In Splunk, search macros are defined from Settings > Advanced Search > Search macros.

The span argument sets the time interval, or size of each time bin, used by timechart; for example, span=1h creates hourly bins.

The Splunk Common Information Model add-on includes the Authentication data model, which defines normalized fields and tags for login and authentication activities across data sources.

Splunk data models use four dataset types: event datasets, search datasets, transaction datasets, and child datasets. Child datasets inherit from and further constrain their parent event, search, or transaction datasets.

Selecting the option to use the same time range as the search that created the field listing causes the workflow action to inherit the originating search’s time range.

Splunk calculated fields define reusable eval expressions, allowing transformations that would otherwise require repeatedly writing a long or complex eval command in searches.

The Splunk chart command supports over to group results by one field and by to further split those groups by another field, producing subgrouped aggregate results.

The stats, chart, and timechart commands are Splunk’s statistical and charting commands and use statistical functions for aggregations such as counts, sums, averages, ranges, and percentiles. chart formats results for charts, timechart aggregates them over time, and stats produces statistical tables. Splunk: Statistical and charting functions

A calculated field uses an eval expression to automatically produce a field at search time, eliminating the need to manually include the equivalent eval command in each search.

Splunk calculated fields create values from other event fields through eval expressions at search time. They can be searched as extracted fields, and they provide a reusable shortcut for applying an eval calculation without writing that calculation in every search. They may be configured for a sourcetype, host, or source, so they are not restricted to only host and sourcetype.

A GET workflow action retrieves information from an external resource, typically by passing selected field values in a URL request.

Unstructured data has no predefined fields or consistent tabular schema, so regular expressions are used to recognize textual patterns and extract the needed values.

Splunk search workflow actions accept field-value variables in the form $<field name>$; the dollar signs delimit the placeholder that is replaced with the field value.

A root search dataset can use transforming commands, including commands such as stats, chart, and timechart. The limitation is that a root search dataset using transforming commands cannot be accelerated; the commands themselves are allowed.

The * wildcard matches zero or more characters in a where command search pattern. Microsoft documents that where patterns can include * and ?; the asterisk is the multiple-character wildcard.

The datamodel command takes the data model name first, followed by the dataset name. In this search, Application_State is the data model and All_Application_State is the dataset from which events are returned.

Search workflow actions launch dynamically populated secondary searches using specific field values from an event. They support field-value placeholders in the search string and can be configured to open the search in a new window within Splunk.

A calculated field is defined with an eval expression that computes a new field value from existing event data.

A Splunk search macro that accepts arguments is invoked with its name and comma-separated argument values enclosed in backticks. Dollar-sign notation identifies argument tokens within the macro definition and is not used around values when invoking the macro.

Splunk macros must be enclosed in backticks, with any arguments inside the macro call. A command-style macro can be inserted as a piped search fragment, and an eval-expression macro can be used as the expression assigned by eval. Macros within quoted values are not expanded, and if is not a standalone statistical function accepted by stats.

The data models included in the Splunk Common Information Model add-on have data model acceleration disabled by default. Acceleration is optional and can be enabled for selected models when faster data-model-based searches, reports, or dashboards are needed.

The Common Information Model Add-on Manual contains the Data Models reference documentation, including the fields and tags that define each CIM data model.

The Common Information Model provides a common schema of fields and tags for normalizing data. Knowledge objects such as field aliases, event types, tags, and data models are used to apply that schema. Normalized data can support correlation searches across sources, but CIM is not itself the correlating mechanism or an application.

fillnull replaces null field values; its default replacement is 0 when no value argument is supplied. A separate fillnull value="NO-VALUE" operation is needed for field2, because that field requires a different replacement value.