Full Course | Splunk Search and Reporting | All You Need To Know | Zero To Expert.

Hi, friends.

This video is about search
and reporting basics.

So before begin, I
wanted to inform you

that this topic will
cover a maximum question

from the fundamental 1 exam.

So from this topic, around 25%
of questions comes in the exam.

So please, pay
attention on this.

So as I earlier mentioned that
everything in Splunk is app.

So Search and Reporting
is also one of the app.

So let's go to Search
and Reporting app.

So once you click on that, it
will go to this window here.

I have already
explained about it.

Just go to that video and have a
look of what all functionality.

This is called a search bar.

So search bar-- how to--

in a Google search bar,
if you type something,

it will give you some results.

So similarly, it's a Google for
your logs, whichever you have

ingested in your environment.

So if you want to search
anything, just start with error.

If anything is there in your--

anything is there-- any
error is there in your log,

so it will come in the picture.

So currently, there is
no things called error.

So let me search with some
other fatal or no fail.

There is nothing called fail.

So there is no
error in my system.

So let's start with some other--

the keyword info.

So I will click on it, and it
should show some info because I

haven't given any index.

So before that, it
should have some index.

Internal.

And I'll call it as info.

So it should come like--

first, you need to
mention any of the index

in the environment,
whatever index is there.

And then you go for the keyword.

Now, main thing you
need to understand here

is if you type it, there will
be some assistance will come

in picture, like all
keywords you can use it

and all things you
can match it through.

So you can continue whatever
in your mind to type.

Or if you know everything,
you can do by your own,

or it will suggest the--

Splunk assist you on that.

So once you type pipe, it
will give you all the commands

which is related to--

or you have earlier used, or it
will give you some assistance,

that these command you can use.

And if you hovering over it--

you are hovering over it, you
can see the definition of it

comes in.

If you want to learn more,
you can click on More

and go to your search or do--

go to the help, and you
can work over there.

So like this.

See, the things are--

if you want to--
say, if you say I

want to type a chart
or stats command,

I want to use
statistics command.

So it will assist what can
you do with the stats command.

You want to do count or you want
to do the count by host or count

by something.

So these all things will come
first or everything will come.

So it will assist you.

And how to access that--

how to enable this or disable.

By default, it is enabled, but
it is enabled in compact mode.

So you need to go to
admin preferences or user.

If your user, it will show user.

I am admin.

That's why it is
showing me admin.

So preferences, SQL editor.

And here, you can see currently
the assistant mode is compact.

If you want to do
full assistance,

you can do it full assistance.

Though I have already
covered this topic

in my previous videos,
just I will inform.

If you click this, it will
give you more information

about the command.

So you can see the
difference stats.

Now, the command will come
history command, or command

history, or something.

The assistance will come.

Now here, the example or the
details about that command

will come.

You can see it here.

You want to-- if you want
to click on More or Help,

it will give you currently
auto-selection is open.

Auto-open.

If you want to do auto-open,
you can select or unselect it.

Now, working with parenthesis
in assistance mode.

Like if you want
to put parentheses

the matching parenthesis
is there, it will say--

it will highlight the
matching parenthesis.

If there is no parenthesis, it
will not highlight anything.

So this is how the
assistance will work.

If in case you forget to
put the parenthesis-- so

for individual
opening parenthesis,

there will be a
closing parenthesis.

So this is how you can
identify whether you

used the correct number
of parenthesis or not.

Now, when you use
any search, it will

give you result immediately.

And the result will be in
reverse chronological order.

That means that the
latest event come first

and the oldest event
will come last.

If you want to search
the oldest event,

you want to run reverse command.

So you can see the oldest first.

Also, you can see the
term which we have used

is highlighted in
the result itself.

Here, you can see whatever
field you will put,

it will highlight over there.

Now, whenever you search for any
events or anything, there are--

number of field
comes automatically.

And those are the timestamp,
and timestamp of event, host,

source, source type, and index.

So these are the major
things come by default.

If you do not
specify, it will come.

So this thing needs to be
taken under consideration

that whenever you--

so let's see what all other
things are there in the result.

So you can see here, the events.

The events is shown here.

You can see events.

The second one is--

this is called a
time range picker.

This is called a
time range picker,

where you can select time
for which you want the data.

And this is called
a field sidebar,

where you can see the selected
fields and interesting fields.

Selected field means when you
click it and you said yes,

so it will come
in selected field.

And again, if you do not want to
include it here, you can click.

This is the time stamp and other
metadata attached to your event.

Paginator.

So here, we can see
a paginator, where

you can go to multiple pages.

One by one, you can go to Pages.

And also, a timeline format--

how you want it--

compact, full, hidden.

So this is a timeline pattern.

This is a small
representation of your data--

at what time your
data has come--

you can see, I have a data on--

these main number of data
is there on Saturday.

This is the date and everything.

This is called Hold Event.

And also, I have explained
you these are the metadata.

And this is generally
a selected field,

which you select over here.

So those will come over there.

So you can see, if I do that,
the selected field, it has added

a new selected field over here.

If I unselect it,
it will go off.

So you can see it.

So this is Event.

All the events come over here.

And this is a Search Mode--

in what mode you want
to run the search.

So about this Search
Mode, I'm going

to create a video in our next
part, that is fundamental 2.

So for now, you need to consider
how many modes are there.

If you want to modify
your search according

to your results, you can do that
as well over any specific value.

So it will get highlighted.

And now, if you
click over here, it

will say if you want to
add this value in search,

or exclude, or open a new
search-- if you will add,

it will get added and it will
search according to that.

If you want to exclude it--

remove-- it will get removed.

Also, a particular thing,
if you want to exclude it,

you can exclude as well.

It will say not for
that particular.

Also, if you want to open
that in a new search,

it will get opened
in the new search.

It will open a new search.

So similarly, you can use
this function as well.

Now, again, if you
can see in the event

there are 50 events per page.

If you want, you can
increase it to 10--

or you can decrease or
increase it to 50 per page.

Now, again, how you
want to see the data--

this is in the List format.

So here, you can see a raw
format, where the data will

be shown as raw table--

that it will show in table.

By default, it's in List format.

That is called a
layout of your event.

So now, if you go
to Time Range, there

are different-- if you want
to choose a particular time

range from where you want
to get the data-- this

is a present time range,
where it has a relative time.

This is the relative time.

This is the real time.

So real time, it
means it will search

for the data in real time.

It will look for--

say, if you selected
five minutes of data--

if you select it,
it continuously

will looking for the data
for last five minutes.

Means it's a real-time searches.

So continuously, it will
be looking for the data.

So similarly, there
are customized fields--

customized time picker is there.

So relative time picker, if
you want to select a relative

or real-time--

again, I'd shown the
real-time date and and range,

date and time
range, and advance.

So these are the time
picker, where you can search

the data for a particular time.

So these are called--

the below-- and these are
called advanced time picker.

These are called
Advanced Time Picker.

If you want-- if you go
to Advanced Time Picker--

as it is shown--

Advanced Time picker, there is a
abbreviation, like h for hours,

s for second, m for minute,
d for days, weeks, months,

and year-- y for year.

Mo and mon is for month.

Week, you need to use w.

So what it means--

so whenever you have put like--

it will search for a specific--

say, if you have
put 30 minute and--

30 minute, and you have at hour.

So if your event has come--
if you have ran the search

for, say, 10:35 m-- if
you run that command--

and you are looking for
past 30 minutes of time,

so the data will be
fetched for 10:00.

Not 10 past 5.

It will not search for 10 past
5 because you have rounded off

for hours.

So it will check for
a particular hour,

a specific value--
specific hour.

So it will search for
10:00 AM, instead of 10, 5.

So this is the
abbreviation we use.

Also, when we talk
about a time range--

so there are-- in search itself,
you can use earliest time--

if you say it, hour.

So this will search
for past hour--

past one hour.

It will search for the
data past one hour.

Now, if you want to put--

there are some other things
are there, like, say,

if you want to put in the
latest will be at the rate T.

So I think there
is no data for--

for past two days,
there is no data

because I have installed
the instance right now.

But it will search for last--

look back from two days ago
up to the beginning of today.

It will look back
for two days ago,

and the latest event will
be the beginning of the day.

So similarly, you can use a
time range-- specific time range

if you want to know.

I will put a certain date,
where I want to search the data.

So you need to
give a time, 12:30.

So it will search for
that particular time.

So similarly, you can
use the earliest time--

and from that time
until now-- that's

why it is showing the data.

So this is-- you can use a time
range in the search itself.

Now, when you see
the data over here,

you can see some bars over here.

And inside, you can see how the
time range is for-- how the time

range is for this bars.

Like for every one
minute-- currently,

it is showing every
one minute per column.

So this is showing a data
for every one minute.

Now, this bar chart, if
you select any of it--

now, if you hover it, it
will show you the event

for that particular time.

But there is no change in
the result of the event

or there is no
change in the search.

You can see there is no
change in the search--

or no change in this.

Once you click over here,
you can see the 313 events

at that particular time.

And now, you can see
the result also, 313.

So it will change the
result, but still it

won't change the search.

So this question
will come in exam.

So if you want to select,
deselect-- you can deselect,

and it will go back to
that particular event

and that main search.

Now, again, there are certain--

other options are there.

Zoom out.

If you want to zoom
out, you can zoom out.

For that particular
time, you can zoom out.

Zoom out again.

You can see the difference.

It will show now--

earlier, it was
showing for-- past--

the column for every one minute.

Now, it is showing
for every hour.

So in this particular hour,
these many events are there.

Now, if you--

I don't think so--

yeah.

It's zooming again and again.

This will zoom per day.

I'll click Zoom to select.

Now, it will go
back to per hour.

Again, I will select.

It will go to per minute.

Now, again, select, it
will go to per second.

So this is how it will work.

Also, there is-- you can
select a time format, how

you want to run the format,
like hidden, compact, line, log

scale.

If you want to select log scale,
it will show it like this.

Full or compact--
full and compact.

Currently, it is compact.

Or you want to hide,
you can hide it

if you do not want to see it.

So this is called
timeline and its settings.

There is one more thing
you need to keep in mind.

When you do zoom in, zoom out--

so at that time, the
search will rerun.

Zoom in, zoom out.

If you can see, the
search will rerun.

So if you want-- if you just
select it, the search won't run.

Just the events get filtered.

So this type of question
can come in the exam.

So pay more attention on that.

Here, if you can see,
there is a job inspector.

If you want to-- if anyone want
to troubleshoot their search

or trouble-- or identify the
performance of their search,

they can do it through
the job inspector.

So we have a job inspector.

So you can click over
here, and you can see

how your search is performing.

So this job inspector,
if you want to add--

currently, the
setting is to keep--

that particular job is for 10
minutes by default setting.

If you go and edit,
you can edit it.

If you want to keep
it private, public,

permission to app or something.

Everyone-- if you click on
everyone, everyone can see it.

If you want to
keep a time to see

if the job will stay in the
Splunk for 10 minute by default

and if you want to change
it, you can change it.

If you want to share this
particular inspection to anyone,

you can share it.

You can copy and share
it to anyone you want.

So that you can save a time
of running this search again

and again.

Just you can send
the result to them.

So this is how you can--

this will help you--
the job inspector

will help you in investigation.

Also, you can perform
some other operation--

pause, stop, share
this particular search,

You can print and download.

You can print to PDF.

If you want to print this
to PDF, you can do it.

And if you want to
download to CSV,

you can do CSV or
any other format--

raw format, XML, JSON.

You can do it.

You can export to it.

Like here, I can export to Test.

So it will get exported,
and it will get saved

in your local environment.

Also, keep in mind how
many types of format

you can download for
a particular app.

So this question
can come in exam.

So keep in mind.

Now, if you have
already ran the search

and if you want to go to
inspect the job-- so you

can go from-- from
Activity, you can go to job.

And you can search for a
specific job when you have.

So here, you can see the job.

This job you have run.

So if you want to delete or
do any operation on this job.

So generally, what happens
is this job is taking--

a job is taking long.

So it will get-- it go to some
other state apart from done

or from here itself, you can
go to some other activity

like if you want to
edit, you want to extend

or inspect or delete the job.

You can do that,
inspect or delete.

Delete when this jobs got
stuck or when jobs get stuck,

it won't allow other
jobs to complete.

So you need to delete
the job forcefully

to run the other searches.

So this is how it will help you.

There is one more thing,
the search history.

So you can see the search
history is over here.

Whatever searches you have run.

So go to Splunk search.

And from here, you
can go down and select

for the search history.

So by default you can
see 20 searches per page.

So you want to select
as per your need.

Also time picker, you want to
see two days or any other days

you can see it.

So let's recap this session.

So I've shown you how can you
search a particular search term.

So first of all, you need
to give the index name.

So any index name you
can provide and search

for a particular search
term in your index.

Now, it will this is
called a search assistance.

And like see if once
you search for it

will give you a certain
match assistance where

you can select--

either you can select or you
can write your own searches.

So here it will show
some other details.

How to navigate to that--
how to select that you

want to go to preferences.

Go to SPL editor.

And if you want to
select any compact none.

If you select none, it
won't show anything.

So this is about
search assistance.

Next one is if you want to
like about the parentheses,

there are like if you have
selected search assistant

it will assist you
about the parentheses

as well whether it match
the parentheses or no.

If you can see there is no
match it won't highlight.

Now it will highlight
the adjacent parentheses.

We have seen the
other things as well.

When you search,
it will give you

the immediate result and the
term which you have searched,

it will get
highlighted over here.

