Splunk Best Practices

Summary

In this chapter, you have learnt about the anatomy of a search, and then some key techniques that help in real-world scenarios. Many people understand search syntax; however, to use it effectively (in other words, to become a search ninja) is something much more evasive and continuous. We have also seen real-world use cases in order to get the point across such as merging two datasets at search time, and making the result set of two searches match each other in time.

In the next chapter, I will show the readers how to create form-based dashboards leveraging $foo$ variables as selectors to appropriately pass information to another search, or another dashboard, effectively creating a drill-down effect.