Splunk: Enterprise Operational Intelligence Delivered

Chapter 9. Best Practices and Advanced Queries

As we bring this book to a close, we want to leave you with a few extra skills in your Splunk toolkit. Throughout the book, you have gained the essential skills required to use Splunk effectively. In this chapter, we will look at some best practices that you can incorporate in your daily Splunk work. These include the following:

• Temporary indexes and oneshot indexing
• Searching within an index
• Searching within a limited time frame
• How to do quick searches via fast mode
• How to use event sampling
• Using the universal forwarder

We will also list some advanced SPL queries that you can use as templates when the need arises. These include:

• Doing a subsearch, or a search within a search
• Using append and join
• Using ...