Summary

We focused on writing Splunk queries in this chapter. Before looking at the queries, we explored the Splunk search interface in the Search and Reporting app. We looked at seven different parts of the search interface, including the search bar, interesting fields, and time picker. We wrote simple filters using key/value conditions, including specifying the index and sourcetype in the index=botsv1 sourcetype=iis query. We also learned how we can increase the complexity of our queries using the pipe symbol. We then used this knowledge to get more out of our searches by using the pipe symbol and introducing commands such as eval, fields, regex, and rex. The eval command can be used with a variety of Splunk functions, including round() and lower(), which work on numerical and string values, respectively. Commands such as rex can be used to extract values from Splunk events using regular expressions.

We will explore more advanced reporting commands in Chapter 5, Reporting Commands...