And the events will be in
chronological-- reverse

chronological order.

The latest event
will be on the top

and the oldest event
will be at the last.

So there are multiple
things by default. Things

comes with the event and we can
say Splunk extract those things.

First is timestamp host
source type and index.

So how the search
results get means

what all the other things are
there when you run the search.

Here is the events.

You can see the events.

So time picker and the
fields, the interesting field

or selected fields.

You can see it over here.

Time stamp is this time--
this is the time stamp.

Paginator.

This is called a paginator
where you can go to the page.

This is called the event.

This whole bunch
is called event pan

and this is a
particular events event.

So you can show here.

And then in the
bottom of the event,

you can see the selected fields.

You can add or delete the
selected fields over here.

Now, you can include or
exclude any from the search.

You can include exclude
any of the searches

like you can add exclude or
you can run a new search.

So this is how you can use it.

You want-- how you want
to display your event.

So you can edit that as well.

Raw event or table.

About the time picker, we have
discussed about the time picker.

Like this is a
present time picker.

And these are the advanced one.

We have checked about a
abbreviation of these--

Abbreviation of this.

We can use S for second, M for
minute, H for hour, D for day,

W for week, Mo for
month, and Y for years.

So this is a snap to
time until you specify.

So I like--

I have already explained it.

So you can go through you
can rewind that video.

So we have checked about how
can you use time range in--

time range in your
search itself.

So you need to use earliest
is equal to some value or R

or something.

So it will give
you a last R data.

And so on.

You can use and you can
use the latest one as well.

So latest, whatever, now.

By default, it is now, but
I am giving, for example,

I am giving it now.

So you can do
manipulation as your own.

Now, we have talked about
that format timeline.

This is called a timeline,
where for here, it

will show how the data
is displayed over here.

Currently, you can see
one minute per column.

Now, you get to hover over here.

It will show-- until
you have not selected,

it will show the events without
filtering or changing events.

So once you select it, it
just changed the event.

So it just filter the
event, not rerun the search.

So if you want, you can
deselect it from here.

When you Zoom in and
Zoom out at that time,

it will filter
the events as well

as it will rerun the search.

OK.

This is the main thing
you need to understand.

So you can do pause, stop,
or search with your events

and you can print.

Also, you can export the data.

OK.

There are multiple.

You can see there are multiple
modes are there of search

fast, smart, and
verbose modes are there.

And the job, Inspector
means from job settings

you can do whatever
you want to do.

You can make it private,
public, lifetime, how for,

how much time the job should
be there once it is completed.

So you can edit that as well.

Apart from that, here we
have covered all the things

with respect to this.

Apart from that, if you
have run the search in past

and you want to inspect the job
or do anything with the job,

so you can go here and do those
things, like here, you can see.

If you want to go to
history of your searches,

you can go in search
and reporting app,

then from there you can
go to search history.

Here you can see
all the histories.

So that's it about this topic.

So-- Hi, friends.

So today's topic is
fields and Splunk.

So we will see what
is fields and what

is the importance
of fields in Splunk.

So before that, I just want to
give you a brief about an event.

Whenever the Splunk
gets a data into index,

so the data comes in
the form of events.

So until you have not specified,
by default it's an event.

We can ingest the data in
the form of metrics as well.

So by default, it
comes as a event.

Each and every data
comes as an event.

So what are fields?

So, generally, a field is a
K value pair in the Splunk

where it has a key and a value.

Like, for example,
we have index.

And index is a key and its
value is internal_index.

Now, you hit Enter.

So against that,
it has some values,

or it can, in some
scenario, it is possible

that event does not have a
value for that particular field.

So this is a field.

So y field is very
important because whenever

you search with
the field, it will

give a certain value to you.

Otherwise, it will
search over all the data.

So this is the
significance of field.

Now, field can be anything.

As I mentioned that
index equal to internal.

So it has given a
event with respect

to index equal to internal.

Now, if I want to include
more than one fields,

so I can do like
space, or I will

give source is equal to this
version, this particular path.

So it will give you
the event with respect

to both of the events.

So if you have not mentioned
anything in between,

it means it is an end operation.

So it is end between them.

So if I install--

I run that command, it
will give a similar result.

So by default, it's end
if you have not specified.

So if you put R, the
difference will be the result

will be something different.

So by default it is end.

So if you have,
let's say if I want,

if you see the event
with not, so it will not

include the event for
this particular value,

and it will give the
value only for this event.

Now, we will talk
about field discovery.

So Splunk automatically
discovers few of the fields

based on source type and the K
value pair found in the data.

So as and when
the data comes in,

Splunk does its own analysis and
its own like mapping of data,

so it will provide its own field
by default field, you can say.

So of-- there are few fields
are there, meta fields

that I have already explained
in my previous video

that there are few meta fields.

One is host, source,
source type, and index.

So those are meta fields.

Also, these are the
meta fields, and also it

has a internal fields
such as underscore

raw or underscore type.

So we can see that with this.

It should have host equals.

OK.

We will do like table
host, source, source type,

and underscore raw.

So it should give value
for each and every--

so these 1, 2, 3 and--

1, 2, 3 and also index.

Index, it will come
by default this one.

So I will give index as well.

Index.

So host, source,
source type, index.

So these are the meta
fields and _time and _raw,

its internal fields.

So these fields come by
default with 10 event.

If nothing is there, this
field will be there by default.

So it is also possible
that many of the field

does not have the value
for that particular index.

So it can be possible, or
it has more than one values.

So how to identify a
specific field in the event.

So, sometimes, if you can see
here, the throughput equal to--

sorry.

The group is equal
to throughput.

So it defines a clearly K
value pair in the event itself.

Sometimes, it
depends-- sometimes

get embedded with
respect to source type.

So here you can see user admin.

So in source type, it is defined
that user is equal to admin.

So likewise, you can
forget the field value.

Now, about the
side field bar, you

can see here, this is the side
field bar where it has selected

fields and interesting fields.

Selected fields where,
automatically, there will

be a three fields get selected.

Host, source, and source
type, and the rest

will be interesting fields.

And if you click on all fields,
the all field will come in here.

So these are all fields.

And here, you can see
the interesting fields.

Now, there are few terms.

You can see the alphabet and
hash in front of all the fields.

Alphabet hash.

So A means it's alphanumerical,
and hash is its number.

So if you can see this value
will be alphanumerical values.

And if you click on the
field, which has hash,

so it will be a number.

So this difference can
become in the exam.

Also, if you can see, this has--

this field has 71 values.

This field has one value,
and similarly so on.

So this shows the
occurrence of--

the distinct occurrence of
this field value in this field.

So, again, as I mentioned, if
you click on all the field,

it will show you all the fields
in that index, whether it

has come or no, whether it has a
single value or multiple values.

See the field can have
multiple values as well.

Regarding the selected fields,
when you select a field,

the fields will come in
the bottom of the event.

So if you select
any of the field,

let's say I have selected
it, so now you can see here--

like in this event, the
component value is not there.

The component
field has no value.

So here, if you can see the
component matrix component LMS

stack manager.

So it will show over here.

If you unselect it, it will,
again, go off from here.

You will not be able to see it.

And when you select on
all fields, so by default

it comes 1%.

So 1% of all the events.

Now, you can show as much
coverage you want to,

50% of events, 20%
of all the fields,

or any fields you want to
search, you can search it over

here, avg.

Or once you click
over here, it will

go to selected field
like this you can see.

Now, when we talk about field
window, when you click it,

this is called a field
window where on the top

it has a field name.

The component, and how
many distinct value

is there, 71, 71
of distinct value,

and how many percentage
of events are there.

So it shows 87.911% of events.

If you want to select,
you can select it.

Now, report wise, it
will show some statistics

values, top value, top value
by time, rare value, and so on.

These are static results.

So if you click over here, I
will click and it will show--

no I need to click
it directly here.

So it will show top values.

If I go back, again,
top value by time.

So you can see
top value by time.

Now, if you want
to see rare values,

so if you can see the
rare values as well.

Below you can see
these many rare values

are there and its percentage.

You can see one option
event with field,

so when you click over here,
it will include this field

in the search, which
is equal to star.

So if you click on that,
it will show where it

has the value for this field.

So if you click
over here, it will

go ahead and put a component
field is equal to star.

So it will show all
the events related,

which has a component field.

OK.

So if I remove it, like
you can see it here,

10,189 events are there.

If I remove, definitely,
it will increase z.

You can increase.

So there are few
events are there, which

does not have component value.

Now, if you want to
include a particular value,

like if you want to see here,
top 10 value will be shown here.

Like if you want to see the
event with respect to metrics,

the component is
equal to metrics.

So directly, you can
click it over here

and it will load the event
with respect to metrics.

Component is equal to metrics.

So this is how you can
directly select it from here.

If you do not know the name
of that particular field,

value of that field, so you
can directly select it here.

You can see the fields here.

And if I want to select
like group or from group,

I want to select, I want to see
the events where the group is

equal to throughput.

So it will automatically
include this in the event.

And you can see it over here.

So this is how the selection
will work from the field window.

So how can you use
field value or field

efficiently in your search?

So when I directly
search, like this

without any field throughput, so
it will search an entire index.

It will search
in-- when I specify

a specific field is equal to
this, it will narrow down.

It will look only
into this field.

It will show me the event
related to this field only.

Now, before that, it
will show an entire--

it will see an entire field
and will show you throughput,

like wherever it
finds the throughput.

I can see the throughput
in name as well.

Maybe, throughput
over here as well.

But if I want to see
only in this field,

it will give me the exact value
or exact event where the group

name is equal to throughput.

Now, there are few
consideration about field.

That field name
is case sensitive.

Now, if I, instead
of group, I put this,

it will not give any result
that because it does not

find the group with
capital G in the event.

So this thing you
need to consider.

And second one is the group--

the field value is
case insensitive.

So if I give throughput, it
will give me some result.

If I put like this, it
will give me some result.

So just remember that field
name is case sensitive

and field value is
case insensitive.

You also can use wild
card with the field name.

So I can put group
is equal to star.

So it will give all the
value with respect to this.

So if I do dedup of
group and table group,

so it will give all the
values with respect to group.

So, as I mentioned, the star
over here, it will look good,

and then I have remove
the duplicate values.

And this is how it works.

So you can use wild
card at any point, but--

any point, but it is good
that you should not use

a wild card at the beginning.

You should always use at the
end like this throughput.

If it is not used, like say
I'm using somewhere here.

So if it has a multiple
value in between,

it will give you a wrong result,
or if you include it over here

at the beginning, also, it
will give you the wrong result.

So make sure that you
should use a wildcard

at the end of the string.

So initial values, you
need to make it fixed.

You can use a relational
operators as well.

Like I have taken example of
average kbps is greater than 3.

So it will give you
the result where

the average is greater than 3.

So you can make it less than.

So it will give
you result of that.

Also, you can use
a NOT operator,

where if you want to display,
you do not want throughput.

So it won't include
throughput in it.

So if you go over here,
earlier it was 31, now it's 30.

You can see you cannot
see throughput over here.

OK.

So let's see the
difference between NOT

with this and OP NOT.

OK.

So when you type group NOT
is equal to throughput.

So it will give you the result,
which does not have the group

value is equal to throughput.

Now, if you write NOT.

So what it will
give, it will return

where the group field exist
and the value in the field

does not equal to throughput.

OK.

This exists, but
the value of field

does not equal to throughput.

And all event where throughput
field does not exist.

Throughput itself not exist.

So we can see--

see, it is giving
similar result.

So you can see here the
throughput won't be there,

and you can see
few of the events,

if I can search it over here,
the throughput, the event

where the throughput
itself is not there.

When you select it, it
will come under here.

So you won't be able to see any
of the selected field over here.

So that this field itself
is not exist in the event.

This field itself is not exist.

For that event, come
either or the event come,

which does not have the
value as a throughput.

So let's compare the result
in both of the scenario.

It is giving 1,300--

13,425.

OK.

Now, if I put NOT,
it is giving 17,532.

So when you are using not
equal to, so the result of it

is a subset of when
you are using an OP.

So this one is the subset
of when you are using this.

So we are going to
check in what scenario,

in what condition, both
the scenario giving

the same results.

So is it possible or not?

Yes, it is possible
that when there

is some field, which
is mandatory, which

is coming always in the event.

So in that condition, it will
give you the similar result.

So like here, this event
always will come in the event.

So if you give this
host name is equal to--

is not equal to Splunk.

So it is giving no result,
but though results are there.

Now, if I give NOT
hear, it, again,

will not give a similar
result. So in this--

it will give no result. So
this is a similar result. OK.

So in this condition,
where the fields

we are expecting some value
for that particular field,

so in that condition, the
event will be similar.

So let's go to the
modes of search.

So there are three
types of mode.

One, is fast,
smart, and verbose.

Fast mode is always emphasize
on speed over the completeness.

So smart mode, this
is a by default mode.

This will balance between
fast and verbose mode.

And the verbose mode, it
always completes the search

and doesn't bother
about the performance.

So it always emphasize on
completeness over the speed.

That's all about it.

Let's recap what we
have learned today.

So let's recap.

What we have learned
is everything in Splunk

comes as an event until you have
not specified as a metrics OK.

So there are concept called
key value pair in Splunk.

So we call it as--

means that the name of that--

or you can say a key is
nothing but a field name,

and the value is it's a value.

So always, the fields comes
in the form of key value pair.

So it plays an
important role in Splunk

where you can search a
particular event with respect

to a particular
value of a field.

So if you have not mentioned
anything between two fields,

like this, so always it
will be end operation.

