This chapter is perhaps the most important part of the entire book as it covers how to use Splunk's Search capability to get data out of Splunk indexes, reduce it to its essential components, and then transform and format the results into a dataset and visualizations that provide real value and useful insights. The important features of the user interface — Splunk Web—are leveraged in working examples of the more basic Search Processing Language (SPL) commands, which serve as the foundation for a gentle and logical progression to using the more advanced commands and visualization options.
Topics we will cover in this chapter include:
- Essential SplunkWeb interface features and controls
- How to format basic Search Processing Language (SPL) search strings
- How to create filters to reduce the amount of data returned from searches
- How to use...
