Splunk Search Command Series: mvzip

 

 

Need some help zipping up your data in Splunk? This week’s Search Command should do the trick. The Splunk Search Command, mvzip, takes multivalue fields, X and Y, and combines them by stitching together.

Today, we are going to discuss one of the many functions of the eval command called mvzip. This function can also be used with the where command and the fieldformat command, however, I will only be showing some examples of this function using the eval command.

If you have been following our eval series, I am sure by now you know that the eval command is very versatile. Now let’s dive into another tool in the eval command’s tool belt! Let’s also use another command that we just learned called makemv to help facilitate this lesson. First, let’s make some data that has multiple field values.

Figure 1 - Data with multiple fields in Splunk
Figure 1 – Data with multiple fields in Splunk

 

I’ve created three new fields called name, grade, and subject. Within each of these fields, we have multiple values. Let’s say we want to create a new field with these values “zipped” together. For example, I want to know what subjects Mike is taking all in one field. This is where mvzip comes in.

Figure 2 - mvzip example in Splunk
Figure 2 – mvzip example in Splunk

 

Here, I have created a new field called “zipped” with the values from the name and subject fields. Now we can see that Mike is taking Math, Science, History, and English. Next, I want to know what grades Mike has in those subjects (a.k.a. report card time!).

Figure 3 - Using mvzip in Splunk
Figure 3 – Using mvzip in Splunk

 

Using mvzip, we can see what grades Mike has in each subject. As you can see from the SPL above, I have mvzip the third field “grade” to the other two by adding another mvzip function. Splunk only allows you to zip three fields together, so this is our limit here! Also, if you noticed I added a different delimiter to our final results. I have a pipe separating my values instead of a comma in my first example. You can use whatever delimiter you want when using the mvzip function by putting quotes around the delimiter.

That is it for now, I hope you enjoyed this lesson and I hope you try this out in your own environment, happy Splunking! P.S. I think Mike could use some tutoring in History and English??

 

Ask the Experts

Our Splunk Search Command Series is created by our Expertise on Demand (EOD) experts. Every day, our team of Splunk certified professionals works with customers through Splunk troubleshooting support, including Splunk search command best practice. If you’re interested in learning more about our EOD service or chat with our team of experts, fill out the form below!

Splunk Search Command Series: makemv

 

Have you ever been stick with a single value field and needed it to bring a little more… value? This week’s Splunk search command, makemv adds that value.

Let’s talk about makemv. Makemv is a command that you can use when you have a field, and that field has multiple values. Here is an example of a field with multiple values.

 

Figure 1 - example of a field with multiple values in Splunk
Figure 1 – example of a field with multiple values in Splunk

How to use makemv

Here field1 has the values of 1, 2, 3, 4, and 5. By using the makemv command we can separate out these values. Let’s take a look.

 

Figure 2 - example of separated values using makemv
Figure 2 – example of separated values using makemv

 

Using the delim argument

As you can see, Splunk has successfully divided out the values associated with this field. To use the makemv command successfully you have to give the delim argument, once you let Splunk know what delim it’s looking for, make sure to surround it in quotes. After that, all you need to do is provide the field that has multiple values and let Splunk do the rest! Here is an example of Splunk separating out colons.

 

Figure 3 - Splunk separating out colons
Figure 3 – Splunk separating out colons with makemv

 

Extract field values with regex

The makemv command can also use regex to extract the field values. Let’s take a look at how to construct that. Here is an example.

 

Figure 4 - makemv command using regex
Figure 4 – makemv command using regex

 

Here, all I wanted from the field values was the name of the email address. To do this you need to use the tokenizer argument instead of the delim, while the regex takes care of separating the values. Now that you have some basic understanding of the makemv command, try it out in your environment! Happy Splunking!

 

Ask the Experts

Our Splunk Search Command Series is created by our Expertise on Demand (EOD) experts. Every day, our team of Splunk certified professionals works with customers through Splunk troubleshooting support, including Splunk search command best practice. If you’re interested in learning more about our EOD service or chat with our team of experts, fill out the form below!

Splunk Search Command Series: Table and Fields

In the Splunk search world, table command and the fields commands are really similar, but they have different functions. The fields command allows you to bring back specific fields that live within your data, cutting down the time it takes for Splunk to retrieve the events associated with those fields. The table command does the exact same thing; however, it also lists the fields’ values. Let me show you an example of both of these commands in action. First up: the fields command.

Fields Command

In this first example, notice the search and the fields that it brings back.

Figure 1 - Start with your Splunk search
Figure 1 – Start with your Splunk search

By the way, that search above took a little over 10 seconds to complete. Let’s see how much faster Splunk can retrieve the data once we specify the fields that we’re looking for.

Job inspector results before using the fields command:

Figure 2 - Job Inspector results from Splunk search
Figure 2 – Job Inspector results from Splunk search

The interesting fields that were brought back from the above search:

Figure 3 - Interesting Fields list
Figure 3 – Interesting Fields list

Now that you have seen the interesting fields in the main index and the sourcetype in the above search, let’s say that we are only interested in action, ProductName, file, and JSESSIONID. By using the fields command, we can bring only these four fields back once Splunk completes the search. After that, we’ll check the job inspector to see how much faster Splunk was able to accomplish this search.

Here we have our new search introducing the fields command:

Figure 4 - New search with Splunk fields command
Figure 4 – New search with Splunk fields command

The results from the job inspector after using the fields command:

Figure 5 - Job inspector results with fields command
Figure 5 – Job inspector results with fields command

As you can see, after introducing the fields command to specify what fields we’re interested in, we cut the time Splunk takes to complete the search by almost seven seconds. Notice that Splunk only brought back the fields specified by the fields command.

