Category: Splunk

Working with Splunk Metrics Indexes (Part 3)

Part 1 of this series of articles about working with Splunk metrics indexes covered what metrics indexes are, how to create one, and how to

Working with Splunk Metrics Indexes (Part Two)

Part 1 of this series of articles about working with Splunk metrics indexes covered what metrics indexes are, how to create one, and how to

Working with Splunk Metrics Indexes

This article is split into three parts to improve readability – this is the first segment of the series. TL;DR “My simple definition and mental

Splunk Search Command of the week: mvjoin Command

Data that has multiple values in a single field can be difficult to view in a report. Splunk’s Search Processing Language (SPL) offers several functions

Splunk Coalesce Command

Data fields that have similar information can have different field names. While the Splunk Common Information Model (CIM) exists to address this type of situation,

Splunk Processing Language (SPL) SubStr Function

The Splunk Processing Language (SPL for short) provides fantastic commands for analyzing data and creating content from your search results. The language also provides functions

Splunk Search Processing Language (SPL) Concatenation Feature

The Splunk Search Processing Language (SPL for short) provides amazing flexibility for string manipulation in events. While creating your SPL searches you may come across

Using the Splunk Relative Time functions

Splunk has power commands for analyzing events over time or with a window of time using timestamps of the event. One of the most interesting

Splunk Lookups

Splunk has some enormously powerful features for analyzing data. One of the most popular is the ability to take highly analytical information and render it

Exploring the Power of Splunk Subsearches: Correlating Events for Enhanced Insights

Splunk subsearch is an analytic technique for correlating events in data and discovering key activities that is occurring your computing environment. Did you know that