So, also, there are
few fields, which

are automatically discovered
that is called a metadata.

So meta fields you can say.

So those are host, source,
source type, and index.

And there are few
fields are there, which

is called internal fields.

And that is _time and _raw.

So those are by default
values discovered by Splunk.

So there are few
events are there where

the fields value is not there.

So it can be possible the
field doesn't have any values,

or it can have multiple values.

So how we can identify values.

So in certain scenarios, like
here, you can see it here.

It's a status, but it is--

we cannot identify for which
field it is assigned to.

So it is done on source
type, source type,

automatically discovered.

So let's say user has admin.

So also, it has a key value
pair defined itself in the log.

So I am searching for
that particular value

where you can have--

see here, you can see features
is equal to search script.

So this kind of values
can be there in the event.

So we talked about this
site field sidebar.

So field sidebar has selected
field and interesting field.

The selected field will
show under the event

when you can select or unselect
the field from the field window.

OK.

Also, you can select all
fields, where by default, it

coverage 1% or more.

You can select
anything you want,

or you can search any field
over here, whatever you want.

So these are interesting
in selected fields.

Also, we have talked about the
count, what signifies this.

So these are the unique
value against this field.

A means it has
alphanumerical values,

and hash means it has a number.

Also, we have talked about
selected field window, selected

field window.

So field window has a multiple
things, like field value name.

It's a value percentage.

It has some static
values as well.

Also, if you want to include it
in the event while searching,

you can directly kick
click, and it will say as--

if you click it,
component is equal to star

will come in the search.

Now, here it will
show top values.

If you want to include any
of the value in the search,

you just directly need
to click over here

and value will go
into the search.

So selected field,
we have already

talked about selected fields,
that selected field will

come under the event.

If I will select this field,
it will go under the event.

Like you can see component.

Here, there is no
value of component.

So when I have selected or no.

So here, you can say
component value is here.

So this is how it works.

So we already included means
how to search the value.

You just directly cannot
search it like this.

So it will search
in all the index.

Instead, you can search for
host is equal to, so it will--

the field is equal to
the value of that field,

so it will search in
that specific field.

OK.

Also, we need to consider
that whole field name is case

sensitive.

So if I give host, it
will not give any value.

And the field value
is case insensitive.

Field name is case sensitive and
field value is case insensitive.

OK.

Also, we can use a wildcard,
if I can use a wildcard in it.

So it's best practice to use
the wildcard at the end, not

the beginning OK.

You can use relational operator,
like equal to, not equal to it.

It will not apply with this.

It will apply always
with the number.

So better to use with number,
equal to, not equal to,

greater than, less than,
or not equal to Splunk.

So it will not show
any value actually.

So the difference between
not equal to this,

not equal to, or not.

So the difference
between this is

when you say not equal to, so it
will show the host value, which

does not have-- the event for
which the host value does not

match to Splunk.

When you click not,
when you say not,

it will give you the
field where the status

field exists, but with--

sorry, with the value,
which does not have Splunk.

And all the event where
the whole host field itself

is not there.

OK.

How about mode?

There are fast, smart, and
verbose mode are there.

So fast, it will always prefer
the speed over the completion.

The smart mode is combination
of fast and verbose mode.

Verbose mode always prefer the
completeness over the speed.

So this is all about this video.

And so this video is about
search best practices.

So how can we
improve our searches

to consider few points in mind.

So first point is the time.

So time is very efficient or
crucial filter in searches.

So it is recommended
that you should

specify lesser time for your
search when you are running.

You should not
specify a larger time.

It will take more
time to execute,

and it will take more resources.

I/O operation will be more,
so take a lesser time.

Like if you type
for all time and you

are searching for
some index, so it

will search for that
all time in your index.

So it is not recommended
for any of the search

to run for all time.

So in ad hoc search, you can
run, but in schedule search,

you should not run because
the searches can get skipped.

So in my this example,
I do not have much data

so it finished earlier.

It's finished very quickly.

So in actual
production environment,

you should not run
it for all time.

Generally, the admin will
disable this for all time

and they keep it
for lesser time.

That will not impact
the system performance.

Now, this is all about time.

So keep in mind that whenever
you are performing any searches

on the search head,
so keep a lesser time,

and, gradually, you
can increase it.

If you want to go beyond
your time, there is--

means beyond time,
as in you want

to search it for more than
30 days or more than 60 days.

So you can play around
with these options.

So you can create a bunch of
one month, every one month,

or every seven days,
and you can see

shift the window accordingly.

So also, there is
one more thing.

You should specify a one
or more index, like sorry.

It is internal.

So it is giving me the
value from both the index.

So you can mention one index,
or more than one index at

the beginning of
the search, and it--

you need to keep in
mind that the index--

the index field, always,
you need to give it

at the beginning of the search.

It is recommended that you
should give the index field

at the starting of the search.

So the next thing is include as
many search terms as possible.

Search term, as in, if you want
to search like for this term,

whole term info
LLM task manager.

So if you give simply this
one, let's see what happens.

Simply, this it will
include this and whatever

other parameters are there.

So it will give the
input for everything.

If you specify one more term, so
it will give this and also this.

This and this, both of them.

So it is like you are
creating your script

to the point, the search you
are creating to the point

that it searches only for
your data, not the other data.

So this one thing
you can keep in mind.

As many search term you can put.

Like you can put a specific
search term this as well.

So it will reduce--

it will reduce this
the amount, which

is fetching from the index.

OK.

So you can include that.

Also, the search term, you
need to make this specific

to your requirement that
what you want to do exactly.

So one thing you need
to consider in Splunk,

the inclusion is better
than the exclusion.

So inclusion, as in, if
you want to search for--

so, for example, if you want
to search not successful.

Not successful, you want to
search it, or successful login.

Not successful login,
currently there

won't be any incident
in any event in that.

But if you search
it, indirectly, this

is a failed login.

So when you search it, it
will search in entire index,

or it will search
for everything.

So if you search it, currently
there won't be anything.

Instead of that, remove
not and search for failed.

OK.

So this will help.

So failed login or failed
anything, you can consider.

So instead of exclusion,
use inclusion.

OK.

The next thing is filter
as early as possible.

So if you filter as
early as possible

and then apply some
statistics on that, then

bunch of the events, bunch
of event will be lesser.

Like say I will--

like say 6,494 events are there.

I will put some count stats.

Count.

OK.

So this statistics will
be applied on this.

So earlier you have seen,
our number was huge.

Now I will put get and
filter, and then you

can see the number has reduced.

So this is how you
can filter the events

and then apply the
statistics whatever you want.

Like, suppose you want some
condition through where,

and where ABC is
greater than some value.

So now here, you got a
subset of your entire event,

and then you have
applied the statistics.

So this will be a best practice,
that you filter it first.

If you apply-- suppose you
have already done statistics,

now you have
applied the entire--

applied the statistics on
entire events, and then

you have putting--

you are putting the conditions.

So this is inefficient,
you can say.

So obviously this will run,
but it will take much time

than the earlier condition that
you filter the event earlier as

possible.

OK?

The next thing is,
avoid using a wildcard

at the beginning or the
middle of the search term.

Like if you were to search for
"fail" so it can include "fail"

or something--

now if you include this, it
will search for entire index.

It will-- fetches the
data in the entire index

and then apply this filter.

OK?

In this condition, the
result will be huge

and it will impact the system.

Now, what happens when
you put it in between?

In between, that means that if--

suppose instead of "fail",
some spelling will be there,

like F-A-I-E-E-E-L, so that
event also will get fetched from

the index.

Or some other spellings
or something else,

it will get it over there.

So the best way is
apply the wildcard

at the end of the
search term, so this

will give a perfect
result for your search.

So here, what it does is it
fetches only the specific data

and apply the wildcard on that.

So the next thing
is, instead of using

wildcard for a specific field--

if you know the value of field,
then put or instead of wildcard.

Like, say here, if you put--

OK.

So this will give
some value, but I have

used this card underscore star.

But if you know the index name--

this is the index name and OR
If you have [INAUDIBLE] as well.

So this will be more efficient
than giving the underscore star.

OK?

This will give a valuable--

the correct information.

OK?

Then we can say the efficient
information to your search.

Working with the index, like
here in [INAUDIBLE] index,

what you can do is
provide an index name.

And then if you want
to search for fail,

you can search it for
fail or something else--

successful.

Successful-- if it is some
[INAUDIBLE] it will come.

Yes, successful
register or something.

So this is how you
can search on any--

You can search it
for source type.

So it's better you specify
as many field you know about.

If you know the source type,
also specify the source type,

and then you success.

Successful.

In similar fashion, you can
include as many a number

of fields that you want.

Now, again, as I have earlier
mentioned, with the index,

you can provide more than one
index with "or" like this,

and you can search for the
data and whatever field--

next field.

I am taking it from the field.

If you know the field
names and directly

you can put it over
there [INAUDIBLE].

OK?

So the first preference
will be inside the bracket,

and then it will execute this
one, so it will filter for this.

OK?

Also, you can use a
wildcard with the index.

But generally, it
is not recommended

to use a wildcard
with the index.

Does not recommend it to
use wildcard with the index.

Instead, at least a single
value should be there.

This is also valid--

failed.

OK.

This will give you value.

But instead of that, you
specify one or more indexes.

It is recommended.

You need at least--

there should be one index--

one or more index
should be there,

but it is better you mention
one index, not the star or not

the wildcard with
any of the field.

If you know the field name,
then specify the field name

or at least you use
initial of that field name

and then put a wildcard.

OK?

That will be the best
way to find the indexes.

This is the best way to make
your search more efficient.

OK?

Now, how can you find index?

How many index are there
in your environment?

So if you know
initial or anything

about index, so just [INAUDIBLE]
so that it will come.

So once you do this--

once you run this command,
there will be index field here.

So these many indexes are there,
which starts with underscore.

And any of them, if
you want to use--

audit, internal index--
any of the index

if you want to use in your
search, you can directly use it.

OK?

But at least you should
know initial or any word

about your index so you can
put it there, give a wildcard,

and use it.

OK?

Let's summarize what we
have learned until now.

So time is the most
efficient filter.

Specify one or more index
values at the beginning

of your search string.

So you need to specify
at the beginning of--

you need to specify
the index name

and include as many
search terms as possible.

So this is the next one.

Next is, make your search term
as specific as possible OK?

Inclusion is generally
better than exclusion.

The next one is, filter
as early as possible.

So as I explained, you
filter first and then apply

any of the statistics.

Avoid using wildcard at the
beginning or middle of a search.

So if you use it at the start
or beginning of any search term,

so it will process all the data.

First it will process
and give you the result.

If you provide in middle--

in between of a string, so
it can give a wrong value.

If you use at the start--

at the end of the search term,
so it will give you a better

result. When possible, use
"or" instead of wildcard.

OK?

So working with indexes,
you can work with any index,

like you just provide
index equal to index name

and then search term so
that will be very efficient.

You can use more than one
indexes through "or" and then

provide your next field.

In brackets, the
precedence will be

higher, so first execute
that, and then next,

it will execute the next search.

Then, how can you find
the index from the data?

You can use a wildcard.

You need to know at least
alphabet from your index.

So I'll put a star
underscore star,

and this is how you can get the
index name from the index field.

The index field is always
within the [INAUDIBLE] field.

If you want, you can want to
make it selected field as well.

It will go up in
the selected field.

So that's it about
the video, and thank--

So this video is about
Splunk's search language.

So we will start with
search language syntax,

so how the search language
language syntax works.

So this is full search I have
written in the search bar.

So this first part
will be your search--

any search the index you--
what you want to give,

where the data is
and the data source--

the category of that data.

Or any other string
if you want to put,

so you can give it as a
basic search based search.

And after that, you put a pipe.

So the output of
this search will

act as an input of the search,
which is after the pipe.

So this is called
a "pipe operator".

In any other language,
also in shell-scripting,

also we use pipe.

So in similar fashion,
pipe works here.

It acts as a filtering or--

the output of this search
will act as an input for this,

so simply, you
can consider that.

So after that, if
you see, this stats,

this is called as command.

So in Splunk, there
are multiple commands

are there, so this is
a statistics command.

This is not the
only one command.

There are multiple commands.

So this part is called a
command, and the next one is--

this is called a function.

So with stats, there
are many functions,

like min, max,
average, count, sum.

So I'm using here, "max".

OK?

And the next one is the
argument of that function.

So whatever argument,
one function

can have multiple arguments
or single arguments.

So here, it is a
single argument so I

have given-- this is
argument is nothing,

but it should be a
field from your event.

OK?

So this will be the
field from your event.

Generally, if you run
this command without this,

it will create a
field itself as "max."

You can see it here-- "max",
bracket, and then this field.

So you need to
rename this field.

You can rename this
field, call this max_avg.

So if I run this
command now, after this,

it will show you the rename.

It removed the "max," and it
is showing the new field over

there.

So it will be the new
name of that field.

So this part here, it
is called as a clause.

So it can be by something or as,
so this is called as a clause.

So the next one
is-- again, here,

you can see a pipeline
pipe over here,

so output of this
whole search will

act as the input for
the upcoming search.

So again, this is
called as function,

and this is the
variable-- new variable

we are creating through eval.

You can see it assignment,
the output of this

will assign it into
this variable OK?

Now, next one is--

this is Splunk pre-built
function, like max,

to convert a string-- to convert
a numerical value into a string.

So that, you can add one more
string or two because you cannot

not add a numerical
value with the string.

So you can see, if I run
this command, it will show.

this much bytes.

This is showing us
this much bytes.

