Advanced Searching & Reporting with Splunk (ASRWS) – Outline

Outline detalhado do curso

Module 1 – Using Search Efficiently

• Review search architecture
• Understand how the components of a bucket (.tsidx and journal.gz files) are used
• How bloom filters are used to improve search speed
• Describe the parts of a search string
• Understand the use of centralized vs. distributable commands
• Create better searches

Module 2 – More Search Tuning

• Understand how segmenters are used in Splunk
• Use lispy to reduce the number of events read from disk

Module 3 – Manipulating and Filtering Data

• Divide search results into different groups, based on values in a specified field, using the bin command
• Regroup fields of search results using untable and xyseries
• Create a template for performing additional processing on a set of related fields using for each

Module 4 – Working with Multivalue Fields

• Use multivalue eval functions to analyze and format data
• Use the makemv command to convert a single value into a multivalue field
• Use the mvexpand command to create separate events for each value in a multivalue field

Module 5 – Using Advanced Transactions

• Find events logged before or after a particular event occurs
• Compare complete vs. incomplete transactions
• Analyze transactions

Module 6 – Working with Time

• Use time modifiers
• Search for events using custom time ranges and time windows
• Display and use using relative dates
• Use custom time ranges in multiple subsearches

Module 7 – Combining Searches

• Use the append and appendcols commands (and know the differences)
• Use join and union (and when not to use them)

Module 8 – Using Subsearches

• Use subsearches to provide filtering and other information to a main search
• Know when NOT to use subsearches
• Troubleshoot subsearches

Module 9 – Some Extra Tips

• Describe the use of regular expressions
• Provide some guidance on using lookups
• Provide miscellaneous optimization tips