{"id":137,"date":"2026-01-04T10:16:51","date_gmt":"2026-01-04T10:16:51","guid":{"rendered":"http:\/\/securitylearning.ir\/?post_type=knowledgebase&#038;p=137"},"modified":"2026-03-17T22:13:53","modified_gmt":"2026-03-17T22:13:53","slug":"splunk-command-structure","status":"publish","type":"knowledgebase","link":"https:\/\/securitylearning.ir\/index.php\/knowledge-base\/splunk\/splunk-command-structure\/","title":{"rendered":"Splunk Command Structure"},"content":{"rendered":"\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0628\u0631\u0627\u06cc \u06a9\u0627\u0631 \u0628\u0627 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0627\u0633\u067e\u0644\u0627\u0646\u06a9 \u0628\u0627\u06cc\u062f \u0628\u0647 \u0646\u06a9\u0627\u062a \u0632\u06cc\u0631 \u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u0645. <br>\u06a9\u0644\u06cc\u0627\u062a \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0627\u0633\u067e\u0644\u0627\u0646\u06a9 \u0628\u0647 \u0635\u0648\u0631\u062a \u0632\u06cc\u0631 \u0645\u06cc \u0628\u0627\u0634\u062f :<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-left\"><code>&lt;Search Criteria> | &lt;Command><\/code><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0633\u0645\u062a \u0686\u067e \u0686\u06cc\u0632\u06cc \u06a9\u0647 \u0628\u0627\u06cc\u062f \u062c\u0633\u062a\u062c\u0648 \u0634\u0648\u062f \u0631\u0627 \u0645\u0634\u062e\u0635 \u0645\u06cc \u06a9\u0646\u062f . | \u0628\u0631\u0627\u06cc \u0627\u0631\u0633\u0627\u0644 \u0646\u062a\u0627\u06cc\u062c \u0628\u0647 \u0642\u0633\u0645\u062a \u0633\u0645\u062a \u0631\u0627\u0633\u062a \u0645\u06cc \u0628\u0627\u0634\u062f \u0648 \u0633\u0645\u062a \u0631\u0627\u0633\u062a \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0648\u06cc \u0646\u062a\u0627\u06cc\u062c \u0645\u06cc \u0628\u0627\u0634\u062f.<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0628\u0631\u0627\u06cc \u062c\u0633\u062a\u062c\u0648 \u0645\u0627 \u0641\u06cc\u0644\u062f \u0648 \u06a9\u06cc \u0648\u0631\u062f \u0648 \u0639\u0645\u0644\u06af\u0631\u0647\u0627\u06cc <code>And<\/code> \u0648 <code>OR<\/code> \u0648 <code>NOT<\/code> \u0631\u0627 \u062f\u0627\u0631\u06cc\u0645.<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0646\u06a9\u062a\u0647 : \u0628\u0647 \u0635\u0648\u0631\u062a \u067e\u06cc\u0634 \u0641\u0631\u0636 \u0627\u0633\u067e\u0644\u0627\u0646\u06a9 \u0628\u06cc\u0646 \u06a9\u06cc \u0648\u0631\u062f \u0648 \u0641\u06cc\u0644\u062f \u0647\u0627 \u062e\u0648\u062f\u0634 <code>AND<\/code> \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc \u062f\u0647\u062f \u0627\u06af\u0631 \u0686\u06cc\u0632\u06cc \u0646\u06cc\u0627\u0648\u0631\u06cc\u0645.<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0645\u06cc \u0634\u0648\u062f \u0627\u0632 \u062a\u0631\u06a9\u06cc\u0628\u0627\u062a \u0627\u06cc\u0646\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f \u06a9\u0647 \u0645\u0647\u0645 \u0627\u0633\u062a \u0628\u0631\u0627\u06cc \u0628\u0631\u062e\u06cc \u06a9\u0627\u0631\u0647\u0627 \u0627\u0632 \u067e\u0631\u0627\u0646\u062a\u0632 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u0645:<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-left\"><code>(error OR failure) AND database<\/code><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0628\u0631\u0627\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0641\u06cc\u0644\u062f \u0647\u0645 \u0628\u0647 \u0635\u0648\u0631\u062a \u0632\u06cc\u0631 \u062f\u0627\u0631\u06cc\u0645 :<\/bdo><\/p>\n\n\n\n<p><code>field=value<\/code><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0645\u0627\u0646\u0646\u062f :<\/bdo><\/p>\n\n\n\n<p><code>dstport=32000<\/code><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0639\u0644\u0627\u0645\u062a pipe \u0628\u0631\u0627\u06cc \u0627\u0631\u0633\u0627\u0644 \u0646\u062a\u0627\u06cc\u062c \u06cc\u06a9 \u06a9\u0627\u0645\u0646\u062f \u0628\u0647 \u06cc\u06a9 \u06a9\u0627\u0645\u0646\u062f \u062f\u06cc\u06af\u0631 \u0628\u0631\u0627\u06cc \u06a9\u0627\u0631\u0647\u0627\u06cc \u062f\u06cc\u06af\u0631 \u0627\u0633\u062a.