Understanding and Using Fields

Transcription

1 Copyright 2015 Splunk Inc. Understanding and Using Fields Jesse Miller Product Manager, Splunk Clara Lee SoCware Engineer, Splunk

2 Disclaimer During the course of this presentaion, we may make forward looking statements regarding future events or the expected performance of the company. We cauion you that such statements reflect our current expectaions and esimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward- looking statements, please review our filings with the SEC. The forward- looking statements made in the this presentaion are being made as of the Ime and date of its live presentaion. If reviewed acer its live presentaion, this presentaion may not contain current or accurate informaion. We do not assume any obligaion to update any forward looking statements we may make. In addiion, any informaion about our roadmap outlines our general product direcion and is subject to change at any Ime without noice. It is for informaional purposes only and shall not, be incorporated into any contract or other commitment. Splunk undertakes no obligaion either to develop the features or funcionality described or to include any such feature or funcionality in a future release. 2

3 Agenda Why you should use fields What are fields? Field maturity Field extractor DEMO MulIvalued fields DEMO More fun with fields Q&A 3

4 Why You Should Use Fields 4

5 Why You Should Use Fields 5

6 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) 6

7 Index- <me fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) 7

8 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- <me fields (everything else!) 8

9 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) 9

10 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) Values are extracted from event data and mapped to a field name Automa<c extrac<on (props/transforms, key=value) 10

11 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) Values are extracted from event data and mapped to a field name AutomaIc extracion (props/transforms, key=value) 11

12 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) Values are extracted from event data and mapped to a field name AutomaIc extracion (props/transforms, key=value) 12

13 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) Values are extracted from event data and mapped to a field name AutomaIc extracion (props/transforms, key=value) 2013/10/03,audit,jesse,write,/etc/rc.local 13

14 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) Values are extracted from event data and mapped to a field name Automa<c extrac<on (props/transforms, key=value) 2013/10/03,audit,jesse,write,/etc/rc.local 14

15 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) Values are extracted from event data and mapped to a field name AutomaIc extracion (props/transforms, key=value) <Symbol>SPLK</Symbol><Last>62.02</Last> <Change>+0.05</Change><Open>61.80</Open> <Low>61.09</Low><Volume>450618</Volume> 15

16 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) Values are extracted from event data and mapped to a field name Automa<c extrac<on (props/transforms, key=value) <Symbol>SPLK</Symbol><Last>62.02</Last> 16

17 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) Values are extracted from event data and mapped to a field name AutomaIc extracion (props/transforms, key=value) Manual extrac<on (rex) 17

18 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) Values are extracted from event data and mapped to a field name AutomaIc extracion (props/transforms, key=value) Manual extracion (rex) Fields can be defined and calculated within a search Stats, Eval, TransacIon You can use lookups to create fields for context and translaion 18

19 Index- Ime fields (Imestamp, host, source, sourcetype, index) Search- Ime fields (everything else!) Values are extracted from event data and mapped to a field name AutomaIc extracion (props/transforms, key=value) Manual extracion (rex) Fields can be defined and calculated within a search Stats, Eval, TransacIon You can use lookups to create fields for context and transla<on 19

20

21 Field Maturity Index Data Extract Fields Use Fields Add Knowledge Keyword search Fix false posiives Metadata filtering CorrelaIon Time correlaion Data- confidence AnalyIcs (stats, charts) Accessibility 21

22 Field Extractor Demo Field extracion using the Advanced Field Extractor Regex/palern based & delimiter based ValidaIng extracions and eliminaing false +/- 22

23 MulIvalued Fields Recipients Open Ports Files Changed Ingredients 25 Props.conf Gin 80 Transforms.conf Lillet Blanc 443 Cointreau 514 Lemon Juice 53 Absinthe 23

24 MulIvalued Fields Demo ExtracIon (props, transforms, rex) ManipulaIon (mvexpand, nomv) Evals (mvcount, mvfilter, mvfind, mvindex) 24

25 More Fun With Fields 25

26 THANK YOU