In this function,
this is a function--

there are multiple
arguments are here.

Here, you saw that there
is single argument,

multiple argument
where to a string

there are multiple assignments
are there, commas, or duration,

and hexa.

So this is about it.

So you can go
through Splunk docs

and check what are commands
or functions are there.

So this is basics about
syntax of a Splunk search

so you can make your
complex searches

as well, whatever you want.

For the beginners,
it's a good point.

You can go one by one and
create your own searches.

Also, I have covered,
in previous video,

the basics about fields
search best practice.

So I am requesting you
guys, before starting

this complex query,
just go through that

and have a basic understanding
of Splunk terminologies.

What is a Splunk, about
the Splunk fields,

and best practice of searches.

So let's move to the
next topic in this video.

So there are a few basic
components of search syntax.

First one is a search term.

Second, commands, functions,
arguments, and clauses.

OK?

These are main syntax
components are there.

Search term actually,
what are you looking for?

It's exact keyword
phrases, or booleans,

or ATC, or number, or anything.

Whatever you know about your
data, just type it after.

It's best practice to give
index and source type or as many

as fields--

fields and value you give,
that will be helpful for your--

with respect to the performance.

So go and check about--

from the admin, if you have
ingested the data through admin

in your production environment
or you are doing POCs.

So first of all, check
your index and/or

whatever field you know about
it-- source type, source, host.

So that will help you to
reduce the performance.

Now, as I mentioned,
the search term

can be a keyword,
phrases, Boolean,

or many other things--
number or anything,

you can put it over
here before this.

The next one is commands.

So commands is, what do you
want to do with the results?

So once you have this search,
and let's say I have searched it

and you got some result.

So you got some result after
running this search, so here

are several things are there.

You can see fields and events.

So what exactly you want
to do with this data?

So Command will
help you understand

the trend or behavior, or
exactly the statistics of it.

So Command will help
you to create a chart,

compute the statistics, and
evaluate and format your data.

So see here, this
is [INAUDIBLE].

This is not much
understandable data.

So say I want to take a average,
any field, and get a max of it.

So this, I will
get the max of it.

So this is a bit meaningful
in terms of data.

Now, after that, the functions.

How do you want to chart,
compute, or evaluate the result?

Now, after this, you can use--

after stats, like max.

Whether you want to do max,
min, minimum, or some--

get a average,
transform the values.

Like, here we have
transformed the values.

Say I want some
string attached to it.

What is it exactly?

It is byte, megabyte,
or something else,

so I have written
this code to include

a byte after these values.

OK?

So these kind of
things, you need

to first make your
mind what exactly you

want to achieve from your data,
what exactly the output should

be so you can do that.

Now, next will be
the arguments--

the function of the argument.

This is one of the
component of search syntax.

So this is called
as an argument.

A function can have one
or multiple arguments,

so this can be a
calculate average value

for a specific field-- convert
a millisecond to a second.

So here, you can--

I can put over here
here as it's a byte,

in byte, you can apply a formula
to convert it into megabyte,

[INAUDIBLE], or anything else.

So this will help you to make
a meaningful information out

of your data.

So next component
will be clause.

The clause, how do you
want to configure or rename

the fields in the results?

So here, how you--

so if you want to give a name--

another name of your field
so you can use as over here

or rename--

also, you can-- that we'll
cover in our next video.

Or if you want to
group by, so you

can put it over
here-- by as well.

So this will come under clauses.

So this is all about the
components of Splunk search

syntax.

Now let's talk about
search pipeline.

So as we know, the data
is stored on the disk--

on the index-- particular index.

So this is a index where
the data is stored,

and data is stored
in the flat files.

So you need to keep in
mind the data is not

in any of the database, like,
say DBMS, like Oracle, or SQL.

So it can be one of
the interview question

that they can ask it what
database Splunk uses.

So Splunk uses flat
file to store the data.

OK?

Just keep in mind for
the interview purpose.

So let's back-- let's come
back to our main topic,

like search pipeline.

So this data-- this index
reside on the indexer,

and the actual data
is on the disk.

So now, when you
run this command--

so after running this
command, the data from here,

one intermediate interface
will come in between after--

this will get phased
into the search.

If you go to component
of it, whenever

the user run the search,
it fetches the data

from the indexer.

It pulls the data
from the indexer

where the data is stored.

So this is one of the
intermediate repository

where the data comes in
from the entire index.

We have chosen from
this index, get the data

for this particular source
type, and now create

a intermediate table for that.

Now this top command will
create an intermediate table.

First, we get the
intermediate events,

filtered the event from
the data and pulled it out

from on the search head.

Now, from there, we have created
an intermediate table where

it gives us the top 10 sources.

So it can be any field,
whichever you want--

so any field.

Here, only five fields
are there and five sources

are there in my index
because I have recently

installed this instance.

There won't be much
data over here.

So you can see it over
here, only five top 10

and through the top.

There are only 10--

by default, 10 records will be
fetched, so it will store this.

So this is called a
intermediate table.

Now, first table is this.

Another intermediate
table is this.

And again, if you want
to filter further and get

the exact result, so I
will give field percent.

So now this is the exact
field, exact table,

or exact data which you want
to come in front of user.

So from the biggest superset,
we have divided into subset,

and again, filtered down
to your interesting fields

or interesting data.

So this is--

I tried to explain about
the search pipeline.

So if you have written
any complex query,

so to make that complex
query more readable,

you can turn this
pipe into each line--

each next line just by typing.

Just you put Shift and Enter,
so this will give you--

This will go to next
string and next line,

and it looks more readable.

So there is auto--

automatic settings is there
so you have to go to user.

This is admin.

So in your case, it will be
any user name or something.

Go to Preference.

Go to SQL Editor.

From SQL Editor, there will
be a search auto-format.

So you need to click over here.

Click OK.

So whenever you write a pipe,
it will go to next line.

You can see it will
go to next line.

How many pipes you want to
use, it will go to next line.

If you want to add line, so
you can add line over here.

Go to this and select
it, it will add lines

as well-- line numbers, sorry.

It will add a line
number to your search.

Let's go to this
coloring options,

what exactly the coloring
means in this search.

So coloring option means blue.

It means these are the commands.

So blue comes in commands.

So also, keep in mind
this question can

come in fundamental I exams.

So also, if anybody
in the interview

want to test whether you have
word on [INAUDIBLE] or not,

they can ask about this.

So this will--

The command come in
blue, and the functions--

you can see the color of
functions is a purple.

OK?

This will come as a purple.

And if you have any
argument coming with the--

coming with your command--

like, say there is a-- one of
the command called "time chart."

It has a argument like "span
is equal to" [INAUDIBLE],

so this comes as a green.

And please do not get
confused with this argument

to the argument, which is
going into the function.

So this is command
arguments, and these

are the functions of argument.

So please bear in mind.

OK.

The next one is clause.

The color of clauses
will be orange.

You can see it here.

If I put "by" as well, it will
come "by", so it will come

as a orange.

OK.

So these are by default
colors comes in Splunk.

The rest of them,
it comes as a black.

So the argument, or function
argument, index name,

index value, key value pair, or
any search term, any keyword--

"fail", "failed", internal.

If you want to put this,
so this will also--

also, this if you
given under the double

quotes some value
equal to zero, so this

won't consider as
a field value pair

as it is there on
the double quotes.

So this will treat as string.

So please bear in mind.

Also, if you want to turn
off your coloring option,

so you can go to your
user preferences,

go to Splunk editor.

And here, if you
go to-- in General,

you can have a search assistant
where it will show you--

after each command,
it will show you

how that particular command
work or how can you use it.

I'll show you
after this example.

So in Themes, you
can go and change

the-- currently,
it's light theme,

so by default setting is this.

If you want to do
black and white,

so it will give everything
has a black and white.

So no coloring
option will be there.

So this is, by
default, a light theme.

So keep in mind,
this is by default.

And if you want to put a dark
one, you can put the dark.

But the color-- by default
colors will be same as it is.

OK?

So if I click OK, it will
convert into the dark theme.

Now, I was talking about
the search assistant.

So this is called
assistant where

Splunk provide you some
assistance on the Field

Name, field when you
are typing over here.

So you can use any of
the-- it will assist you,

how can you use it.

And by default, the
compact mode is enabled.

You can keep it None or Full.

Full, it will show
more detail over here.

See, you can see it
more details with--

OK with the examples?

So let's talk about
the table command.

So table command, as we
know from the name, it is--

as the name suggests, it
will provide you the events

in the form of table.

So Table Command
return a table format

by only field in
the argument list.

Field in the argument list.

So columns are displayed in
the order given in the command.

So whatever, as
I mentioned here,

the first column will be source.

Second is source
type, host, and time.

So let's say if I
run it over here,

it will give you, first, source,
source type, host, and time.

OK?

So column has header.

Header is nothing
but the field--

this field.

The header has its own--

this is header, and
these are the fields.

And each row-- each row
represent a event in the table.

So event in the
index, you can say.

OK?

This represents event.

Each row contains field
value for that event.

So field value for that event.

So for this event,
the source value

will be this for this
particular source type is this.

For this whole event,
the host is this,

and the time of
this event is this.

You can put as many as--

fields over here.

OK?

Whatever fields are there in
your mind to create a table

or create your output
in tabular format

so you can do it with that.

So the next one
is rename command.

So through rename
command, you can change

a name of any of the field.

Like, if you do not have any
meaningful name in your field,

so you can change the
name of that field.

So in this, we can see the name.

So this is what
exactly the name is.

So I'm not convinced this
name-- that what exactly

the name, so I can give
the name to this field,

like an application
name or event name.

So I can write simple,
"rename name as AppName"

and "table AppName _time".

Maybe it takes some
time to display.

So when I run it again, it is
giving the name of the fields,

like you can see here.

So instead of that--

instead of this, I
can use this command.

If, let's say, these
are the application--

if you do not have space
in between in the name,

so you can write
without double quotes.

Like, if you want to put
application name like this,

so you cannot write like this.

You need to put it
in the double quotes.

And same thing, you need to use
it over here while displaying.

So you can see it over here.

OK?

So keep in mind that
if you are using--

you are renaming a
field with the name

where the name consists
of space, so put it

in double quotes.

OK?

So one more important thing--

whenever you change any field
with the rename command,

so you're changing the
name of that field itself.

So the original
field will not be

accessible after
renaming this field--

after using the rename command.

So if I use the
original name, it

won't show any
value because there

is no such field called name.

Let's have a look in the event,
whether we see that name.

No, there is no
field called as name.

No.

We have our rename command
and some other name.

OK?

So please keep in mind that
once you rename this command,

this question may ask
in an interview as well.

So if you change any
particular field--

so the field name
itself will get changed,

you cannot access with
its original name.

OK?

So the next command is field.

So whenever you ingest a data,
on the basis of key value pair,

Splunk automatically
assign a value

to the fields, or field
names, on the basis of header

if it has a CSV file, or
it make on its own logic

to make a key and its value.

If you have created a field
extraction kind of thing so

that is advanced kind of part.

And the field extraction
will take a lot of time,

or performance of indexer
and searches, had both.

So if it's index
time extraction,

so it will consume
indexer resources.

If it's search time, it
consume search time--

search had resources.

So there is a command called
"field" where, through "field",

you can--

after, you can subset your data.

Like, you want to perform a
action on that particular field

only.

So you can include or exclude
the fields from your event

once it comes to a search head.

So it's not we are deleting
anything from the index

or removing anything
or any value or such.

Just we are subsetting our data
to our interesting fields--

interesting data.

And also, it will improve your
search performance that from--

we are not performing any
action on whole index.

Instead, we are filtering out
on the basis of these fields

and performing the action on
that selected field-- filtered

field.

So we can have one of the
example in front of you.

Like, say if you run
this command, so--

and one more I will
run without field.

So this I am running
without field.

Let's see how much time both
of the search will take.

So this I'm taking
without field option.

So without field option,
it took 0.791 seconds--

0.791 seconds.

Now, with field, let's see
how much time it takes.

It took 0.381 second.

So you can see the significant
difference in the performance.

So the event-- number
of events are same,

processed event are same.

Just we have filtered
through field command,

that we are telling Splunk
that I want to apply--

after this, I want to
use only this field

to perform tabular operation.

OK?

So there are
multiple things in--

not multiple, we can say
two things in a field,

like true plus operator.

By default, it's inclusion-only.

You can include or can
use plus so it will

apply to all of the fields.

Or if you want to remove it,
you want to use negative sign.

So in one of the example,
we have used a field minus,

I can use it directly
here-- "top".

"top source" and F-I-E-L-D
is "fields - percent".

So here, it will show
you percent command.

If I don't want percent,
so I can use this command

to remove percent field.

So see this field
will get removed.

So this will reduce the
overhead of your search.

Also, this is improved.

Your performance search query
performance, it will increase.

So two topics are
remaining for this video.

One is-- I'm using one of--

I'm explaining one more
command called dedupe,

and next one is sort.

So dedupe, as name
suggested, that dedupe

means removing the duplicate
field from the data.

If you want a unique
field in your data,

so you can use a dedupe command.

So for that, how can you
use a dedupe command?

So you just write "dedupe"
as you want to pronounce.

So I use "dedupe".

So I want to get
a unique source--

unique sources and type
"source" and get the source--

"sourcetype host".

So it will provide you
a unique source type.

Sorry, on the basis
of uniqueness--

will be on the basis of source.

So this will be unique.

This can be duplicate.

OK?

You can see these
are the duplicate.

Now, if you want to dedupe
on the basis of more

than one field, so you
can do that as well.

