Uploaded byErin Sweeney
Splunk .conf2011: Search Language: Beginner
The document is a presentation by Dan Plaza, a senior instructor at Splunk, providing an overview of basic search functionalities within the Splunk search app. It covers topics such as running searches, navigating results, using fields, saving searches, and generating reports, emphasizing the ability to search through data effectively. The document highlights the importance of using time ranges and fields to refine searches and improve data analysis.
Splunk .conf2011: Search Language: Beginner
- 1. Search Language -Beginner Dan Plaza, Sr. Instructor
- 2. Getting started –Search summary view Running basic searches and viewing results Navigating through search results Understanding and using fields in search Saving searches Agenda
- 3. Dan Plaza –Senior Instructor – Splunk Splunker since November 2010 Experience in database, security, web apps and compliance standards Constantly amazed by the cool stuff Splunk can do About Your Presenter
- 4.
- 5.
- 6. Summary View currentview global stats menus and action links time range picker data sources do it search box
- 7.
- 8. Everything is searchable* wildcard supported Search terms are case insensitive Booleans AND, OR, NOT Booleans must be uppercase Implied AND between search terms Use () for complex searches Quote phrases Basic Search
- 9. Search Results timelinefield picker timestamp event data Highlighted search terms
- 10. Searches return eventsAn event is single piece of data in Splunk, like a record in a log file or other data input Splunk breaks up data into individual events and gives each a timestamp , host , source and source type Events
- 11. By default, Splunksearches over all time Use the time range picker to narrow your search, or search in real time Selecting the Time Range
- 12. Real-time searching allowsyou to view events as they come in Useful in troubleshooting an active issue or creating critical alerts Real-time Searching
- 13.
- 14. Navigating Search Results– click Click a term in the events to add it to the search
- 15. Navigating Results –Alt+Click alt+click a term in the events to remove events with that term from the results
- 16. Navigating Results –Timeline Click a bar in the timeline to drill-down to events that occurred in that time period
- 17. Navigating Results –Timeline (cont.) Select all returns to the original timeframe You can also zoom in / zoom out to narrow or broaden the timerange
- 18. Select custom timefrom the time range picker to indicate specific date or relative time ranges Indicating a Custom Time Range
- 19.
- 20. Fields turn plainold log data into Splunked data There are 2 types of fields Default fields – host , source , sourcetype . These fields exist for every event in Splunk. Data-defined fields – fields that are specific to a given type of data Fields
- 21. Splunk identifies fieldsin events, including the action field In these events, the action field has five values Identify the Fields
- 22. Use the FieldPicker remove events from results that don’t have the field create reports click on a value to add to the search ALT + click on a value to remove from a search
- 23. This search examplereturns events where: The sourcetype – or type of data – is apache weblogs The action field has a value of purchase The HTTP status returned was NOT 200 Searching with Fields sourcetype=access_* action=purchase status!=200 36 events where an e-commerce purchase failed because of an HTTP error!!
- 24. Quick Reporting Clickto generate a quick report
- 25.
- 26. 1. Clickthe save search icon 2. Name the search You can also edit the search string and time Optionally, share the search with other users Saving a Search 500 OR 503 500 OR 503
- 27. Run saved searchesfrom the Searches and Reports menu Lists all searches you have permission to run Running a Saved Search
- 28. Splunk has manypowerful features and search commands that allow you to Calculate statistics Format and organize values within search results Create compelling data visualizations and reports And more! Learn about some of these features in the Search language – intermediate session Beyond Basic Searching
- 29. August 15, 2011Questions? Dan Plaza, Senior Instructor