Splunk

Development
Day 4
- Vikram Yadav (VY)

Your attendance & progress of the course will be calculated based

on the completion of the assignments and quiz.
Agenda – Day 4
• Splunk UI demo
• Understanding UI components
• Search Fundamentals
• Time range Picker
• Identify the contents of search results
• Control a search job
• Lab
Splunk UI Home Page
UI Navigation
UI Components
Data Summary
Search Fundamentals
Anatomy of Search - Events
• Splunk parses data into individual event
• Each event has a:
• Timestamp
• Host
• Source
• Sourcetype
• Fields are also listed in field side bar
Splunk UI & Searching
Run Basic Searches
• index=_internal
• index=_internal sourcetype=splunkd
• index=_internal sourcetype=splunkd source=*usage*
• index=_internal sourcetype=splunkd AND source=*usage*
• index=_internal sourcetype=splunkd OR source=*usage*
• index=_internal sourcetype!=splunkd source=*usage*
• index=_internal sourcetype!=splunkd source!=*access*
• index=_internal sourcetype!=splunkd OR source!=*access*
Time Range Picker
Time Range Picker
Set the time range of a search –
Custom
• Relative
• Date Range
• Date & Time Range
• Advanced
Splunk UI & Searching
• Identify the contents of search results/ Work with events
• Refine Searches
• Use the Timeline
Use the Timeline - Controls
Control a search job

• Every Search is a Job

• Job bar displays a progress of search Job
• Pause
• Stop
Control a search job
 Save Search
Results (Export)
LAB
• Run Basic Searches, different permutation & combinations
• Use Splunk timeline to filter events
• Stop/Pause/resume searches
• Use Fields sidebar to move fields from Interesting fields to Selected
fields
• Use Splunk’s Time Range picker to fire real-time searches
Question & Answer.....