Use this practical guide to the Splunk operational data intelligence platform to search
visualize and analyze petabyte-scale unstructured machine data. Get to the heart of the
platform and use the Search Processing Language (SPL) tool to query the platform to find the
answers you need. With more than 140 commands SPL gives you the power to ask any question of
machine data. However many users (both newbies and experienced users) find the language
difficult to grasp and complex. This book takes you through the basics of SPL using plenty of
hands-on examples and emphasizes the most impactful SPL commands (such as eval stats and
timechart). You will understand the most efficient ways to query Splunk (such as learning the
drawbacks of subsearches and join and why it makes sense to use tstats). You will be
introduced to lesser-known commands that can be very useful such as using the command rex to
extract fieldsand erex to generate regular expressions automatically. In addition you will
learn how to create basic visualizations (such as charts and tables) and use prescriptive
guidance on search optimization. For those ready to take it to the next level the author
introduces advanced commands such as predict kmeans and cluster. What You Will Learn Use
real-world scenarios (such as analyzing a web access log) to search group correlate and
create reports using SPL commands Enhance your search results using lookups and create new
lookup tables using SPL commands Extract fields from your search results Compare data from
multiple time frames in one chart (such as comparing your current day application performance
to the average of the past 30 days) Analyze the performance of your search using Job Inspector
and identify execution costs of various components of your search Who This Book Is For
Application developers architects DevOps engineers application support engineers network
operations center analysts security operations center (SOC) analysts and cyber security
professionals who use Splunk to search and analyze their machine data
