Splunk Portal examples

These examples use standard mode syntax, index=federated:<name>, against a dataset of OpenTelemetry trace data. In transparent mode, drop the federated: prefix and use the dataset name directly. Adjust index and field names to your setup.

First searches

Raw events, newest first. Click any event to see the full record, and use the field sidebar to explore:

index=federated:otel-traces | head 20

Filters push down, so only matching events leave Axiom:

index=federated:otel-traces "service.name"=frontend kind=server | head 50

Note that dotted field names take double quotes in SPL, as on any Splunk index.

Count at any scale

Exact counts per service over millions of events, computed inside Axiom:

index=federated:otel-traces | stats count by "service.name" | sort - count

The classic top-N and rare patterns push down too:

index=federated:otel-traces | top 10 "service.name"
index=federated:otel-traces | rare kind

Aggregations

Any mix of aggregation functions in one stats command:

index=federated:otel-traces | stats dc("service.name") as services
index=federated:otel-traces | stats count avg(duration_ms) median(duration_ms) by kind
index=federated:otel-traces | stats first("service.name") last("service.name")

Time series and dashboards

timechart is computed Axiom-side, including the time bins, so dashboard panels backed by federated searches stay fast at any data volume:

index=federated:otel-traces | timechart count
index=federated:otel-traces | timechart span=1h count by kind
index=federated:otel-traces kind=server | timechart count

Shape results on the search head

Streaming commands run on the search head over the events Axiom returns, so familiar SPL shaping works unchanged:

index=federated:otel-traces | head 100 | eval svc='service.name' | stats count by svc
index=federated:otel-traces | head 100 | rex field=name "(?<verb>^\w+)" | top verb
index=federated:otel-traces | head 200 | dedup "service.name" | table "service.name"

Use lookups against Axiom data

In transparent mode, CSV lookups that live on your Splunk search head are replicated to Axiom and joined there:

index=otel-traces | lookup kind_names kind OUTPUT kind_label | stats count by kind_label

This is the pattern that makes existing Splunk content work: the lookup table stays in Splunk, the events stay in Axiom, and the Portal joins them where the data is.

Query data models with tstats

In transparent mode, data models queried with tstats, the pattern security content uses, are answered exactly from Axiom:

| tstats summariesonly=false count from datamodel=Web by Web.status

Inspect what happened

On any federated search, click Job, and then select Inspect Job. The axiom.* entries in Execution costs show what happened on the Axiom side: events scanned, query time, and rows in and out. For pushed-down aggregations, the events-scanned count reflects the full scan Axiom performed, even though only a handful of result rows crossed the wire. For details, see Monitor and troubleshoot.