You're reading from Data Analytics Using Splunk 9.x A practical guide to implementing Splunk's features for performing data analysis at scale

Product type Paperback

Published in Jan 2023

Publisher Packt

ISBN-13 9781803249414

Length 336 pages

Edition 1st Edition

Tools

Splunk

Concepts

Data Analysis

Author (1):

Dr. Nadine Shillingford

View More author details

Table of Contents (18) Chapters

Preface

1. Part 1: Getting Started with Splunk

2. Chapter 1: Introduction to Splunk and its Core Components FREE CHAPTER

3. Chapter 2: Setting Up the Splunk Environment

4. Chapter 3: Onboarding and Normalizing Data

5. Part 2: Visualizing Data with Splunk

6. Chapter 4: Introduction to SPL

7. Chapter 5: Reporting Commands, Lookups, and Macros

8. Chapter 6: Creating Tables and Charts Using SPL

9. Chapter 7: Creating Dynamic Dashboards

10. Part 3: Advanced Topics in Splunk

11. Chapter 8: Licensing, Indexing, and Buckets

12. Chapter 9: Clustering and Advanced Administration

13. Chapter 10: Data Models, Acceleration, and Other Ways to Improve Performance

14. Chapter 11: Multisite Splunk Deployments and Federated Search

15. Chapter 12: Container Management

16. Index

Why subscribe?

17. Other Books You May Enjoy

Extracting fields using props.conf and transforms.conf

So far, we have created field aliases, calculated fields, and field extractions using Splunk Web. These changes can also be made using configuration files. Let’s look at the changes in the configuration files that occurred when we created the http_referer and referer_domain fields in the previous section, Extracting fields using the GUI. Use a ssh client to connect to searchhead1 and browse to /opt/splunk/etc/apps/botsv1_data_set/local/props.conf. You should see the following configurations under the [iis] and [suricata] stanzas:

[iis]
FIELDALIAS-http_refer_rename = cs_Referer ASNEW http_referer
EXTRACT-referer_domain = http://(?<referer_domain>(\w+\.\w+|\d+\.\d+\.\d+\.\d+))\/
[suricata]
EVAL-bytes = bytes_in + bytes_out

Since the field alias (http_referer) and the field extraction (referer_domain) are associated with the IIS sourcetype, they are inserted under the [iis] stanza. The calculated field (bytes) was...