"sourcetype".

So you can consider
this as a key value pair

and that these should be unique.

OK?

You can see, if I
remove it, probably you

can see the difference
after removing it.

It may include multiple things.

Let's see.

Metrics, it has
multiple entries.

Now, if I want duplicate on
the basis of these two fields,

so you can do that as well.

And this will be on
alphanumerical order.

So the next command will be--
the next and last command will

be "sort command" that you can
order your data in particular--

display your data
in particular order.

It can be a descending
or ascending order.

By default, it's ascending.

And if you want to
make it descending,

so you need to use sort
hyphen minus to sort.

You can see, I want to sort.

If you write only
"sort" in field name,

[INAUDIBLE] the basis
of time [INAUDIBLE].

So on the basis of time,
it will sort it out.

And before that, I should
[INAUDIBLE] dedupe--

dedupe or dedup.

And so S-O-U-R-C-E, sorce.

Also, I will include
because [INAUDIBLE]

because we are
sorting, so you can

understand how it is working.

OK?

This will be in the
descending order.

And if you want to make
it in ascending order,

so just what you want to--

what you need to do is
just put a plus over here

so this will change.

No, it is not changing.

OK.

So I can just go time.

OK.

By default, it is changing.

So by default, it is
plus or without that.

Like this or this.

Both are similar.

If you want to put it
in descending order,

so you need to
use minus command.

So descending order, the
biggest is first and then--

OK?

Similarly, you can
use source as well.

If you want to use
source, so this

will be on the basis of
alphanumerical order.

So if you want to put more
than one in a byte space,

you can put more than one.

So space and comma so it
will consider more than one.

One more thing-- if you
are putting plus or minus,

so you need to put space in
between if you want to apply

the sort or order for
both of the string--

both of the fields
if you want to apply.

If you put "only" this, so it
will consider only for the first

value-- first field.

It won't consider
the second one.

OK?

So it will sort on the basis
of source, not the time.

If you put a space, it will
sort on the basis of time

as well as--

source as well as time.

So please keep in mind that
if you put a space in between,

the both will be included.

If you don't put,
only first field

will be included in
this sorting criteria.

OK?

Also, you can limit
the number of events

you want to display over here.

So with sort, I'm using
five or limit five.

Limit.

Limit equal to 3.

OK?

See?

No?

Yeah, it is showing
"only limit equal to 3."

You can use it
like this as well.

Zero.

So you can use it--

the limit function over here.

So there is a
real-life scenario--

real-life problem came in
our system is, how can you--

means by default-- in some
of the version by default,

you can display 10,000
record over here--

10,000 or 1,000
record over here.

So to overcome that problem,
just put with sort, just put 0.

So it will include
all the records which

you are fetching from the data.

But though it is not a good
practice to fetch all the data,

so you need to filter
as much as possible

the data to make sure that
your search is performing well.

Your resources are
utilizing well.

Otherwise, it will
hamper your performance,

also your search reporting time.

The search will
not get ended if it

is fetching all the
data from your indexes,

so just keep in mind.

So that's all about the video.

Let's recap what we have
learned from this video.

First, we have used a
search language syntax

where we have used a
basic search, then pipe.

We have used command, then
functions-- functions argument

and clauses.

We have used clauses as well.

And then the pipe--

what is the use of pipe.

The pipe will act
[INAUDIBLE] hence the output.

It will forward the
output of a previous surge

to input-- as an input to the
next surge, or next function,

or whatever surge you are using.

To that, it will pass on.

Also, there are some argument
of fields as well-- commands

as well, so stats, max.

So these are the
average, "avg_max".

So this is nothing--

argument is nothing
but a value here.

And the field, which is
there in your events,

so there are one or more
fields can be there in the--

from the function.

So next will be search
term components.

There are a few major
components are there.

First is search term.

What are you looking for?

Either keyword, phrases,
or Boolean data.

The second one is commands.

What do you want to do
with the result, which

is coming from search terms?

Then whether you want
to create a chart,

compute statistics,
eval, or format.

Now, the third one is--
third component is functions.

How do you want to chart,
compute, or evaluate the result

coming from the previous data?

Yeah.

So if you want to get
a sum, get an average,

transform the values,
[INAUDIBLE], or evaluate

or whatever you want
to do with the data.

And the fourth one is argument.

Are there variables you want
to apply to this functions?

So if you want to calculate
anything, rename the fields,

or change the format of that
field so that you can do,

the calculating average
value for a specific field,

convert megabyte to gigabyte
or byte to terabyte,

so these kind of
calculation you can do the.

And the fifth one is clauses.

You can-- how do
you want to group

or rename the fields in results?

So give a field name or a
group value by [INAUDIBLE].

OK?

So these are the components.

So we have talked about
the search pipeline where

the data is reside on the
indexes and searches head

fetches the data to
keep it internal table--

to be keep in to
the internal table--

sorry, not internal,
intermediate table.

Now, again, we filter
the data and that result

will keep it intermediate table.

And then finally, we will show
the data or in what format

you want so that will give you
a crisp insight from your data

through the search pipeline.

So in the pipeline, if you want
to make your search readable,

so you can use Shift Enter to
go to next line and use a pipe.

Or you can go to Splunk
Editor, SPL Editor,

and change the settings
whatever you want from here.

So next, we have talked
about the coloring

of commands or functions,
so functions are always

in blue color.

No, sorry.

The commands always
in blue color.

Functions are in purple.

So if you have any clauses,
it will come in orange.

Then apart from that,
everything will be in black.

OK?

Just keep in mind.

And also, there was
one more thing--

if you are putting a command--

using a command function,
so it will come in green.

[INAUDIBLE] command
or argument, so there

is a difference between command
argument and function argument.

OK?

So please make sure you got
the difference between them.

OK?

So you can play around
with the coloring options

as well from SPL Editor.

So if you had to go to--

you have to go to Themes
and choose by default,

it will come light theme.

Now you can remove a
theme or put a dark theme,

so I am applying dark theme.

Dark dark theme will
not come by default.

By default is light theme.

OK?

So I have talked
about creating table.

You can use a table.

You can create table
from your events

and play around with the table.

So you can represent a
data in the tabular format.

The column are display in the
order given in the comments.

You can see the order of it.

So this header fields header
is always a field name,

and this is the event.

One event represent the
value of your field.

So here you can see
the value of a field.

Next, we talked
about renaming field.

You can rename field to
whatever meaningful information

you want--

meaningful name.

So if you do not have space
in your renamed string--

rename the string-- so you
need not to use double quote.

If you have a space in between,
please use double quote.

So once you rename the command--

once you rename the field,
the field will not be there.

The original field will
not be there in the event,

so you need to use--

in going forward, you need
to use your renamed field.

So also, we have talked about
fields where [INAUDIBLE] field

parsing is very costly for
the index and for the search

as well.

So field command allow
you to include or exclude

specific fields in your
search to include use--

If you want to include--

use "plus", or if you
do not use "plus,"

it will be a by default plus.

Occur before the field side--

before the field extraction
and improve the performance.

OK?

To exclude, you need
to use a minus command.

After the field extraction.

no performance benefit, include
field used in the search

to make the table
display easier to read.

So there will--

If you do minus, there won't
be a performance benefit.

So next, we have given a
live example that how--

if you are using a
field command, how

it is improving the performance,
that search time will decrease.

We have talked about a
dedupe command, where

if you want to remove the
duplicate value from the data,

you can use it.

You can use a dedupe command
on more than one fields

if you want to do to dedupe
on more than one field.

If you want to
the sort the data,

you need to "sort command".

Use "sort command" order
your result in descending

or ascending order.

To use that, you need
to use sort, S-O-R-T,

plus for ascending,
minus for descending.

So one more thing
you keep in mind,

whenever you are using
field command without space,

it will consider the first--

It will sort only
for a first field.

If you are using a minus
or plus with the space,

it will consider--

it will qualify all the fields
which are mentioned in the sort.

It will qualify all the fields.

It will sort on the
basis of all the fields.

So I think that's
it about this video.

Hi, friends.

This video is about
transforming commands in Splunk,

or rather we can set types
of commands in Splunk.

So I am going to cover one of
the transforming command that

is called stats.

So in short, I can say
the transforming command

means the command
which can convert

your output into the tables.

So in short, this
is the definition

of transforming command.

So I am going to cover the stats
transforming command in it.

So let's begin.

So what exactly
the stats command?

So stat enables you to
calculate statistics

on data that matches
your criteria.

So what it does
is whenever you--

if you want to do some
statistics on your data after

any certain data volume,
which you know about it--

so let's say, if you
have your data index--

index is equal to audit or some
internal index, source type--

source type, any source
type can be there.

First of all, let's check what
are the source types are there.

So let's say I will take one
of the source type, Splunk D.

So this is the source type.

Now, after this, if
you know on which field

you want to apply
the statistics,

so you can apply on that.

So this will be your
search criteria.

Upon that, you can start
with the statistics command.

Now, the common functions
in statistics command

is first is count, so this
is one of the function.

[INAUDIBLE] count.

So what it does is it returns
the number of events that

matches the search criteria.

So in this, it will
return the count value.

The second one is distinct
count, or rather, we say DC.

So that returns a count of
unique value on the given--

for a given field.

OK?

So how to use it, I will
tell you in a few minutes.

The next function is sum,
return a sum of numerical value,

or then again, average-- avg.

Return an average
of numerical value.

Similarly, max-- M-A-X, max--

so it will return a max value
from all values for the fields.

Also a min--

M-I-N, min.

And also, it has list.

So it will list out
a list function.

So it will list out all the
values of a given field, OK.

Values is also one
of the functions,

so list out the unique
values on a given field.

So difference between
list and value

is, the list will give you all
the values for a given field.

However, the value lists the
unique value of a given field.

So let's go one by one
to these functions.

So first, let's say I am
going to run a stats count.

I want to know how
many events are there

for this particular
search criteria.

The search criteria
can be anything,

so I am going to
run count stats.

So let's see what
value it gives.

So let's say the number
of events are 2,503,

and the same count will be here.

Also, you can rename this
command as this field,

as Number Of Events.

So you can see it over here.

I have renamed the count field.

Otherwise, by default, it will
give you a count field name.

So one more thing is that
this is the function.

So the function accepts
the arguments as well.

So now, if you want to--

this count comes
for all the values.

Now, if you want to count
for a specific field,

a specific field, so you
can apply that as well.

So I will say source.

How many sources are there?

So these many sources
are there in [INAUDIBLE].

Let's see if source field
itself is there or not.

So you can see how
many number of events

are there where the
source is present.

So these many number
of events are there.

It is showing all, because for
all the source, it's there.

Like say, I will
put one of the field

where group is one of
the field, I suppose.

So see for these many number
of events, the group of fields

is there.

So it will give you
the total count of it.

Now, if you want to compare
with the actual field,

you can give it count.

Total count as--

Total count.

So it will give you
the number of events

which has group, group
field, and the total count.

If you want to do some
calculation over it

without group, or how many
number of events are there,

so you can do it with event.

Event remaining one.

So you have to do
total minus count,

so it will give
you remaining one.

This is the additional
one you can leave for now.

So next one, you can
group by these events

as well if you want to group by
event, like say, number of count

by source.

By source.

So it will give you for number
of count for each source.

So for this source, this
many number of events

are there for this source,
this many number of them.

So some of it will be
equal to your exact events.

So you can do Group By.

You can put as many
as number of group.

There is no limitations
of grouping the events.

So sourcetype host.

You can put this.

So you see for this combination,
the events are these many,

this combination of
events are these many.

There is no difference.

That's why it's not
showing any difference over

here because there is
only single source type

and then one host name is there.

So it is showing similar
value over there OK.

You can use comma in between or
without comma as well for this.

So it will give
you similar value.

While using a stat command,
please use a time range

very carefully, because as I
mentioned in earlier videos,

time is a very crucial
parameter for any searches.

So let's say you give the time,
that it will produce the faster

result. OK, so next
function is distinct count.

You can use it in two ways.

One is distinct_count.

Another one is dc.

The short form of
it is dc, dc count.

So I want the unique
count for source.

So source So it should give
only the unique count of it.

That shows 5 sources are there.

So it will give you
a count of that.

The result should be 5.

It's taking longer.

You can see it over here.

It is giving a distinct
count of source,

so only 4 sources are there.

So it is gaining count
of that field value.

Similarly, you can
use as over here.

So you can put this
[INAUDIBLE] count of source.

So it is giving the field name
as distinct count of source.

Next one is sum.

So you can use sum function
with numerical value.

So from here, you can check
which is alphanumerical

and numerical value.

# The field which has "#" before
it, it's numerical value,

and the field which
has "a" before it,

it's an alphanumeric value.

So these functions, you can
apply on the numerical values.

So average, putting
it as average.

So if you do this,
it will sum up

for all the events, OK,
average for all the events.

So it is good practice that you
should apply a source type over

here.

I mean, not source
type, field, any field.

So by, group by, sum of average
kbps, average_kbps, by source.

I'm putting it by source.

So by source, it will sum
up and give you the values.

So for other source
type, there is no value.

So it is blank.

_time if you want to put _time,
So it will provide you time

timely.

OK.

So for this time,
there is no value.

If you want to sort
it out from here,

it will give you
the values as well.

See?

For this time, this
will sum is there.

OK.

If you want, you can sort
it through command as well,

sort hyphen and count.

And count.

Or count field is not there,
so it won't apply over there.

So on time, you can say, _time.

So it will sort it by time.

You can see.

OK, you can put
sort it over here.

