I love Splunk. The way it simplifies my job has been completely changed due to Splunk. The number one resource I use is the Quick Reference Guide. You can print one out and then it makes it easy to just quickly grab it to complete your searches. I don’t know how many times I have used it. I have worn out two of them.

http://docs.splunk.com/images/1/17/4.2.x_search_language_refcard.pdf