Chapter 5. Advanced Search Examples
In this chapter, we will work through a few advanced search examples in great detail. The examples and data shown are fictitious, but hopefully will spark some ideas that you can apply to your own data. For a huge collection of examples and help topics, check out Splunk answers at http://answers.splunk.com.
Using subsearches to find loosely related events
The number of use cases for subsearches in the real world might be small, but for those situations where they can be applied, subsearches can be a magic bullet. Let's look at an example and then talk about some rules.
Subsearch
Let's start with these events:
2012-04-20 13:07:03 msgid=123456 from=mary@companyx.com 2012-04-20 13:07:04 msgid=654321 from=bobby@companyx.com ...
Get Implementing Splunk: Big Data Reporting and Development for Operational Intelligence now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
