Chapter 6. Searching and Reporting
We are going to learn about the not-so-common searching and reporting techniques that have been used in real-world scenarios in order to present data both accurately and in the pretty format that leadership asks us for. There are also some caveats to the Search Processing Language that we need to understand when performing a search, not only for presentation purposes, but also for presenting accurate data.
We will learn about:
- General practices (efficiencies):
- Core fields
- Case sensitivity
- Inclusive versus exclusive
- Search modes:
- Fast Mode
- Smart Mode
- Verbose Mode
- Advanced charting:
- Overlay
- Xyseries
- Appending results
- Day-over-day overlay
General practices
Of course we can search whatever we want in Splunk, using it in a similar ...
Get Splunk Best Practices now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.