Similarly, you can put average.

Instead of this, you can
put average, AVG, average.

Any statistics
command, you statistics

function, you can
put it over here.

So it will give you the
average of this field.

Now, similarly,
average, you can use min

to get the minimum
value for that field.

Similarly, you can do the max,
so get the maximum value of it.

Maximum value for
that time period,

as you have given sort command.

No, group by, group by source.

For this source,
this particular time,

the maximum value
is this much, OK.

So next one is list command.

So here, you can provide
a list, list of source.

I will do source.

So let's see.

Let's see what comes
without by command.

So for all the event,
it should list them.

See, it is listing out
all the source type.

Now, I will put by source type.

So for each source type,
see, for this source type,

this many number of
sources are there.

It is listing over here.

So only single
source type is there.

So it is giving for single.

Let's see if any other
values are there.

So I will put component.

Component is one
of the value in--

components by source.

See, for this source, these
many components are there.

So these are not
the unique value.

All the value will come here.

So if you want to do Save As, so
list, or any list of components.

So list of components, we'll do.

So list of components
instead of this.

So this will give you
non-unique value, OK.

If you want to get
the unique value.

So instead of this,
you need to put values.

So this will give you unique
value against each source.

So by field, you can
apply by field over here.

So it will give you more
granular level of inputs.

or you can have level
of data it will provide.

So similarly, you can
use it in your use cases

how you can use values
and list command,

and other statistics functions.

So you can use it as
per your use case.

So this is very simple.

Not much complex
things are there.

So as you know, stats command
will give you a table format.

Let me see if I will run
the sum of this field

by source and time.

So now you can edit
this table or format

this table in multiple--

like this is like, say,
this is the sum of average.

So if I want to give
coloring options like,

say orange, see,
if from 0 to 30.

30, if data is there,
the color will be blue.

Like you can see it over here.

The color of it is blue.

Now, you can change it by
your own, like minimum 2 of 5.

It will be this, then 5 to 7.

It will this much, 7 to 10.

It will be this, and
10 to 100, for example.

I'm keeping it 10,
and maximum is red.

So similarly, you
can put it over here.

You can make it short, and
you can see the coloring,

the change in color.

You can see it over here.

OK, similarly, you can
make other like value,

if any specific value
for a specific value, you

want to put it, or auto.

Define a rule if cell value
is any specific number,

or cell value is this.

Let's say I skip it here.

Make it here now.

Value, define a rule.

If cell value is this,
the color will be this.

Add another one if cell
value is something else.

If cell value is this,
I'll put some other color.

Add another color.

So this is giving another color.

So this is how you can play
around with the color coding.

And the next one is
number formatting.

You can do number formatting.

Currently, it's disabled.

I am making it enabled.

Not here, because
this is not number.

So make sure that the
number formatting you

are putting for numerical value.

So precision, use 1,000
separator, 1,000 separator,

like it will provide you the
comma and everything, unit.

Like I will put in bytes.

So if your position of
it, if you want to put it

before or after, bytes.

So bytes, it has come by byte.

After the numerical value,
if you put it before,

it will come before
bytes in this.

So similarly, you can put
anything, whichever you want.

If this is like any
group or like we

are calculating in price or
something you can put dollar.

So here, it will
comment as dollar.

And now if you
want to put pound,

it will comment as a pound.

So similarly, you can
put anything over here.

So that's it for the video.

So hope you liked it.

Welcome to my channel.

Hope you are all doing good.

So the next topic will be
creating reports in dashboards.

So in this video, I will be
covering creating reports

and working with reports.

So what exactly a report is?

So let's go to the
definition of reports.

So reports are the saved search.

So whenever you are
creating any saved search,

so it is nothing but a report.

So a report can show events.

It can show events, raw events,
or statistics, or table,

or any visualization chart, bar,
pie chart, or any other kind

of visualization.

You can do it through report.

Running a report
returns a fresh result

each time when you
run the report.

So this is one of the
feature of report,

that it will not
run the past data.

every time, it will
run the fresh data.

It won't get the cached
data or something,

until or unless you have
used a specific date and time

range over there.

But it always gives
you the fresh data.

So Statics and
Visualization allow

you to drill down by default
to see underlying events,

so whenever you
create any report.

So if you are clicking
on any of the parameters,

it will drill down to
that particular event.

OK, we'll see it in
our practical session.

So the next one is, a report
can be shared and added

to dashboard.

That means you can
share the report.

You can keep it private.

If it's confidential,
you can keep it private.

Or you can share those reports
among the app or multiple apps.

And also, you can
create a report

or share the report to
the dashboard as well.

So when we are moving
forward, I will show you

how we can create a report
and add it to the dashboard.

So that, I'll be covering
in our dashboard video.

So there are a
few things we need

to take care about when
you are creating reports.

So one is naming convention.

So naming convention, it's
good to have a smart naming

convention.

Before you begin using
Splunk on the job,

define a naming
convention so you

can allow always find your
reports and tell them apart.

So generally, when
you create a report,

there are thousands of reports
in your environment, maybe.

So to uniquely
identify, it should

have some naming
convention to follow

so that it's very
easy to understand

what all reports are created.

And through naming
convention, you

can get which what object it
is, for which group it is,

or what is the
description of it.

OK, so the ideal
naming convention

will be, what can you
do is, first, here you

want to create a
report just saying,

how can you give the name of it.

This is not the search language.

This one is in brackets.

So first should be
your group name.

Second should be your object.

And third will be
the description.

So in this naming
convention, you

should always save your report.

So saving a report,
I will show you

how can you save the reports.

So for example, the
example will be--

suppose you need to get the
weekly data for a sales report

or for a login failure.

So how can you do that?

Loginfailed_.

What exactly do you want to do?

You need to create a report,
alert, or dashboard, or macro.

So here, like we can
say report and daily.

Daily failure.

Or you can say
DailyLoginFailure here.

Or if any domain is
there, like say, network,

it is with respect
to network domain.

Or finance.

Finance, like this, you
can create a reporting.

Or IT department.

So IT_Report_DailyLoginFailure.

So this is how the naming
convention should be.

So first, whenever you
are searching for reports,

the report will be there
always in this tab.

So whenever you are
searching for the report,

if you search
directly on this tab--

let me show you--

in this tab, there are
these many reports.

If you have created
any report, so you

can search it like report.

And currently, there
is no report created,

so it is not showing.

But you can see a report.

If you have created
alert, you can search it

with alert, or dashboard.

It won't show here.

It will show it in
here, under Report, OK.

So this is about naming
convention of report.

Now, I will explain to you
how can you create a report.

So before that, you
should know for which

you want to create a report.

Like, you should have the data
login or any employee record

or something.

Before that, the data
should be there in Splunk.

So you need to request
to your admin or whoever

if you are working with POC.

So just ingest
the data yourself.

I have created on video how
can you ingest the data.

So go and have a look on that.

If you are doing any
POC or you are learning.

So let's see.

I have ingested some data in
employee index and employee

source type.

So better you filter out a
field as much as possible,

so it will impact
your performance.

Now, what I am doing is
I'm creating a table,

or let's say first
time, what I'll do

is I'll create a raw data.

This will be the
raw data from here.

This is a simple raw event.

Now, from here,
first is your search.

Second, you need
to go to Save As,

and you need to click on Report.

So I will save it as
IT_Report_EmpDetails.

So this will be my report name.

The description is optional.

So I will sure make it
as demo and content,

how you want to see the report.

So currently, it's
in event format.

So it will show event.

Time Picker, Time
Picker will show you

whether you want to use the Time
Picker during your reporting

or searching.

When you deploy the
report, the Time Picker

will come by
default, and you can

choose your timing
for how many days

you want report, how many
hours you want report.

If you don't select it,
it will choose the value

as you have mentioned
in the search,

like all time I have searched.

But please do not use all time.

It will impact your performance.

So once you have selected
everything, just click on Save.

So it will save your report.

So when you save it, it
will give you few details

like additional settings.

If you want to do Permissions,
when you are creating it,

the report will be private, so
it will be visible to you only.

And if you want to make
it visible to others,

you need to make it
read only, or even

to give write
permission to some roles

so you can provide
a write permission.

Second, one is Schedule, so
you can schedule a report

if you want to
schedule a report,

or you want to send an email.

In email, you want to send this
event, so you can say Schedule.

You can accelerate.

Accelerate is nothing, but it
will create a summarized data

on the disk and
embed if you want

to embed your report somewhere.

So you can do that code.

You can get it
and you can embed.

The next option will be the
Continuous Editing or Add To.

Add to dashboard,
directly from here,

you can add it to
add to dashboard.

So currently, what I'm doing is
I will go and view the report.

So once you click
on that, it will

show you the data, the
report output of it.

So also, if you want to search,
you can search it over here.

Report.

As I mentioned, report,
it will show as report.

So it wasn't showing earlier.

It was not showing.

Now it is showing over here.

So this is how you can search
for the report directly.

If you want, you can click it.

Click over here.

So it will show the same page.

So from here, you can perform
a number of operations.

As I mentioned, if
you give Time Picker,

the Time Picker will
be coming over here.

If you don't give
the Time Picker,

it will come without this value.

OK.

So you can use a time range,
time range, last 15 minutes,

or all time, or.

So this is how you
can create a report.

Now, let's see
what all operations

can be done on a report.

So this is an existing report
which I have already created,

already as in we have created.

And now, I want to do any
editing or some operation

on report.

So what can be
done on the report?

So I can open in Search.

So directly, when I
click on over here,

it will open the
report in Search.

So if you want to,
say, give some values

and you want to save it,
you can save it over here.

Or if you want to
rename this event,

if you added some more
values or more visualization

over here, so you can save it or
create your own different copy

of the report.

So similarly, you can click
over here, give all the details,

and do anything with it.

OK, so the next thing will be--

I will go to that report only.

OK, this report the next
one will be description.

You can edit description.

So just bear in mind, you cannot
edit the name of a report.

If you want to do it, you
need to delete it and then

create with another name, OK.

Also, you can edit
the permission.

You can edit the permission.

Currently, it's private.

Whenever you see the report,
it will show you private.

I will show you how
it will look like.

So report.

So you can see
Sharing, it's Private.

Only you can see it.

OK, now you can make it public.

You can share it between the
users, or to only this app, OK.

You just need to
create the permissions.

If you want to share
between all the application,

you can do that as well.

So as per your requirement,
you can change the permissions.

Next one, you can schedule.

If you want to schedule
it, schedule it from here.

Use all the parameters,
whatever you want.

You can schedule it as
per your requirement,

and all the other
details are there.

Actions, whatever actions
you want to perform,

you can do that.

Scheduling is one part.

Next one is Acceleration, so
you can accelerate the report.

But before that, you
need to schedule it.

If you do not schedule
it, it won't acclerate.

Acceleration means, what it does
is, it will summarize the data

and put the copy of
that summarized data,

put it on the file,
not in the index,

OK, not in the main index.

You can clone it, you
can get the embed value,

and you can delete it.

These all operations can
be done on the report.

Also, if you can see in
the more information.

So there will be more
information about created app

schedule action.

So what all details are
there for this report,

you can see it over here, OK.

So OK, there are
multiple things there,

like Edit Job, how
it is performing.

If it is log-running,
you can pause it.

You can stop it.

You can reload it.

You can share it, print it, and
you can download the report, OK.

These are operations
you can perform in it.

So in Download, we can see
how many options are there,

so how many times you can
download raw data, PDF, CSV, XML

and JSON.

And these many types, you
can download the reports.

Name is optional, and how
many records you want to--

how many reports you want to--

OK, now let's come
to the next one,

creating tables
and visualization.

So mainly, there are
three types of method

to create table and
visualization in Splunk.

So first one is select a
field from the side bar

and choose a report to run, OK.

You can select from the sidebar,
and you create a report.

And use a Pivot interface.

This means you can use
start with data, data set,

or directly, you
can go to Pivot.

So this is how you
can create a table.

Use the Splunk Search
Language transforming command

in the search by directly.

You can write your own searches,
and you can create a table

or visualization.

So let's go.

Let's have a look one by
one, how can we achieve this.

So how can you view the
table or visualization?

So if you run any
report, any query,

so there are multiple options.

First is Events, where you can
see the raw events pattern.

You can find out
pattern in your data.

And next one is Stats.

So from Stats, this will
represent you the tabular format

of your data.

So whatever I have given
in the table command,

you can see, name, age,
employee ID, city, and salary.

And next one is
visualization where

you can see how your
data is performing,

or as per your
query, here, you can

use stats any of the
transforming command, which

should be a
transforming command.

So you can see the
visualization and the table,

or statistic table.

So this is how
you can visualize.

So as I mentioned,
you can create

a report, or a table or
visualization, in three ways.

So one of the ways is, select
the value from your field bar.

Select the value
from your field bar.

Let's have a look how
can we achieve that.

So you can see it here.

There are many fields there.

Now, choose a numerical one.

Always choose a numerical one.

Now, in my data, I can
see a numerical value.

So when you click
on numerical value,

it will show you some
mathematical functions,

average over time,
max value over time,

minimum value over time, top
values, top values by time,

rare events with this fields.

OK, so what you can do is
directly click over here.

So once you click it, it
will give you the details.

Currently, only age, OK.

OK, time chart.

Age, only this
much age is there.

That's why it is showing--

OK, I have selected the average.

So it will show
you only average,

because the average is coming.

Like similarly, let's see for
some other value for average

over time.

I think for my data, I have
ingested at the same time,

so ingestion time is taking.

