>> Hello, we're on Module 5 talking about Splunk searches.
Being able to run goods searches in Splunk is probably
the most important skillset you can develop in Splunk.
Not everyone needs to be able to onboard
new data types and modify config files,
but many people in different jobs
have to be able to run searches.
Searches can range from extremely
simple to very long and complex.
To get started with a search,
you can log in to the Splunk web interface
and go to the search and reporting app.
You can run searches using
the command line interface or the rest API,
but we'll stick to the app on
the web interface for this course.
Here's a great image from Splunk.com that
illustrates the different parts
of the search and reporting app.
The example searches we'll talk about in
this video would be entered into the search bar here.
You can easily change the time over here
next to the search button and then if you
want to save your search, you could go up here.
If you want to download the results of your search,
you can go down to these search action buttons
and click this one here.
You'll probably see the letters SPL a lot in forums.
It stands for Splunk Search Processing Language,
it means the language around running Splunk searches.
Splunk searches can just be
about retrieving events for you to look at and
review, but Splunk searches
>> can also be about transforming
>> searches that transform the retrieved data,
such as by performing calculations on them.
There are six general categories of search commands.
We won't go too much into these,
but we will use examples that could
fit under different categories.
Here are good things to remember when running searches.
The more specific, the better.
When you have a small environment like we have,
running searches across all
>> events isn't such a big deal.
>> In a production environment,
it can take a lot of time and
processing power to check across lots of events.
Good ways to limit searches are by time,
index and other fields.
Limiting the timeframe you are
searching across is one of
the best ways to run an efficient search.
Knowing which index you need to
check is a good way not to waste
time and resources searching unrelated events.
If you're working in an environment, you don't manage,
it's possible you won't be able to search across
all indexes because of how
>> your account roles are set up.
>> Other fields are also good to
narrow down your search
to find just what you're looking for.
Like we learned in the last module,
fields are searchable name and value pairings.
Specifying known fields and
their values can help bring up the searches you want.
There are some things to remember
when searching for fields.
Field names are case-sensitive,
but field values are not.
This means, if you're searching for a field name
called Username and it has a capital
>> U at the beginning,
>> you need to type it this way.
If you're looking for username equals Sarah,
it doesn't matter if the S is
capitalized in Sarah or not.
You can also use wildcards when searching.
If you know, for example,
that the username you're looking for starts with SA,
you can put a wildcard.
That's the asterisks or star-looking
thing at the bottom there after
the first two letters
and you'd be able to get results for things
like Samantha and Sandy in addition to Sarah.
If you have a space in the field values,
you should put quotation marks around it.
If you're looking for name equals Sarah Smith,
you need to format it as name
equals Sarah Smith with quotation marks.
When searching, you can use
Boolean operators like and, or and not.
For example, username equals Sarah and machine equals
host3 will bring up results
where events match both of these fields.
Username equals Sarah or machine equals
host3 will bring up events that match either field.
Username equals Sarah not machine equals
host3 will bring up events where
the username is Sarah when
the machine does not equal host3.
Using an exclamation mark in
front of the equal sign means does not equal,
but it's not the same as using the Boolean not.
When you specify that the field does not equal a value,
it requires that value to show up in search results.
When you're using the not before the field name,
you can get results that don't have that field.
You can also use parentheses
to group values for searches.
You can use pipes to transform
and filter your retrieved events.
On my keyboard, I can make a pipe by holding
the "Shift" key while pushing the "Backslash" key.
Some examples of transforming searches might be things
like index equals Windows,
stats count by host, sort by count.
This we're able to perform
>> statistics on the results and sort it so that the
>> largest number displays at the top.
In the second example, we have results in
a table that would show the list of hosts and
then the dedup command removes
duplicate hosts in the results.
There are so many other examples and we don't
have time to go into them all in this course.
You can do many things like,
look at standard deviations or compare
results into lists in a lookup table.
You can look for outliers in your results and
evaluate and display events in many different ways.
Getting used to using
the search language in Splunk takes practice.
Check the supplemental materials for
some lists of other useful example searches.
For our last topic in this video,
we'll briefly talk about search modes.
When you run a search, you can select the search mode.
If you want faster results,
you guessed it, you can run in fast mode.
If you want to be able to make sure that you're looking
at all event data relating to your search,
you can run the slower verbose mode search.
There's obviously more to this,
but that should be enough to get you started.
That was a lot in a short amount of time.
For our quiz, please fill in the blank.
If you're searching for a field value with
a space in the middle,
you should use
>> quotation marks.
>> In the example in this video,
if you're searching for a field name of name and
a field value of Sarah Smith
>> with a space in the middle,
>> you should put quotation marks around it.
Great job making it through all of that.
In our next video, we'll be using
our search knowledge to create alerts.