Splunk笔记
学习Splunk Fundamentals Part 2 (IOD) 和 Splunk Fundamentals Part 1课程的笔记。
Chart
Over
By
Tips:
- ….|chart count over host by product_name usenull=f useother=f
- Only first value after by modifier effect
Timechart
- Time is alwarys the X axis
- Only first value after by modifier effect
- Span=12hr
- Use the limit option to include only the 5 best-selling products.
- Splunk automatically calculates the top products by totaling each column and taking the top n results (n being the number you specify in your limit).
- …|timechart count by product_name limit=0
Iplocation
- …|iplocation src_ip
Maps
- Marker maps
- Choropleth maps
Geostats
- …|geostats latfield=xx longfield=xx count
- Latfield
Geom
- (geom geo_us_states featureIdField=VendorStateProvince)
- index=sales sourcetype=vendor_sales VendorID < 3000 |chart count by VendorStateProvince |geom
- geo_us_states featureIdField=VendorStateProvince
Trendline
- Wma2 weighted moving average
- Sma simple moving average
- Ema exponenial moving average 指数
Addtotals
- Col=true
- Label="xx"
- Labelfield="xx"
- Fieldname=xx
- Row=false
Eval
- Tostring format values will changing their characteristics
- destination field for the eval command
- already exists overwritten by the new field
- defined in the eval command
Fieldformat
- Not change chararistic
Search
- index=security sourcetype=linux_secure fail* |stats count by user|search count>3 |sort -count
- 不可以接函数,where场景更多
Where
- index=network sourcetype=cisco_wsa_squid |stats count by http_content_type |eval type=if(http_content_type LIKE "image%","graphic","other")
- No results are found because the search command cannot compare values from two different fields. (As you saw earlier, the where command can do this.)
- … | where a>2 AND b>4
Lookup
Transaction
- Endwith
- Startwith
- : The search command must be downstream from the transaction command.
- Duration
- Eventcount
- Maxspan
Name conventions
Group
Type
Platform
Category
Time
Description
Tips:
- OPS_WFA_Network_Security_na_IPwhoisAction
- It is suggested that you name your Knowledge Objects using 6_ segmented keys.
Field Extractor (FX)
Extract your own field
Access FX via Settings, Fields Sidebar, or Event Action menu
Extraction Methods
- Regex
- Delimiter
Field Aliaes
- A way to normalize data
- Support multiple aliases
- Applied after field extractions,before lookup
- Can apply to lookup
Calculated
- A caculated field must be based on an extracted or discovered field, Not from lookup table or search
Tags
Nicknames for related field/values
One or more tags for any field/values
Case Sensitiv
Search syntax
- Tag=tagenam
- Tag::filed=tagname
- Tag=p* (partial field value)
Even Types
- Categorizing events based on search
- Tagged to group similar types of event
- No time range
- Can be inclued in a search sting
Macro
- Store entire search strings
- Time range independent
- Pass arguments to the search
- Expanding search ctr+shift+e
Workflow
- Get workflow
- Post workflow
- Search workflow
Knowledge Object
Data Models
Data model is structured datasets
3 types dataset
- Events
- Searchs
- Transacitons
Acceleration
Events Dataset
- Constraints
- Fields
Dataset field
Auto-extractd
Field type
- String
- Number
- Boolean
- IPV4
Field flags
- Optional
- Required
- Hidden
- Hidden & required
Eval expression
Lookup
Regular expression
Geo ip
Pivot
- Used for creating reports and dashboards, which are based on dataset
CIM Add-on ( Common Information Model)
- Normalize data
- Easier correlation data
- Object permission
Datamodel command
- |datamodel Web Web search |fields web*
Splunk笔记的更多相关文章
- Splunk 简单笔记
Splunk Notes source="c:\logs\abc.log" | rex field=url "(?<=\/)(?<ApiId>\w+?) ...
- 一起学习 微服务(MicroServices)-笔记
笔记 微服务特性: 1. 小 专注与做一件事(适合团队就是最好的) 2. 松耦合 独立部署 3. 进程独立 4. 轻量级通信机制 实践: 1. 微服务周边的一系列基础建设 Load Balancing ...
