Now we have seen some of the basic searches.
Let us see some of the most common searches for visualization.
The most commonly used searches are are search commands or one stop, let me say top action.
By default, it displays ten if you want 20 or let me say I'll limit it to five.
So it displays only the top five action.
Limit is equal to five.
It displays just the top fi action.
This means.
In the last 24 hours.
These are the top action values that are present in the logs of the audit.
There were 949 searches, 325 acceleration, and these are some of the other functions of Splunk, which
are inward internally.
Now we are inter top.
It provided me statistics so each statistics by default invoke visualization function.
I had previously choose pie charts for my other demonstration, so it is showing me my pie chart.
Let me change it to other recommended forms.
It shows.
A column chart.
If I want a bar chart, I can just click and select bar chart.
Let's say I'm not able to see the values here.
Only if I move my cursor next to the selected bar.
It shows me what is the action and what is the count?
Let's say I want to see the count.
I can click on format.
Sure data values on it will display each values right next to the bar.
Similarly with.
Column chart.
And by chart.
In case if you want to display values using pie chart because the formatting option doesn't have that.
Four.
Pie chart to display the values you have other methods to display which we will be discussing, like
how to search and plant a tattoo.
Complete different module which covers almost 140 plus commands, which Splunk has.
I'll write a small query.
Probably it might look advanced, but trust me, over a period of time you'll feel it much easier.
What I'm doing is I'm trying to add this action here.
Along with search.
Add these values also for the display do action is equal to action plus for contacting the string from
search and 949 the search plus 949.
So after search, I need a blank space.
And I'm adding one more plus to add my count into it.
As you can see, it is search 1981.
If you want to still make it look good, you can add some text saying.
Count ese or count colon, which makes it presentable.
Search count is 989.
There are not many ways you can play around with Splunk.
We'll go through them one by one throughout the course so that once you finish this course, you should
be able to take Splunk, power user, Splunk User and Splunk Admin, probably Splunk object.
Also because we will be building our own Amazon enterprise level multi site clustering environment in
the cloud.
After this, probably you will have one complete experience of going through the real scenario of implementing
this plan.
Now let's come back to our search query.
See, I've done I've added a braces for better presentation and I can see search count is 1000.
If I go to visualization, I can see right next to my pie charts now.
This is some of the ways that you can play around with Splunk.
Probably when you get access to the demo environment in the cloud, which will be the package or the
free access for all you guys as the complete package of.
Discourse.
This is one comment.
Let's see what happens with stat command, which I'm counting by the same action field.
If you see the difference between stats and count.
Now we have 51 values where top display by default only ten top values whereas stat displays everything.
Well, you can sort them by account or you have a sort command for doing that.
You can sort by count which sorts at ascending or descending values these kind of information will be
going through the later part of the tutorial.
One more probably quick command would be rare because we have already seen top.
Let's see rare.
What it does is it gives us the least values in the last 24 hours for the action field.
These are some of the least values or the bottom ten of the action values.