Splunk Fast SPL Searches

Name: Splunk Fast SPL Searches
Rating: 3.5 (16 reviews)

Optimize Your SPL for Insanely Fast Search Speeds

Created byAndrew Landen

Last updated 11/2022

English

What you'll learn

Accelerate Splunk searches by 10k+ times. Reduce the load on your Splunk infrastructure, reduce the wait time for search results.
Learn effective SPL usage, including effective use of reporting commands like stats and tstats to improve indexer reporting and job results loading speeds.
Learn less known SPL and search techniques.
Improve dashboard efficiency

Course content

3 sections • 13 lectures • 2h 28m total length

Introduction4:59
My personal introduction to the course which will enable you to bring 31 day searches down to 31 minutes or less.
Splunk install7:39

Splunk Fast Search Overview part125:03
The primary objectives for achieving fast searches involve an understanding of the way data is indexed and the way that SPL is processed and executed in the environment.
Splunk Fast Search Overview part 212:31
Part 2 on the Fast Search Overview
tstats, TERM and stats25:25
Walk through the most effect processes to achieve fast searches for extracting valuable insights from your data.
Segmentation, Reporting Commands and Datamodels15:31
Details on Segmentation, both major and minor. Review of Reporting commands and their mechanics. SPL tricks for command usage strategies to improve search speeds
Stats11:10
Details regarding effective use of stats command for fast and efficient SPL.
loadjob3:50
Overview of loadjob
loadjob and macros9:31
Command Types2:48
A look at the SPL command types and what they mean.

TERM details17:28
Details on using TERM effectively in your SPL
NOT TERM7:32
Details on using NOT TERM effectively in your SPL
Fast TERM filters on one index from intel in another index5:26
What if you want to search an index for intel from another index like threats, intel feeds, or other events? With the search_term macro, you can find events from one index connected to events in another index, including using time windows. You could look in an index for a time window of 5 minutes before and 1 minute after the appearance of traffic involving an ip address list from another index by modifying the macro provided here.
search_term(2) - stats count by $field$ | eval $field$ = "TERM($pre$".$field$.")" | stats values($field$) AS search | table search | eval search = mvjoin(search," OR ")
The final search shown in this video took 4.3s to search 64.5k events over All time on a desktop indexer. This search is much more effective when the number of events filtered is very large (sparse searches) so that the indexers pull few events for parsing.

Requirements

Basic computer skills to navigate to web pages and install simple programs like Putty
Linux command line (CLI) familiarity
Basic familiarity with Splunk (Splunk Using and Reporting)

Description

You will learn to leverage Splunk indexing mechanics, Splunk indexers in parallel, and optimal SPL to increase your search speed/efficiency by on average over 500k times faster; search times of months or days will be reduced down to minutes or seconds. A basic understanding of Splunk SPL commands and data analytics (averages and sums) is useful, but not essential, for success in this course because basic SPL will also be covered. Comfort with Linux and with Cloud services are both helpful in following the process for installing Splunk on the Cloud (highly recommended). Much like with Google Cloud and AWS, the first year with Azure is free.

The key to searching fast in Splunk is to begin with a good idea of what you are looking for and how you will render that data into a form that you will use to understand the answer. You'll need to move away from wanting to see "everything" because the human eye is not designed to look at millions and billions of complex events. You'll need to plan the kind of information and format that you want to see into a relatively small number of rows and columns or lines on a chart. Be careful to avoid wanting to look at raw data because that is the easiest way to waste a lot of your time, slow you down and miss something.

Who this course is for:

Splunk Analysts
Splunk Developers
Big Data Managers
Security Analysts using Splunk Enterprise Security

Splunk Fast SPL Searches

What you'll learn

Explore related topics

Course content

Introduction2 lectures • 13min

tstats and loadjob8 lectures • 1hr 46min

More TERM Details3 lectures • 30min

Requirements

Description

Who this course is for: