Udemy
    •  
    •  
    •  
    •  
    •  
    •  
    •  
    •  
Subscribe
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
Splunk Search and Reporting
Rating: 3.3 out of 5(9 ratings)
87 students

Splunk Search and Reporting

Splunk Search and Reporting and Basic Syntax
Created byPraveen Soni
Last updated 9/2021
English
English [Auto],

What you'll learn

  • Fields, Interesting fields, extracted fields
  • Search and Reporting basics
  • Search and reporting syntax
  • Search Modes
  • Report and Alert creation
  • Dashboard creation

Course content

1 section • 11 lectures • 4h 14m total length

  • Introduction2:53

    Discover how Splunk acts as a Google for your logs, enabling keyword-based searches, indexing, and auto-suggestions, with inline help and definitions to guide commands.

  • Search and Reporting Basics34:08

    Splunk search and reporting basics teach you to query logs using an index-based, google-like search bar, apply time ranges and fields, and monitor results with the job inspector.

  • Fields,Search Modes,Interesting and selected fields32:58

    Explore how Splunk treats data as events with key-value fields, case sensitive names, and case insensitive values, using selected and interesting fields, wildcards, and fast, smart, and verbose search modes.

  • Search Best Practices19:42

    Master best practices for splunk searches by specifying time windows, using one or more indices at the start, and prioritizing inclusion over exclusion to filter early.

  • Splunk Search Language,Syntax and its components.Commands table53:12

    Explore Splunk search language syntax, including commands, functions, arguments, and clauses, and master the pipeline that passes data through renaming, table output, and field-level performance by including or excluding fields.

  • Type Of Commands, Transforming Commands, top, rare and its functions13:55

    Learn to use transforming commands in Splunk, especially top and rare, to display most and least common field values; apply by clause, set limits, and control percent columns for visualization.

  • Transforming Commands, stats Command, its functions and table formatting21:32

    Explore transforming commands, especially the stats command, and demonstrate how to compute count, distinct, sum, average, max, and lists, group by source and time, with table formatting options.

  • Splunk Reports, Creating and Working With Splunk Reports26:33

    Create, share, and customize Splunk reports and dashboards, drill down to underlying events, and apply naming conventions, permissions, scheduling, and pivot-based visualizations.

  • Splunk Dashboard, Creating and Working With Dashboards16:27

    Create and customize Splunk dashboards by adding panels and reports, configuring saved searches and time pickers, and managing sharing permissions, exporting, and cloning for reuse.

  • Scheduling Splunk Reports, Sending Reports to Your Inbox11:50

    Learn to schedule Splunk reports and alerts, choose frequency and time windows, and automatically email results with optional report links and notifications.

  • Splunk Alerts, Creating and Scheduling Alerts, Working with Alerts21:04

    Splunk alerts run from a saved search and trigger when a condition is met, either on a schedule or in real time, with actions like email, webhook, or log events.

Requirements

  • Non

Description

This course is intended to explain the basics of search and reporting. This will help you start with search and reporting.Also help you do understand the basics about the fields. You can create complex search queries by following the best practise.

By default, Splunk Enterprise provides the Search and Reporting app. This interface provides the core functionality of Splunk Enterprise. The Splunk Home page provides a view to the app when you first log into Splunk Web.


It has default app as search and reporting by which you interact with the data, and create reports, alerts, Dashboard etc.

Log processing is one of the core competencies of Splunk. It stores all your logs and provides very fast search capabilities roughly in the same way Google does for the internet device log files.

The Search Processing Language (SPL) for Splunk is an extremely powerful tool for extracting meaning out of vast amounts of data and performing statistical operations on what is relevant in a specific context.

Splunk indexes any kind of machine data that can be represented as text and there is no need to define tables and fields before you can store data. Splunk does not have a fixed schema. In fact, it performs field extraction at search time. This aspect allows for great flexibility.

It does not reduce the granularity of older events, compressing many data points into one because of capacity limits. It can seamlessly index hundreds of terabytes per day and keep practically unlimited amounts of data.

Splunk dashboards allow you to monitor all of your systems at once, so when a problem occurs you can start looking for a solution even before the problem starts bothering the system, or even better, its dashboard allows to clearly look for signs of a possibly arising problem.

Who this course is for:

  • Splunk Search and Reporting

Report abuse