Figure 7 - Splunk fields command results
Figure 7 – Splunk fields command results

Table Command

Switching gears to the table command. We are going to use the table command on the same four fields that we used in the fields command demonstration. The table command is a transforming command, which means it will take your search results and output the results into a tabular format. Like I mentioned before, it will only bring back fields specified after the command. Let’s take a look at the table command in action.

Here you can see the table command used in the same four fields. The results are now put into a table format displaying the values of the fields specified after the table command.

Figure 7 - Table command results in Splunk
Figure 7 – Table command results in Splunk

There you have it! The fields command and the table command: two very useful and powerful commands that you should definitely add to your arsenal of search commands. Enjoy!

 

Ask the Experts

Our Splunk Search Command Series is created by our Expertise on Demand (EOD) experts. Every day, our team of Splunk certified professionals works with customers through Splunk troubleshooting support, including Splunk search command best practice. If you’re interested in learning more about our EOD service or chat with our team of experts, fill out the form below!

Splunk 101: Basic Reporting and Dashboarding

It’s Mike again, one of Kinney Group’s resident Splunk experts. This week, I’ll review basic reporting and dashboarding functions following best practice methods in this video tutorial.

Basic Reporting and Dashboarding is one of many Splunk troubleshooting issues that is covered by our Expertise on Demand service offering. Within this video, I’ll break down the basics behind these essential functions of Splunk…

Splunk Help At Your Fingertips

If you’re a Splunker, or work with Splunkers, you probably have a full plate. Finding the value in Splunk comes from the big projects and the small day-to-day optimizations of your environment. Cue Expertise on Demand, a service that can help with those Splunk issues and improvements to scale. EOD is designed to answer your team’s daily questions and breakthrough stubborn roadblocks. We have the team here to support you. Let us know below how we can help.

Splunk 101: Basic Search

Splunk Basic Search

Hi, I’m Michael Mims, one of Kinney Group’s resident Splunk experts. In this video, I’ll review the basic search functions of Splunk (following best practice methods in this video tutorial). I pioneer our Expertise on Demand (EOD) team where we work with customers to troubleshoot issues and transfer best practice approaches for Splunk.

Splunk Best Practice in Minutes

Don’t let your investment in Splunk fall flat because you don’t have enough Splunk expertise on staff. EOD is designed to answer your team’s daily questions and breakthrough stubborn roadblocks. It’s a perfect complement to traditional, project-based professional services and maintenance support, providing a set amount of hours each month you can utilize however, and whenever you’d like. Interested in learning more? Let us know below.

Splunk Search Command of the Week: chart

 

This week, let’s chat about chart command.

The chart command is a transforming search command that allows you to put your data into a graphical visualization and like the stats command, the chart command can perform statistical functions such count, avg, min, max, etc. Chart command is going to be most utilized when you have fields that you want to build your chart with that do not involve time. Timechart and chart are similar. However, when you use the timechart command, your charts x-axis value is always going to represent time. With chart command, you can represent the x-axis using the over clause with any field you specify.  

 

Chart in Action

 

Let’s check out this dataset reviewing the ratings from IMBd on Netflix TV shows and movies.

 

Over and By Clause

Here’s an example of chart command and the over clause in action.

 

Figure 1 - Chart command and the over clause
Figure 1 – Chart command and the over clause

Notice that the x-axis is represented by the Age field. This is a product of using the over clause and letting Splunk know that you want Age to be on the x-axis.  The chart command also allows you to manipulate the y-axis by using the by clause.

Here is an example of using the over clause and the by clause together. You can see the chart broken down over Age by IMDb which is the ratings of those movies in that specific age group.

 

Figure 2 - Chart command and the over clause and by clause
Figure 2 – Chart command and the over clause and by clause

 

Remove NULL and OTHER

The legend on the right-hand side has all the ratings in different colors. You’ll also see two values you may not necessarily be interested in… NULL and OTHER. Chart and timechart commands automatically filter results to include the ten highest values while the surplus values are grouped into the OTHER category. In this particular search, our results are skewed by the NULL and OTHER values.

To remove the NULL and OTHER values, you will use these two arguments “useother=f & usenull=f”. After applying the useother=f and usenull=f, you get the results you see below. You can see how the data looks better and cleaner without the OTHER and NULL values.

 

Figure 3 - Remove NULL and OTHER from your chart legend
Figure 3 – Remove NULL and OTHER from your chart legend

 

The Limit Argument

If you want to adjust the number of series that Splunk returns back, use the limit argument. With limit, specify how many values you’d like Splunk to return with.  If you want Splunk to return an unlimited amount of values, use limit=0. Let’s take a look at this in action. After applying the limit argument of 20, this is what Splunk brings back.

 

Figure 4 - Chart command series limit of 20
Figure 4 – Chart command series limit of 20

Next, let’s take a see what an unlimited amount of values looks like.

 

Figure 5 - Chart command series unlimited
Figure 5 – Chart command series unlimited

There you have it. Splunk has brought back all of the IMDb ratings associated with the movies in each age group. Now, you’ve seen chart command in action and its visualization options.

Ask the Experts

Our Splunk Search Command of the Week series is created by our Expertise on Demand (EOD) experts. Every day, our team of Splunk certified professionals works with customers through Splunk troubleshooting support, including Splunk search command best practice. If you’re interested in learning more about our EOD service or chat with our team of experts, fill out the form below!