So it will give
you this data only,

like for this time, because
it's average on time.

So for this particular time,
all the events has happened.

So that is why it is
showing you this graph.

Otherwise, it will show as I'd
shown earlier, similar to this.

It will show you on
the basis of time

how your data is performing
on the basis of time, OK.

So this is the simplest
example of how you can

get the data from your fields.

So also, when you
click on that field,

you observed
automatically, it is

giving the time chart command.

Now, you click over
here, it's giving you

time chart command, OK, because
time chart command always

works over the time.

So by default, the y-axis,
the x-axis is always time.

And the y-axis will be the
field which you have taken.

OK, so now let's create
a top value report.

So when you go to your
event from event itself,

from sidebar field itself,
you can create top values.

So let's go to alphanumerical
values, alphanumerical values.

And here, you can
see top values.

So once you click over here, it
will give you top 20 countries'

value, but currently, only two
data is there for each country.

So it will show you
this, only two records.

But by default, if you
choose it over here,

it will show you 20 records by
default, but in the top, OK.

So you can play
around with your data.

Currently, I have limited data.

So it is showing this
many, only on two records.

So it will definitely
show you top 20 records.

And then by default, it will
provide you the bar chart.

And you can change as
per your requirement.

And you can top or some other
as per your requirement.

OK, so just keep
in mind that when

you click through
any of the side

bars, so it will
show you top 20.

Otherwise, it will show
you top 10 records, top.

Here, there is no
multiple data, so there

will be a top 10 records.

So this question
can come in exam.

So as you have seen, you
can change the chart.

You can change the
format as well.

There are multiple
formats there.

So General Stack over,
you can do stack,

or one after on top of that.

You can have a
Multi-series as well.

If you want to see the current--
show the data over here,

you can see it.

Otherwise, it will show you a
minimum or maximum for data.

Now, if you see it,
will show you 2, 2.

Now, minimum, maximum.

Again.

It's 2 or 0.

It means 2 is maximum.

There is no 0, so
it's showing maximum.

OK, now on X-axis,
which field do you

want to keep it on X-axis?

In which format by default?

Customize none, or
label how it should

look like, x-axis or y-axis,
how it should look like.

You can do that,
label truncation.

You can do the label
truncation as well, y-axis.

Similar to x-axis, you can play
around with the y-axis overlay.

For this also, I have created
video, but overlay, nothing.

But it will show you the line.

Whichever you have
selected, the field

will go off from
the chart, and it

will create a line chart,
line for that values, OK.

These are all the
things I have already

explained in my previous video,
so please have a look on that.

So this is how you can play
around with your reports.

And after doing
this, finally, you

can go here and save it as a
report, as I mentioned earlier.

There is one more thing.

When you switch to
statistics, there is a term

called data overlay,
field overlay.

So how it works is, whenever
you create an heat map,

it will change.

You change the color from
this to lighter version

of this color, as
per the values.

And heat map looks like that.

And high to low.

So again, if you
click on that, it

will show you high
value, as it's only 2.

if it is 0 somewhere
there, so it

will show you
lighter of that, OK.

So it will show you the
lighter value over there.

So this is all about report.

Welcome to my channel.

Now, this video is about
creating dashboard.

So, if you have gone through
my last video, in that video,

I have explained to you about
creating reports and working

with reports.

So continue to that video.

I am going to show you how to
work with a dashboard or what

exactly what the dashboard is.

So a definition of
dashboard, a dashboard

consists of one or more panels
displaying data visually

in a useful way, such as
events, table, chart, or stats,

or any other data or
normal events also, you

can show it in a dashboard.

So in short, you can
say a dashboard is

a collection of reports, and
reports has saved searches.

This is the pure
definition of a dashboard.

So a report can be used to
create a panel on a dashboard.

So a dashboard consists
of different panels.

So we will see how you
can create a panel,

or how can you add a
report into the dashboard.

So let's add a report
into the dashboard.

So this is the
report which I have

created in my previous video.

So in this video, I
have already explained--

in my previous
video, I have already

explained the detail
about these tabs.

So now let's go to next tab
of it, creating a dashboard,

add to a dashboard directly.

You can create it.

Add a report from
here to the dashboard.

So if you have a new dashboard,
so give the detail about it.

Demo, demo dashboard.

OK, And dashboard ID.

If you don't give
underscore as well,

it will always take
it as underscore.

So keep in mind.

And then the
description is optional.

One thing to be noticed, if you
have already existing dashboard,

like see, a few
dashboard are there,

if you want to add this
report in existing dashboard,

you can do that.

Or else, you can save it
as per your requirement.

So by default, the dashboard
permission is private.

You can make it public to
share to the application,

or within a application
to multiple user,

or a between the apps, you
can share your dashboard,

as the permission works
similar to any of the report.

So if you have a panel name in
mind, you can use that panel.

Or if you want to give a
panel name, you can give it.

I will give a panel
name as Employee Record.

OK, so I'm not
using inline search.

I am using it as a report.

And also, report, in what
type the report can be,

a column, chart,
or a statistics.

So currently, I am
using a statistics,

so it should be Statistics.

So for now, drill down.

Now I will show you how can we
drill down to a particular event

or drill down from your events.

OK, so click on Save.

So once you click on
Save, it will show you

the dashboard has been
created, and you may now

view the dashboard.

Now, once you
click over here, it

will show you the actual
dashboard which you

have created from your report.

So currently, it's only
a single dashboard.

so you can create
multiple dashboards.

This is only a
single panel, which

says that it's Employee Record.

You can make a JSON
panel or below panels.

Let's see how it works.

So I'm using the word panel.

So let's have a look.

Why create panels
for the reports?

So the first thing, it
is efficient to create

most dashboard panels
based on the report

because a single
report can be used

across the different dashboard.

One report can be used
for different dashboards.

This links the report
definition to the dashboard.

So it will link the report
definition to the dashboard.

Any changes to the
underlying report

affect every dashboard panel
that utilizes that report.

So it's nothing but
calling a function.

So whenever you are
using that panel,

this panel, anywhere
you can use this panel.

This panel can have multiple
reports or single report.

So you can use this
panel in other report

as well, other
dashboards as well.

So this is beneficial
for reusing your reports

in multiple dashboards.

So let's play around
with the dashboard.

So first, I will show you
how can you edit the panel.

So once you have
saved your dashboard,

so dashboard will
look like this.

So if you want to do any
modification or anything,

you want to play around
with the dashboard,

so you need to click on Edit.

So here, it will show
you UI, and then next one

is source code.

So if you are good
at XML format,

so you can create a dashboard
in the backend as well.

So there are many things you
can only create in backend.

So you should have a little
bit understanding of it.

And then the panel,
which I am calling about,

this is the panel.

So you can drag and drop if you
have multiple panels over there.

Let me add one more panel.

So let's add a second
with add panel.

So I will add one panel,
like a column chart.

And again, I will give
it Employee Record.

And I need to give a query.

So this similar query,
I will be using.

OK, table.

Table name.

This, I will use the
same query over there.

OK.

Time Picker I have not
used Global Time Picker.

So let's have a look
on that as well.

So I will do that.

I will click on OK.

It will look like this, and this
is what I was talking about,

that you can drag
and drop over here.

OK, so I was talking
about Time Picker.

So if you add Time Picker,
so now, in inline query,

you can see the Time Picker.

So whenever you change the time,
this report will get changed.

So in this, how to
do that, if it's

a different way of doing
it, so I'll show you

in my upcoming video, how can
you change the report Time

Picker value over there.

OK, so the next
will be, here you

can see more values, one or
more values, here more actions.

So in that, this action,
two things can be there.

One is Drilldown option.

So Drilldown option, what
do you exactly want to do?

First, the automatic
will be linked to search.

So whenever you will
click on any of this,

it will link to the search,
and multiple options are there.

No actions linked
to the dashboard,

linked to report link, to URL
manage token on this dashboard.

So these are the multiple
options that are there.

This will come in
advanced version.

But for now, you
need to understand

that these many
options are there, OK.

And once you click over
here, you need to apply it.

So the next option on this is--

[INAUDIBLE] is
nothing, means nothing,

but it will show
you different values

for different forms,
because this, again, it

will be the advanced one.

So I'm not showing
you over here.

So once you save it with this
option, Drilldown option,

once you save it, now
if I click over here,

it will redirect you
to city equal to Pune.

If you can see it, it is showing
me should city equal to Pune,

and the name equal to.

Whatever the things will
be there, it will show you.

Like, I have clicked over here.

So it will show you
name equal to this,

and then name equal to Kabeer,
and then city equal to Pune.

Like see, I clicked over here.

It is drilling down me
to that particular event.

So similarly, also
time range, it

will pick the same time range,
which is present over there.

OK, so this is about drilldown,
and then it's visualization.

So next can be if I
go to the dashboard.

If I do not have
permission to edit

this dashboard, what you can
do is, I can go and clone

the dashboard.

I want to change--

clone self for temp.

Temp, and I will clone it.

So you can see it over here.

It's cloned, and then
all the things will be.

And you can change as
per your requirement.

The search can be changed
when you click over

here on the filter.

You can do all other
operations as well.

You want to select
the visualization,

you can select the
visualization under the panel.

See, you can see the
visualization formatting.

You can change the formatting
as you have done on the reports.

All the formatting
can be done here.

Here, everything can
be done, which you

have performed with the report.

So it's treated as
a single report.

And the combination of it,
or when you clubbed together

these reports, it will
form it as a dashboard, OK.

So if you have done
any changes, it

will highlight you the
Save panel, Save option.

Otherwise, it won't
show anything.

Just you cancel it
and you move ahead.

Now, Next one in this
is, what you can do

is edit, export and print.

You can export your
dashboard to PDF,

and if you want to send this
PDF to your customer or anyone,

you can send it.

So this is how it will
look like in the PDF format

when you download it.

OK.

This is a very useful
feature when you want to--

because the dashboard, there
is a limitation of dashboard.

You cannot send this
dashboard as an email,

so the best way you just
download it as a PDF,

and this PDF can be
sent in the email.

OK, so one more main thing,
good thing about dashboards

are, you can set this dashboard
as a home page, home page

dashboard.

So you can choose it over here.

From here, you can choose it.

I can select the dashboard
which I have created.

Choose a dashboard demo.

OK, save.

So whenever I will log in,
I can see these dashboards.

OK, let me log in and log
out, and log in once again.

So [INAUDIBLE].

Logging in, it will show
me the same dashboard

which I have created.

So guys, that's it
about the video.

Let me show you
how can you search

for the dashboard which are
there already in your record.

So whenever you click
on Search and reporting,

there are multiple
tabs there where

you can see the reports alerts.

And here, you can
see the dashboard

which you have created.

So please follow the
naming convention as well.

I have created demo
dashboard, for which purpose

you have created to
put underscore, email,

employee record or something.

So I should have created,
but it's OK for now.

So just bear in mind about
the naming convention.

So guys, that's it
about the video.

Thanks.

Welcome to my channel.

So the next topic will be
scheduling reports and alerts.

So in this video, I'll be
covering scheduling the reports.

So before we start, just we want
to know why we schedule reports.

So scheduling reports
are useful for

monthly, weekly, daily executive
managerial role of reports.

So by doing scheduling reports,
so management or upper level,

they can see the reports, how
their business is performing,

how a particular
flow is behaving.

So the next point can be
a dashboard performance.

So by sharing a
report, we can increase

the performance of a dashboard.

And the next one can be
automatically sending

reports via email, so when
you schedule a dashboard

so you can send a
report automatically

to someone's inbox.

So these are the few benefit
of scheduling the reports.

So how can we create a
scheduler for the report?

So this is the search bar.

So you need to type, write
some query over here.

I have already written a query.

So this will be the query.

And also, it's similar
to my previous video.

I have mentioned how
can we create a report.

So here, we can give a name.

So it can be
IT_Report_EmpRecord.

EmpRecord.

Here, I am putting, this can be
the description, can be "Demo."

So if you do not want to, so the
time picker can be a scheduler.

It will pick a scheduler report.

So once you do that, it will ask
for several options, Permission,

Schedule, Acceleration
and Embed.

So here, you can
schedule that report.

Click over here.

Once you do that,
you need to click

whether you want to schedule.

Yes.

Once you schedule it,
a different option

will come, how often
you want to schedule.

So weekly, every hour, every
day, every month, every week,

every month, or cron job.

So for cron job, you need to
know how the cron job works.

So currently, I
am putting hourly.

Now, the second term with time
range, how far the data you

want to fetch.

Do you want the data for last 15
minutes, 60 minutes, or 4 hours,

or so on, or for all?

It's not a good practice
to select for all,

because it will impact your
performance and search will not

get completed if it's the
huge data will be there

and relative time
you can put it.

There are different advanced
time ranges also there.

So this is how you can
select the time range.

So I will select the
time range as weekly.

And if you say weekly,
it will ask on which day

the report will
run, and what time.

So currently, I'm
keeping it as it is, OK.

So by this, as I
already explained it,

you need to select
the time range.

And priority, what can
be the priority of it?

Highest priority, or highest
priority, or by default?

It can come.

Window, schedule window.

If you want to put a schedule
window, you can do that as well.

So a schedule window
is nothing but a report

run for that particular window.

Whenever the multiple
reports are there,

the report will run for
that particular window.

This will help whenever the
multiple reports are there,

and those are queuing up.

So it will give you a
relaxation of that window

in that this particular
window, the report should work.

It should run.

OK, so the definition of it
can be a schedule window.

This setting determines a
time frame to run the report.

