In our previous lecture, we have gone through the Splunk top menu and all the links in the in those
menu.
Now let's get inside an app and let's see how the app menu and other features look like.
I'll be using search and reporting app, which is the default app and it has five different menus in
which search is a are default menu so that as soon as we click the app, we are landed on the search
menu page.
There are other menus like data sets, reports, alerts and dashboards.
In this case, we'll be going through a complete walk through of search menu and brief about all other
menus.
Let's come to the search, meaning in the last the data set, which was previously known as the pivot.
It is used as a typical pivot function in Excel where you can build visualization just by clicking and
selection of pivot or data sets.
Here.
For example, I have one data set calling Splunk internal server log.
Since this is a new instance, we should be able to see if we have any event related to our internal
logs.
Okay.
We do have some of the events related to internal logs.
In the left side.
You can see there are a lot of visualization features.
If we click on them, it will automatically pop up.
Any kind of visualization will be going through brief and for this tutorial purposes very briefly about
this.
But in the future we'll be going through how to create a new pivot, how to visualize, how to customize,
how to add it to your dashboard, how to add or use it pivot commands and report this kind of features.
But for now, I think it has a simple Excel pivot where you can visualize data without writing any queries.
Moving on.
The next menu is to report alerts and dashboard tabs are self-explanatory, which are used to search,
create or manage a report or even accelerate a report or dashboard respectively.
Now.
Let's continue with our search menu, which is the most important and most informative menu in any app.
The search bar.
This is known as the search bar, the white rectangle just below the search term where you write your
queries based on custom condition to pick the needle from the haystack.
This is where you'll be writing all your queries to fetch the data, probably from millions or billions
of events that the organization is generating every day.
And right next to this search bar, there is a time selector which is by default, set to last 24 hours,
and it is completely customizable.
And these are some of the preset conditions which are commonly used during searching and next to the.
Time selector.
This is known as the time selector.
Next to the time selector there is a search icon so that once you choose the time you can click search
so that it starts searching or even enter key can start the search.
Let's search something pretty basic.
I'll search for.
Splunk audit logs for the last 60 minutes.
Welcome to writing a search query.
And what does that mean in the later part of our tutorials?
As soon as I hit enter the complete bottom screen just below the search bar has been completely changed.
Once we kicked off our search, hitting enter key and typing index is equal to underscore audit, which
is nothing but saying search to search its local audit trail or audit logs.
Just below this, there is some message display saying from this time to this time, which is nothing
but our last 60 minutes, there were 3000 events and there were no events sampling the event sampling
is basically used for predicting a trend and we can set a sample like how much samples to use.
And there is a job function which is used to edit these jobs whether to expire or who can view this
job, whether for yourself or everybody.
This link can be seeing or using this job.
There is a lifetime which you can specify by default.
I believe it's 10 minutes.
You can set it to seven days, whereas if you share this job by default, it will be kept for seven
days.
So that is one more option.
The inspect job whenever your query is throwing some errors or performance is very slow.
The search returns take very long time to respond.
This job inspector will help you to troubleshoot such kind of issues.
The delete your is just to make sure kind of erase this from the Splunk cache so that even if you read
on the search, it will start from the scratch.
It doesn't pop up as it is.
That is with this menu.