Splunk Knowledge Objects

In this chapter, we cover the various ways you can powerfully enhance and enrich machine data with user-defined fields and datasets to help harness that information in a smarter and more focused way. Event types, tags, and aliases allow you to classify and normalize similar events; field extractions create fields from otherwise-unlabeled segments of an event. Lookups enhance your data with additional information, such as the meaning of HTTP status codes. Data models are pre-prepared representations of one or more datasets created to drive pivot tables and allow business users to create complex reports and visualizations without having to use the Search Processing Language (SPL). All of these enhancements create what are known as knowledge objects, and these capabilities help make Splunk a much more useful and valuable business analytics tool, so you&apos...