02_PS_Splunk 9 Performing Basic Splunk Searches

 Table of Contents

1 Performing Basic Splunk Searches Overview 2

2 Introduction to Search in Splunk 3

2.1 Overview 3

2.2 Searching Machine Data 3

2.3 Demo: Splunk Search Interface 3

2.4 Splunk Data Sets 4

2.5 Summary 4

3 Understanding the Basics of Splunk Search 4

3.1 Overview 4

3.2 Splunk Roles in Search 4

3.3 Demo: Creating Splunk Search Roles 4

3.4 Data Storage in Splunk 4

3.5 Demo: Bucket Management 5

3.6 Bucket Management in Splunk 7

3.7 Summary 8

4 Using Field Searches for Splunk 8

4.1 Overview 8

4.2 Search Bar and Timeline 8

4.3 Search Field Operators 9

4.4 Demo: Splunk Field Operators 10

4.5 Splunk Field Sidebar 10

4.6 Demo: Splunk Field Sidebar 10

4.7 Splunk Result Field 11

4.8 Demo: Splunk Results Field 11

4.9 Best Practices in Splunk Search 12

4.10 Summary 13

5 Building SPL Queries in Splunk 14

5.1 Overview 14

5.2 What Is SPL? 14

5.3 Demo: Search Processing Language Editor 14

5.4 Building SPL Queries 16

5.5 Demo: SPL Chaining Commands 16

5.6 SPL Filtering & Modifying Search Results 16

5.7 Demo: SPL Search & Rename 17

5.8 SPL Ordering Search Results 17

5.9 Demo: SPL Sort, Tail, & Head 19

5.10 Summary 19

6 Performing Transformative Searches in Splunk 20

6.1 Overview 20

6.2 What Are Transformative Commands? 20

6.3 Demo: SPL Top, Rare, & Contingency 21

6.4 Splunk Stats Commands 22

6.5 Demo: SPL Min, Max, Average, & Count 24

6.6 Splunk Chart Commands 24

6.7 Demo: SPL Chart & Timechart 25

6.8 Summary 25

7 Creating Splunk Lookup and More 25

7.1 Overview 25

7.2 What Is a Lookup? 26

8 Demo: Splunk Lookup 26

8.1 More Splunk Learning Resources 26

8.2 Summary 26

1. Performing Basic Splunk Searches Overview

• Don’t know where from he download the data to create index  dev_web – may be earlier lesson

2. Introduction to Search in Splunk

1. Overview

2. Searching Machine Data

3. Demo: Splunk Search Interface

• Default index = main

• Search Bar

• Events Tab

• Time Line

• Events

• Fields – Selected Fields / Interesting Fields

• 
  

4. Splunk Data Sets

• Semi structured

• Csv, Tab delimitted

• Access log 

• Local Logs (Windows, Linux, Mac)

• Machine Generated

• Often Overlooked 

• Network firelwal, event log, web log

• 
  

• Data source from Servers, Cloud, Workstations, Log (Regex)

• ButterCup – Splunk Generated Data

• Eventgen – splunkbase 

5. Summary

3. Understanding the Basics of Splunk Search

1. Overview

2. Splunk Roles in Search

3. Demo: Creating Splunk Search Roles

Indix = main – all information used here

Pint in click search facility is easy to use splunk 

4. Data Storage in Splunk

Buckets

5. Demo: Bucket Management

• Settings – Data – Indexes – 

6. Bucket Management in Splunk

Hot Bucket – 24 Hrs

Warm Bucket – 3 Months

Cold Bucket – 3 + Months

Frozen Bucket – 1Year

Higher Performance (Hot/Warm)  – Lower Performance (cold, Frozen)

Write the query to get the data from Hot Tier

7. Summary

4. Using Field Searches for Splunk

1. Overview

2. Search Bar and Timeline

• Fast, Smart (defualt), Verbose modes

3. Search Field Operators

Field Expression

Boolean

NOT, OR, 

Wildcards

4. Demo: Splunk Field Operators

Index=main

Index=”main”

index!="main"

5. Splunk Field Sidebar

• Selected Fields, Interesting Fields

• 

• 

6. Demo: Splunk Field Sidebar

We can move fields from Selected to interesting vice-versa

• Search – In the field sidebar choose one value – choos Top value with Time bar – the query updated with visual by using timechart

• Top limit = x

7. Splunk Result Field

8. Demo: Splunk Results Field

• If any field we need to available in Selected fields, 

• In Interesting Fields, click the filed – choose Yes OR

• From the Result Pane, Expand the event, select the field it will come into selected fields

• If we click the field value, we can add or excluse in the search query

• The result we can change to List, Raw, Table

• 
  

9. Best Practices in Splunk Search

10. Summary

5. Building SPL Queries in Splunk

1. Overview

2. What Is SPL?

• Nomencluature, syntex

SQL	SPL

More free text for SPL

3. Demo: Search Processing Language Editor

Administrator – Preferences – 

• Choose full – Choose Line Numbers Choose – Choose Search Bar Themes as Light Themje

• 
  

4. Building SPL Queries

Example: 

5. Demo: SPL Chaining Commands

Choose No Event Sampling if we deal with less data

6. SPL Filtering & Modifying Search Results

7. Demo: SPL Search & Rename

• Remoe clientip field

• Only show two fields

• 

8. SPL Ordering Search Results

9. Demo: SPL Sort, Tail, & Head

• Last 10

• 

• 

• 

• 

• 
  

10. Summary

6. Performing Transformative Searches in Splunk

1. Overview

2. What Are Transformative Commands?

| top

|rare

|highlight

| Contingency

3. Demo: SPL Top, Rare, & Contingency

index="main" | top limit=3 Eventcode – not working – case sensitive

index="main" | top limit=3 EventCode – working .

index="main" | top limit=3 Type > information, warning, error

| top

| top

|rare

| Contingency

|highlight

4. Splunk Stats Commands

5. Demo: SPL Min, Max, Average, & Count

index="main" | stats min(EventType)

index="main" | stats max(EventType)

index="main" | stats max(EventType) by EventCode

index="main" | stats avg(EventType)

index="main" | stats avg(EventType) by EventCode

index="main" | stats count by EventCode

6. Splunk Chart Commands

7. Demo: SPL Chart & Timechart

index="main" | chart count as EventType by EventCode

index="main" | chart count as EventCode  by EventType

index="main" | timechart count as messages  by EventType

_time field added and display every day

8. Summary

7. Creating Splunk Lookup and More

1. Overview

2. What Is a Lookup?

8. Demo: Splunk Lookup

1. More Splunk Learning Resources 

2. Summary