2026-08-11 SPLUNK 3 min
Finding the delta in Splunk
Comparing a value to its previous event is one of those things I look up every single time. streamstats does it in one line, and here is the version I keep in my snippets file.
#splunk 3 notes
2026-07-28 SPLUNK 2 min
Make timestamps human readable
Epoch seconds are fine for machines. For a dashboard someone else has to read, format the field once at search time and never think about it again.
READ NOTE →2026-06-05 SPLUNK 5 min
Lookups vs. subsearches, finally
When each one is faster, with the row counts that decided it — so I stop reaching for a subsearch out of habit.
READ NOTE →