05_PS_Splunk 9 Optimizing Fields, Tags, and Event Types

 Contents

1 *Splunk 9: Optimizing Fields, Tags, and Event Types - Course Overview

2 Understanding Splunk Knowledge

2.1 Let’s Talk About Splunk!

2.2 Understanding Splunk Knowledge

2.3 The Splunk Search Operations

2.4 Optimizing Knowledge Objects

2.5 Managing Knowledge Objects

2.6 Splunk Data Enrichment

3 *Customizing Splunk Fields

3.1 Managing Splunk Fields

3.2 Creating Fields in Splunk

3.3 Using Calculated Fields in Splunk

3.4 Creating Calculated Fields in Splunk

3.5 Introducing the Field Extraction Process

3.6 Working with the Field Extractor in Splunk

4 Using Tags and Event Types

4.1 Introducing Tags and Event Types

4.2 Using Tags in Splunk

4.3 Creating Tags in Splunk

4.4 Using Event Types in Splunk

4.5 Creating Event Types in Splunk – Demo

5 Enriching Splunk Knowledge

5.1 Exploring Splunk Lookups

5.2 Creating and Using Splunk Lookups

5.3 Detailing Splunk Scripted Lookups

5.4 Creating and Using Scripted Lookups (External Lookup)

5.5 Understanding Geospatial Lookups

5.6 Configuring Splunk for Geo Lookups

6 Utilizing Search Macros

6.1 Understanding Splunk Macros

6.2 Creating and Using Simple Macros

6.3 Configuring Macros with Variables and Arguments

6.4 Reviewing Splunk Knowledge Objects

6.5 Searching Efficiently Using Knowledge Objects

6.6 Wrapping up Splunk Knowledge Optimization

1. *Splunk 9: Optimizing Fields, Tags, and Event Types - Course Overview

2. Understanding Splunk Knowledge

1. Let’s Talk About Splunk!

2. Understanding Splunk Knowledge

During searches - Index time or search time knowledge created

And etc.,

3. The Splunk Search Operations

4. Optimizing Knowledge Objects

5. Managing Knowledge Objects

Settings – All configurations

6. Splunk Data Enrichment

3. *Customizing Splunk Fields

Watch one more time

1. Managing Splunk Fields

2. Creating Fields in Splunk

Naming conventions to be standardized

3. Using Calculated Fields in Splunk

How can we get all calculated fields?

4. Creating Calculated Fields in Splunk

5. Introducing the Field Extraction Process

Inline – using regex or delimitter

Settings > Fields > Fiedld Extractions 

Splunk_TA_Windows ???

 

6. Working with the Field Extractor in Splunk

Open Field Extractor >

4. Using Tags and Event Types

1. Introducing Tags and Event Types

2. Using Tags in Splunk

Settings > Tags > Add New

Or Add Tags from Search Results

 

• Event types if we collect more data every day

• 
  

3. Creating Tags in Splunk

Settings > Tag > List by Tag Name > New Tag

4. Using Event Types in Splunk

Automatically find event types for given index

???

5. Creating Event Types in Splunk – Demo

Settings > EventTypes

Combination of some items which we can see in Search string

Add New

First write search string and check in search then use it in EventTypes definition to narrow down

5. Enriching Splunk Knowledge

1. Exploring Splunk Lookups

2. Creating and Using Splunk Lookups

Settings > Lookups

1. Add Lookup file

2. Defin Lookup definition – familiar with Type

3. 
   

??? how to delete the uploaded file with index

???Search – if we add more condition the search will be faster

3. Detailing Splunk Scripted Lookups

4. Creating and Using Scripted Lookups (External Lookup)

Check external_lookup.py 

5. Understanding Geospatial Lookups

6. Configuring Splunk for Geo Lookups

| inputlookup geo_countries

| inputlookup geo_us_states

Settings > Lookups > GeoIP lookups file 

Get the file from https://www.maxmind.com/en/home - we can create account to use their database

Upload required of file in splunk 

6. Utilizing Search Macros

1. Understanding Splunk Macros

2. Creating and Using Simple Macros

Settings > Advanced search > Search Macro > 

Macro surrounded by “`”

To see macro definition in search itself > CTRL+SHIFT+E

CLI

3. Configuring Macros with Variables and Arguments

Settings > Advanced Search > Search Macros > Add New

4. Reviewing Splunk Knowledge Objects

5. Searching Efficiently Using Knowledge Objects

Not completed with understanding

• Creating a new macro

• 
  

6. Wrapping up Splunk Knowledge Optimization