In the previous video.
We are going through complete UI of Splunk.
Now let's understand how Splunk search works before searching.
Keep in mind, never ever use all type unless there is a real need to do so.
Because if you use an old time search, it just kills us blank resources.
If we choose all time, it just search for the data that is available on the Splunk for from the time
of its implementation or probably even beyond that, if we have index the older data.
So it just kills the resources like CPU and the RAM on the search and puts a heavy load on your index
because it's searches for a longer duration just to make sure use all time only when there is a real
need.
I'll perform some of the basic search for Splunk on internal audit logs.
I'll keep it for the last 16 minutes and.
Index called underscore audit is where all the internal logs of Splunk are stored.
I'll just type index is called to underscore audit and it enter.
As soon as I hit enter, I got 4000 plus events for the last one hour.
This means there were these many events were generated during the last 60 minutes.
You can also refer to this from which time to which time it is referring.
60 Minutes window from present to the last 60 Minutes.
Now I have narrowed down my search to just search for indexes equal to audit.
In Splunk, the free form search.
I need to search for an error so I enter errors.
It will display me all the errors in the last 16 minutes.
As of now, there is nothing found.
The last 60 minutes.
Let me run for the last 24 hours.
In last 24 hours, there was one error.
It exactly matches my the free form search or the keyword search, which I perform.
You can also use wild card searches.
Let's say.
Yara star at reports.
Anything that matches with Earth Star.
As you can see, there is one Earth Star and one error.
These are basically the searches that I'm running.
It is auditing the searches that it keeps track of the searches.
So in the last 24 hours, we have three events that are matching starting from Earth.
That is a wildcard search.
Let me search for capital e r this error.
What it does is in the free form, search splunk is case insensitive capital error or small case error.
They both mean the same.
It gives me the same results which are matching error keyword but.
If you use quotes.
Or if you use a field name in capital, it always refers to the code names.
Here.
Even with the codes, the error is still finds me all the same results.
Let me search.
By selecting a field.
Al search action is equal to search in last 24 hours.
So we got four events that are matching action is equal to search in the last 24 hours.
What will happen if I search for.
Capital action.
Let me filter my search.
Now my search is I'm searching for a field called action with the upper case and value is search.
This will be probably one of your question when you're taking certification for Splunk power user or
Splunk user.
Make sure you understand the capital case that is mentioned for the field.
It says the results were not found, but we saw there was a field named action, but it is with a smaller
case.
So this shows that field names are case sensitive.
The field names should be typed as it is if it starts from capital.
It should be with capital.
If it all small, you should type all of it small.
As you see now, we are searching with small case action and we got eight, eight, eight events matching
our search query.
Let's see what happens if I change the value of the field to capital case.
This is a guaranteed questions.
When you are taking a Splunk power user or Splunk user certification, you'll get this question.
What they will give you an example like action is equal to search one in small and one in caps, and
they will say whether the boot returns the same result.
Is it true or false?
Of course it is false.
Just now we have seen that capital field names.
Are different than the smaller case freedoms, whereas the values represent the same.
Even they will give it with quotes.
We have even validated that scenario that if it quotes.
Also it will not look for kids sensitive values but whereas feels they are case sensitive.