<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0627\u0632 \u06a9\u0627\u0645\u0646\u062f \u0647\u0627\u06cc \u0632\u06cc\u0631 \u0645\u06cc \u062a\u0648\u0627\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f :<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-left\"><code>| stats count \u0628\u0631\u0627\u06cc \u062e\u0644\u0627\u0635\u0647 \u06a9\u0631\u062f\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a<br>| table host source status \u0628\u0631\u0627\u06cc \u0646\u0634\u0627\u0646 \u062f\u0627\u062f\u0646 \u0641\u06cc\u0644\u062f \u0647\u0627\u06cc\u06cc \u06a9\u0647 \u062f\u0631 \u0627\u062f\u0627\u0645\u0647 \u0622\u0648\u0631\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a <br>| sort -count \u0628\u0631\u0627\u06cc \u0645\u0631\u062a\u0628 \u0633\u0627\u0632\u06cc<\/code><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0645\u062b\u0627\u0644 \u0628\u0631\u0627\u06cc \u062f\u06cc\u062f\u0646 \u0641\u0642\u0637 \u062a\u0639\u062f\u0627\u062f srcIP \u0648 \u062a\u0639\u062f\u0627\u062f \u0627\u062a\u0641\u0627\u0642 \u0627\u0641\u062a\u0627\u062f\u0646 \u0622\u0646\u0647\u0627 \u062f\u0631 \u0622\u062e\u0631 \u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u06cc\u0645 :<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-left\"><code>| stats count by srcip<\/code><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u062f\u0633\u062a\u0648\u0631 <code>eval<\/code> :<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-right\">\u0628\u0631\u0627\u06cc \u0633\u0627\u062e\u062a <bdo lang=\"\" dir=\"rtl\">\u06cc\u06a9 \u0641\u06cc\u0644\u062f \u062c\u062f\u06cc\u062f<br>\u062a\u063a\u06cc\u06cc\u0631 \u0641\u06cc\u0644\u062f \u0645\u0648\u062c\u0648\u062f<br>\u0645\u062d\u0627\u0633\u0628\u0647 \u06cc\u06a9 \u0645\u0642\u062f\u0627\u0631<br>\u0628\u0631\u0627\u06cc<\/bdo> \u06a9\u0627\u0646\u062f\u06cc\u0634\u0646 \u0648 IF<\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0628\u0647 \u0637\u0648\u0631 \u06a9\u0644\u06cc \u0645\u062d\u0627\u0633\u0628\u0647 \u06cc\u06a9 \u0645\u0642\u062f\u0627\u0631 \u0628\u0631\u0627\u06cc \u06cc\u06a9 \u0631\u062e\u062f\u0627\u062f<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-right\"><bdo lang=\"\" dir=\"rtl\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 :<\/bdo><\/p>\n\n\n\n<p class=\"has-text-align-left\"><code>| eval new_field = expression<br>| eval total = bytes_in + bytes_out<br>| eval mb = bytes \/ 1024 \/ 1024<br>| if(condition, value_if_true, value_if_false)<br>| eval result = if(status=200, \"OK\", \"NOT_OK\")<\/code><\/p>\n\n\n\n<p class=\"has-text-align-left\"><code>eval x=1<br>eval x=if(a=1,\"yes\",\"no\")<br>eval is_ok=(status=200)<br>count(eval(condition))<\/code><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0628\u0631\u0627\u06cc \u06a9\u0627\u0631 \u0628\u0627 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0627\u0633\u067e\u0644\u0627\u0646\u06a9 \u0628\u0627\u06cc\u062f \u0628\u0647 \u0646\u06a9\u0627\u062a \u0632\u06cc\u0631 \u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u0645. \u06a9\u0644\u06cc\u0627\u062a \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0627\u0633\u067e\u0644\u0627\u0646\u06a9 \u0628\u0647 \u0635\u0648\u0631\u062a \u0632\u06cc\u0631 \u0645\u06cc \u0628\u0627\u0634\u062f : &lt;Search Criteria> | &lt;Command> \u0633\u0645\u062a \u0686\u067e \u0686\u06cc\u0632\u06cc \u06a9\u0647 \u0628\u0627\u06cc\u062f \u062c\u0633\u062a\u062c\u0648 \u0634\u0648\u062f \u0631\u0627 \u0645\u0634\u062e\u0635 \u0645\u06cc \u06a9\u0646\u062f . | \u0628\u0631\u0627\u06cc \u0627\u0631\u0633\u0627\u0644 \u0646\u062a\u0627\u06cc\u062c \u0628\u0647 \u0642\u0633\u0645\u062a \u0633\u0645\u062a \u0631\u0627\u0633\u062a \u0645\u06cc \u0628\u0627\u0634\u062f \u0648 \u0633\u0645\u062a \u0631\u0627\u0633\u062a \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0648\u06cc \u0646\u062a\u0627\u06cc\u062c \u0645\u06cc \u0628\u0627\u0634\u062f. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","template":"","knowledgebase_cat":[18],"class_list":["post-137","knowledgebase","type-knowledgebase","status-publish","hentry","knowledgebase_cat-splunk"],"_links":{"self":[{"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/knowledgebase\/137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/knowledgebase"}],"about":[{"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/types\/knowledgebase"}],"author":[{"embeddable":true,"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/comments?post=137"}],"version-history":[{"count":8,"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/knowledgebase\/137\/revisions"}],"predecessor-version":[{"id":315,"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/knowledgebase\/137\/revisions\/315"}],"wp:attachment":[{"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/media?parent=137"}],"wp:term":[{"taxonomy":"knowledgebase_cat","embeddable":true,"href":"https:\/\/securitylearning.ir\/index.php\/wp-json\/wp\/v2\/knowledgebase_cat?post=137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}