Chapter 6. Advanced Search Examples
In this chapter, we will work through a few advanced search examples in great detail. The examples and data shown are fictitious, but will, hopefully, spark some ideas that you can apply to your own data. For a huge collection of examples and help topics, check out Splunk answers at http://answers.splunk.com. Our chapter flow will be as follows:
- Using subsearches to find loosely related events
- Using transaction
- Determining concurrency
- Calculating events per slice of time
- Rebuilding top
- Acceleration
Using subsearches to find loosely related events
The number of use cases for subsearches in the real world might be small, but for those situations where they can be applied, subsearches can be a magic bullet. Let's look ...
Get Implementing Splunk - Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
