Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Splunk Essentials

You're reading from   Splunk Essentials Operational Intelligence at your fingertips

Arrow left icon
Product type Paperback
Published in Sep 2016
Publisher
ISBN-13 9781785889462
Length 236 pages
Edition 2nd Edition
Tools
Arrow right icon
Authors (3):
Arrow left icon
Somesh Soni Somesh Soni
Author Profile Icon Somesh Soni
Somesh Soni
Betsy Page Sigman Betsy Page Sigman
Author Profile Icon Betsy Page Sigman
Betsy Page Sigman
Erickson Delgado Erickson Delgado
Author Profile Icon Erickson Delgado
Erickson Delgado
Arrow right icon
View More author details
Toc

Table of Contents (10) Chapters Close

Preface 1. Splunk in Action FREE CHAPTER 2. Bringing in Data 3. Search Processing Language 4. Data Models and Pivot 5. Data Optimization, Reports, Alerts, and Accelerating Searches 6. Panes of Glass 7. Splunk SDK for JavaScript and D3.js 8. HTTP Event Collector 9. Best Practices and Advanced Queries

Advanced queries

There are various kinds of advanced query that you may want to consider as you plan out how you will create searches and dashboards for your data. Consider the ones that we present, for they will help you design queries that are more efficient and cost effective.

Subsearch

A subsearch is a search within a search. If your main search requires data as a result of another search, then you can use Splunk's subsearch capability to achieve it. Say you want to find statistics about the server that generates the most 500 errors. A 500 error is a general HTTP status code that means that something has gone wrong with the server, but it doesn't know specifically at this particular time what is wrong. Obviously, if you are responsible for running a website, you want to pay close attention to 500 errors and where they are coming from. You can achieve your goal of finding the culprit server with two searches.

The first search, shown next, will return the server address with the...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Banner background image