Splunk Overview

Extract Fields

Fields are the values that we awalys cares.

How to identify a field

A. extract by splunk ui

https://www.cnblogs.com/xiaozi/p/15960470.html

B. extract by regex in searching

[search vendors]

| rex "abc(?<field-name-A>.*)def"

| table field-name-A

the above command can extract field with the name: field-name-A from the search response

And then display in table format like:

https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/SearchReference/Table

 Common commands

eval

https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/SearchReference/Eval

Do pre-process for the whole raw

| eval _raw = replace(_raw, ":", "=")

Create new field

| eval new_field = fielda + fieldb

 Logic condition

operators:

 case:

|  eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

if:

... | eval error = if(status == 200, "OK", "Problem")

dedup

For one field which mapping to multipel row,

we may want to use dedup to unique the value.

| dedup fielda fieldb

coalesce

It will return the first no-empty value

| eval fielda = coalesce(field1, field2, field3)

rename

| rename fieldA as "test A"

join

... | join fieldA fieldB type="outer" [search vendors]

this command will outer join a search result when fieldA and fieldB between two source type are the same.

And I tried the command below, but never worked:

And we always recommand to use stats instead of join, for higher efficient.

stats

same as the "group by" in sql

follow conmands use it to do statistics, how many get in the data group by host

 Internal function

 

 https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/SearchReference/Stats