Time
2 hours 29 minutes
Difficulty
Beginner
CEU/CPE
2

Video Transcription

00:00
Hello. We're on module five. Talking about *** searches.
00:04
Being able to run good searches and *** is probably the most important skill set you can develop in splints.
00:10
Not everyone needs to be ableto onboard new data types and modify CONFIG files, but many people in different jobs have to be able to run searches.
00:19
Searches can range from extremely simple, too very long and complex.
00:23
T. It started with a search. You can log into the *** Web interface
00:27
and go to the search and reporting AP.
00:30
You can run searches using the command line interface or the rest a p I, but we'll stick to the APP on the Web interface for this course.
00:39
Here's a great image from sprint dot com. The illustrates the different parts of the search and reporting out
00:44
the example searches will talk about in this video would be entered into the search bar here.
00:49
You can easily change the time over here next to the search button, and then, if you want to save your search, you could go up here.
00:58
If you want to download the results of your search, you can go down to these search action buttons and click this one here.
01:06
You'll probably see the lies SPL a lot in Foreman and forums. It stands for a splint search processing language and means the language around running splint searches.
01:15
Swing searches can just be about retrieving events for you to look at interview.
01:21
But spilling searches can also be about transforming searches that
01:25
transform the retrieve data, such as by performing calculations on them.
01:30
There are six general categories of search commands.
01:34
We won't go too much into these, but we will use examples that could fit under different categories.
01:42
Here goods
01:42
things to remember one running searches,
01:46
the more specific, the better. When you have a small environment like we have, running searches across all events isn't such a big deal
01:53
in a production environment. It can take a lot of time and processing power to check across lots of events,
02:00
good ways to limit searches or by time
02:02
in next and other fields.
02:06
Limiting the time for him you're searching across is one of the best ways to run an efficient search.
02:12
Knowing which index you need a check is a good way, not toys Time and resource is searching unrelated events.
02:17
If you're working in an environment you don't manage as possible. You won't be able to search across all indexes because of how your account rolls or set up.
02:25
Other fields are also good to narrow down
02:30
your search to find just what you're looking for.
02:35
Like we learned in the last module,
02:38
fields are searchable name and value pairings
02:40
specifying known fields and their values can help Bring up the search is you want
02:46
There are some things to remember when searching for fields.
02:50
Field names are case sensitive, but field values are not.
02:54
This means if you're searching for a field name called username and it has a capital you at the beginning, you need to type it this way.
03:04
I feel like you for user name equal Sara. It doesn't matter if the S is capitalized on Sara or not.
03:10
You can also use wild cards. One searching
03:14
if you know, for example,
03:15
that the user name you're looking for starts with F A. You could put a wild card. That's that *** tricks or star looking thing at the bottom there
03:24
after the 1st 2 letters and you'd be able to get results for things like Samantha and Sandy In addition to Sarah,
03:31
if you have
03:34
a space in the field values,
03:36
you should put quotation marks around it. If you're looking for name equal Sarah Smith, you need a format as name equal Sarah Smith with quotation marks.
03:47
When searching, you can use Boolean operators like an or and not, for example,
03:53
user name. Equal Sarah and machine equals. Host three will bring up results where events match both of these fields.
04:00
User name equal Sarah or machine equals host three will bring up events that match either field
04:08
user name equal. Sarah does not machine
04:11
equals Host tree will bring up events where the user name is Sarah. When the machine does not equal host. Three.
04:17
You see an exclamation mark in front of the equal sign. Means does not equal, but it is not the same as using the bully, and not
04:27
when you specified that the field does not equal ah value. It requires that
04:32
value to show up in search results.
04:35
When you're using the not before the field name,
04:40
you can get results that don't have that field.
04:44
You can also use princesses to group values. For searches,
04:48
you can use pipes to transform and filter your retrieved events on my keyboard. I can make a pipe by holding the shift key while pushing the black back flash key.
04:58
Some examples of transforming searches might be things like
05:01
in next Eagles Windows
05:04
stats count by Host
05:08
Sort
05:10
Bye Count, and this were able to perform statistics on the results and sort and sort it so that the largest number displays at the top
05:18
and the second example
05:20
we have results
05:24
in a table
05:26
that would show the lists of hosts and then the de Doop command remove duplicate hosts in the results.
05:31
There are so many other examples, and we don't have time to go into the mall. In this course, you can do many, many things like look at standard deviations
05:41
or compare results
05:44
and
05:44
two lists in a lookup table.
05:46
You could look for outliers in your results and evaluate and display events in many different ways.
05:53
Getting used to use in
05:56
the search language and swung. It takes practice.
06:00
Check the supplemental Mitch years for some lists of other useful example. Searches
06:04
for a last topic in this video will briefly talk about search modes.
06:10
When you run a search you can select the search mode.
06:12
If you want faster results, you guessed it. You can run in fast moan. If you want to be able to make sure that you're looking at all event data relating to your search, you can run the slower for both. Smoke search. There's obviously more to this, but that should be enough to get you started.
06:28
Who that was A lot in a short amount of time
06:31
for our quiz. Please fill in the blank.
06:34
If you're searching for a field value with the space in the middle, you should use
06:41
quotation works
06:43
and the example of this video. If you're searching for a field name of name and a field value of Sarah Smith with a space in the middle, you should put quotation marks around it.
06:54
Great job making it through all of that, and our next video will be using our search knowledge to create alerts

Up Next

Introduction to Splunk

This Splunk training class is designed to quickly introduce you to Splunk and its many capabilities.

Instructed By

Instructor Profile Image
Natasha Staples
Incident Response Security Engineer at Arrow Electronics
Instructor