 per service per 15 minutesField Extractions and Data Enrichment
Splunk extracts fields automatically from structured data (JSON, CSV). For unstructured logs, define custom extractions using regex in props.conf and transforms.conf. Inline extractions are at search time; indexed extractions are at parse time.
Lookups enrich events with external data: csv lookups for static data, KV store for dynamic data.
# props.conf:
[app_log]
EXTRACT-service = service::"(?[\w-]+)"
# transforms.conf:
[host_metadata_lookup]
filename = host_metadata.csv Knowledge Objects and Data Models
Knowledge objects make data more accessible. Event types categorize events. Tags provide flexible associations. Data models define hierarchical datasets for pivot-based reporting — they abstract SPL so non-technical users can build dashboards.
I create data models for common domains: web traffic, application errors, database performance. Acceleration improves pivot performance on large datasets.
# Data model acceleration:
| datamodel WebTraffic search
| search status=500
| stats count by uriFrequently Asked Questions
What is the difference between universal forwarder and heavy forwarder?
Universal forwarder is lightweight, sending raw data. Heavy forwarder provides parsing, routing, and filtering before forwarding.
How does Splunk index data?
Splunk parses incoming data into events, extracts fields, compresses, and stores in indexes on disk. Indexes are directories of searchable buckets.
What is a SPL pipeline?
SPL processes events through pipe-separated commands. Each command transforms the result set, making searches modular and debuggable.
How do I size a Splunk deployment?
Calculate daily ingest volume. A typical indexer handles 200-500 GB/day. Use 2x replication for HA. License based on daily ingest volume.
Originally published on Ayodhyyya. Last updated June 1, 2026.