- Splunk大数据分析经验分享
转自:http://www.freebuf.com/articles/database/123006.html Splunk大数据分析经验分享:从入门到夺门而逃 Porsche 2016-12-19 ...
- git-简单流程(学习笔记)
这是阅读廖雪峰的官方网站的笔记,用于自己以后回看 1.进入项目文件夹 初始化一个Git仓库,使用git init命令. 添加文件到Git仓库,分两步: 第一步,使用命令git add <file ...
- js学习笔记:webpack基础入门(一)
之前听说过webpack,今天想正式的接触一下,先跟着webpack的官方用户指南走: 在这里有: 如何安装webpack 如何使用webpack 如何使用loader 如何使用webpack的开发者 ...
- SQL Server技术内幕笔记合集
SQL Server技术内幕笔记合集 发这一篇文章主要是方便大家找到我的笔记入口,方便大家o(∩_∩)o Microsoft SQL Server 6.5 技术内幕 笔记http://www.cnbl ...
- PHP-自定义模板-学习笔记
1. 开始 这几天,看了李炎恢老师的<PHP第二季度视频>中的“章节7:创建TPL自定义模板”,做一个学习笔记,通过绘制架构图.UML类图和思维导图,来对加深理解. 2. 整体架构图 ...
- PHP-会员登录与注册例子解析-学习笔记
1.开始 最近开始学习李炎恢老师的<PHP第二季度视频>中的“章节5:使用OOP注册会员”,做一个学习笔记,通过绘制基本页面流程和UML类图,来对加深理解. 2.基本页面流程 3.通过UM ...
- NET Core-学习笔记(三)
这里将要和大家分享的是学习总结第三篇:首先感慨一下这周跟随netcore官网学习是遇到的一些问题: a.官网的英文版教程使用的部分nuget包和我当时安装的最新包版本不一致,所以没法按照教材上给出的列 ...
随机推荐
- ionic 入口禁止加载其他页面
.state('memberOrders', { prefetchTemplate: false, url: '/memberOrders', templateUrl: '/MemberOrders' ...
- AV Foundation 实现文字转语音
AV Foundation 主要框架 CoreAudio 音频处理框架 扩展学习:<Learning CoreAudio> CoreVideo 视频处理的管道模式,逐帧访问 CoreMed ...
- Google序列化库FlatBuffers 1.1发布,及与protobuf的比较
个人总结: FlatBuffer相对于Protobuffer来讲,优势如下: 1. 由于省去了编解码的过程,所以从速度上快于Protobuffer,个人测试结果100w次编解码,编码上FlatBuff ...
- JMeter-取样器
JMeter取样器: 1.右键点击新建的线程组,选择Add---->Sampler---->HTTP Request:(如图) 2.新建取样器之后的界面如图: 3.根据上图中的数字标识解释 ...
- CSP201503-1:图像旋转
引言:CSP(http://www.cspro.org/lead/application/ccf/login.jsp)是由中国计算机学会(CCF)发起的"计算机职业资格认证"考试, ...
- LeetCode - 66. Plus One(0ms)
Given a non-empty array of digits representing a non-negative integer, plus one to the integer. The ...
- 网络流——poj1273(入门)
题目链接:排水沟 题意:现有n个排水沟和m个点(其中1是源点,m是汇点),给定n个排水沟所连接的点,求从源点到汇点的最大流量. [EK解法] #include <algorithm> #i ...
- 微信小程序-腾讯地图显示偏差问题
原文地址: http://fanjiajia.cn/2018/08/30/%E5%BE%AE%E4%BF%A1%E5%B0%8F%E7%A8%8B%E5%BA%8F-%E8%85%BE%E8%AE%A ...
- Nginx 学习笔记之安装篇
在windows下安装Nginx其实非常简单,只需如下几个步骤: 1. 在Nginx官网下载相应版本的安装程序,上面有最新版.稳定版等各种版本,正式运营的项目建议下载最新的稳定版 2.将下载后的压缩包 ...
- poj 1034 The dog task (二分匹配)
The dog task Time Limit: 1000MS Memory Limit: 10000K Total Submissions: 2559 Accepted: 1038 Sp ...