If there is other
reports scheduled

to run at the same time,
you can provide a window

in which to run the report.

This setting
provides a efficiency

to schedule several
reports or run.

So this is the benefit of it.

So once you select
all these options,

once you checked
all these options,

you also have option
of triggering an alert.

So there are multiple
options as a log event,

output result to lookup, output
result to telemetry endpoints.

Run scripts, send
email, webhook.

These by default comes
with the Splunk version.

So event, log event, creates an
index, searchable log events.

So if you want to put the
event of that in the index,

so you can do that.

Output result to
Outlook, send result

to a result offer of
search to CSV lookup files.

So through that,
you can do that.

Output result to
telemetry endpoints,

send you usage
metrics back to Splunk

if your company has
opted in the program.

So you can send the
output to Splunk back.

OK, I run a script.

You can run a script over here,
send an email and webhook.

You can send through webhook,
you can send a data to UI,

send data to UI through that.

Now, we are going to choose
option of sending email.

So through that, you
can send an email here.

You need to give
an email address.

So [INAUDIBLE].

So it can show you
CC and BCC as well.

Here, if you want to give
a priority of a report,

you can give it.

Now, if you want to use
any field from your output,

so you can enclose in between
these signs, dollar signs.

And otherwise, you can
just tell Employee Record.

So Employee Record.

Now, message.

Message, again, if you want
to put field in the message,

so you need to enclose
in between these signs

and write whatever you
want to write over here.

Also, multiple
options are there.

If you want, you can
link to a report.

Like it will come with a
message, link to report,

link to result, result string.

It will show the result
string in line table.

Or if you want to attach any
of this result as a CSV or PDF,

you can do that.

So once you save it,
let's verify everything.

Everything is fine.

So once you save it,
you can see the alert

will run for Monday this
time, and for 24 hours.

Currently, it has not run, so
there is no result over here.

And how can you see this?

So you have to go to, first
of all, in [INAUDIBLE],

you have to go to Reports.

Search for this report.

So you can see it over here.

The report, the next one
is for this time, OK.

And other things, private,
public, you can see it.

And Edit option,
through that, there

are multiple edit options, as
I mentioned in my report video.

With report these options,
you can see the report as well

as well as with the scheduler.

So description, you can
change the description.

You can assign a permission,
assign to app or in between app,

or in this app to all the users.

Or you can share
between the apps.

So this is how you can edit it.

So there are a few more options
there, Accelerate and Clone,

cloning this report, or Embed.

Once you click on
Embed, it will show you

how directly you can embed any
of the things, or HTML-based.

These are HTML-based.

You can copy and
use it anywhere.

OK, so this is all
about scheduling report.

So once you schedule it,
it will run for this time,

and you will get the email
on email notification

and your mailbox, whatever
options you have chosen.

If you have chosen,
the report should

go in CSV format or PDF format.

You will get the report
in that particular format.

So that's it for now.

Hi, friends.

In my previous video, we have
seen how to schedule a report.

So in this video, I am going
to tell you what is an alert

and how can we schedule
alert in our environment.

So before that, what are alerts?

So first, Splunk
alerts are based

on searches that can run
either on a regular schedule

interval or a real time.

So the alert should
be scheduled,

or it can be in real time.

So alerts are triggered
when a result of search

meets a specific
condition that you define.

So whenever you are
going to create an alert,

so it is searching for
a specific condition

that you are going to trigger
for any specific alert.

So based on your need,
alert can create an entry

and trigger alert, login
event, output result to lookup,

send email, use webhook,
perform custom action.

So these all are
actions you can perform.

So let's have a look how
can we create an alert.

So when you are creating alert,
you should know on which search

you are going to create an
alert, or for which data

you are going to
create an alert.

So I have data already ingested
in my environment, my POC

environment.

So similarly, you can ask
in your POC environment,

or if you are performing
this action in production.

So there should be a
search written already,

and there should
be some criteria.

On that basis, you are
going to set a threshold,

and you will get
the alert out of it.

So this is my
simple query, where

I am going to get
the age of employees

which is greater than 30.

So when I go here, I
will search for it.

And this is the event which
I'm getting it over here.

So how I can change it in alert?

So as we have seen
for saved search also,

we need to, saved search,
we need to run Save As.

So here, you can see it.

First option is Report,
second is Dashboard,

and third one is Alert.

So you need to click on Alert.

So once you go in
Alert, first you

need to give the title of it.

So I can give IT.

So you need to follow the
naming convention as well.

Alert and AgeGreater30.

So description, I am
putting it as "Demo."

You can put as per
your requirement.

So the description
should be there.

The next part, the permission.

So permission, this
permission, similarly, we

have checked on permission
on reports or dashboards.

So similarly, this
permission will work.

So if you keep it
private, the alert

or the search behind the
alert, only you can see it.

Nobody else can see it.

By default, it's private, and
you can share it through app

as well.

So now, if you want
to schedule it,

so this is what we
are talking about.

An alert can be
scheduled or real time.

So if you want to
schedule it, you

can schedule it for
any specific time.

If it's a real time, the alert
will be running real time,

and you need to specify the
expiry date of the alert.

If it's running
for a long time, it

will expire in
this specific time.

So by default, it
comes as a schedule.

And whatever schedule
you want to provide,

you can provide the
schedule over here,

how often it checks
the employee data.

So daily, hourly, weekly,
monthly, or any specific cron

job, or specific certain
time you want to schedule it.

So you can schedule it.

So I am selecting hourly basis.

So before that, just we
can see the difference

between alert type, alert type,
like Scheduled and Real-time.

The Scheduled alerts search
run at a definite interval,

and evaluate a trigger condition
when the search completes, OK.

And the Real-time one is, the
real-time alert search runs

constantly in the background.

It will run constantly
in the background.

Second one, evaluate
trigger condition

within a window of a time based
on the condition you define.

So it will check for
it within a window.

This window, it will
check whatever time you

have defined in that window.

It will check for the data, OK,
whatever time you have defined.

So this is the
difference between type.

Now, schedule setting,
as I already mentioned,

this many number of
schedule settings are there.

So you can define whatever
you want as per your need.

Now, there are certain scheduled
condition, trigger condition.

So there are a number
of trigger conditions,

like when the alert
will get triggered, OK.

The number of results, as
you can see, you have already

given a query, that
meeting your condition,

if there is any
event or such event

is coming, triggering
this alert.

Number of hosts, if number of
hosts are greater than or less

than something, so you
can trigger an alert.

Number of sources, whatever the
source are there, or custom.

So custom, you can
define your own field

is greater than or
less than or something

you can define over here.

So let's say if you define
a number of results.

So here, you can apply a
condition that is greater than,

is less than, is equal
to, is not equal to,

drop by, or rise by.

So drop by, rise by, that
means for a certain percentage,

it's dropping or rising so
you can trigger an alert.

So for now, I am
giving greater than 0.

That means if the age
is greater than 30,

so it triggers an alert.

So this is the simplest one.

Now, trigger an alert
once or for each result.

Suppose in my result, there
are multiple rows out there,

or multiple events are there.

So whether you want to
trigger the alert for only

once or for each event.

If the search query is
like here, if you can see,

if search query is
giving more than one

result, so the alert will get
triggered for multiple records.

So in this condition, it
won't trigger anything.

So I will create one more alert.

Alert, and AgeGreater30.

Demo, and everything,
I'll keep as it is.

Hourly.

And similarly, the
number of results.

And this is the same thing.

This is very important.

Throttle, throttle.

That means you
want to suppress--

if there are many
events out there,

the flood of events
out there, so you

can suppress that
flood of events

by setting this condition.

OK, so suppress the event.

Similar event coming
for 60 seconds.

Or if you are running
query for every 10 minutes,

if you do not want, the similar
alert for next 60 minutes.

So you can define over here.

So likewise, you can
do or day or something

whatever you want to.

So suppress a event
for certain time.

If that time-- beyond that time,
again, trigger one more alert

and wait for another 60
minute or 60 seconds.

OK, after this, there
is main condition.

Once all this
condition is fulfilled,

now you have to
trigger an action.

So action can be multiple.

So before that, just have
a look once and for each.

When you select once, what is
the difference in throttling?

And once you search for
this, for each condition,

for each event, you need to
define a specific field on which

you want to suppress the alert.

Or for that, like say here,
we are searching for age.

So age should be
the field on which--

if age is greater than
30, if you are getting

those alerts
continuously, suppress it

for the next 60 minutes.

And then, again,
release a new event.

OK, so I hope this is clear.

So the next point
is very important,

our trigger condition.

Now, trigger
condition, there are

number of trigger conditions.

One, add alert.

Add to trigger an alert.

Log events.

Output result to lookup.

Output result to
telemetry endpoint.

Run a script.

Send an email or webhook.

It's similar to I
mean, I have already

explained in one of my videos,
so you can have a look on that.

So trigger an alert.

So for this tutorial, I am
just choosing to send an email.

So once you give that, you
need to view email address.

And BCC or CC, you can
put it, and you can

define a priority of an email.

[INAUDIBLE] the priority.

If it's high, you
can put it high.

Here, subject.

If you need some data
from your results,

you need to enclose it in
between the dollar sign.

So Age Alert For Employee.

Age Alert For Employee.

Employee Age Greater
Than Age, and say.

age.

So it will come as 30 when it
comes in the email subject.

So similarly, if you want to
define anything in the message,

you can do it.

And if you want to use
it, you use it too.

So also similar to
Scheduled Report,

you can use any
of this parameter.

So you want to
link an alert link,

a result search string table,
you want result in attached CSV

format, trigger condition,
specific trigger time,

or you want to attach it in PDF.

So I'm keeping it as it is
and attaching it to PDF.

Now, if I save it, it will
ask for the permission.

OK, I'm using a
free-trial version,

so shared schedule
will not work.

Otherwise, like in a
full-fledged version,

it will work.

So if you want to work
around the permission

so you can have a
look on permission,

if you want to change the
permission of this app,

currently it's
owned by yourself,

so nobody can see it, though
the alert condition will

get triggered.

And if you want to share it
in the app, you can do it,

or among the apps,
again, you can do it.

So once you save it, it
will land you to this page

where it shows the alert
name, whatever the alert name,

description, and
Enabled or Disabled.

Currently, it's enabled.

If you want to disable
it, disable it.

And App, you can
specify the app as well.

Permission, what
permission you have.

Modified, last modified.

Alert Type, Scheduled,
Hourly basis.

Hourly basis, or if you want
to edit it, you can do it.

Trigger Condition, number of
alerts and the trigger condition

or action.

The action here you
specified, email,

or if you specified
some other action,

it will specify
that action as well.

If you want to edit the
alert, you can go ahead, edit.

It's similar to edit which
we have applied on search

scheduling or search reporting.

So similarly, you
can do the editing.

Open in search, that's similar.

If you right-click on this,
it will open in search

bar. the search which you
have written will open.

There, now the second
one, Edit Alert

if you want to do some edit.

But remember, you will not be
able to change the name of it.

You have to delete, and
you have to again create

a new report with another name.

OK, so here you
can edit whatever

you want apart from name.

So again, permission.

You can change the permission.

And disable.

And you want to clone it.

You can clone it.

So if you want to see alerts, so
definitely, you can go to alerts

and see the alerts
that you have created.

So here, you can do
whatever operation

I was showing over there.

You can do it over here.

So severity means if you want to
see alerts, which is triggered

with this, this field.

You can go to this
page directly,

and you can see whatever.

If any alert has been triggered,
it will show it over here,

and you can check how it is
performing or how it is working.

And also, if
related to this, you

want to see any job activity,
so you can go to here

and see if any action
has been triggered.

In activity, you need to go to
an activity and trigger alerts.

If you know the detail about
it, you can see it over here.

OK.

So that's it about the video.

Let's have a quick
look on the summary.

So what is alert?

Alerts are based on
the saved search,

and that can be run
on regular interval

or it can be a real-time alert.

Alerts are triggered when
the results of search

meet a specific condition
that you define,

and based on your
need, alert can

create an entry in
triggered alert,

log event, output
result to lookup file,

send email, use webhook,
perform a custom action.

So we have talked about
how can we create alert.

So before that, you
need to know the query

on which you need to trigger
an alert and alert condition.

So you can create. similarly,
the alert, you can create,

go to Save As, and
you create an alert,

and define everything
over here, and save it.

And there, we have talked
about the permission alerts

and how can we schedule it.

And we have talked
about alert condition,

trigger condition on which
condition you can trigger.

We have talked about
once or for each result,

how can you trigger an alert.

And accordingly, we have
seen the throttle value,

how can we suppress the
unnecessary noise if you do not

want it.

And there are multiple events,
and multiple trigger actions

are there.

So these are the
trigger actions.

So I have chosen email one.

So also you can
choose a log event,

log event where you can give
a log event to a specific--

you need to put an event,
and you can ingest the data

in the index.

So this, by default,
it's going to index main.

Then you can define host
or source type or anything

you want to.

Here, you can define.

So there can be multiple
actions in one alert.

So you can define
multiple actions,

like see, log, and as
well as send email.

So once you finish
it, you just save.

And you can see this browser.

Where is it?

This browser, you can see
it, and here, all the details

about the alert is there.

And you can do all
the other operations,

and you can edit your alert.

If you want to see any
alerts triggered with you,

alert which you have
created, go to Trigger Alert.

From Activity, Trigger Alert.

Go over here, and you can see
you need to select the options.

And you can see whatever the
alert has been triggered.

So this is all
about the scheduling

alert and creating alerts,
and editing alerts.

So thanks for watching the
video and have a good day.