Book Image

Implementing Splunk (Update)

Book Image

Implementing Splunk (Update)

Overview of this book

Table of Contents (20 chapters)
Implementing Splunk Second Edition
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Chapter 3. Tables, Charts, and Fields

Up to this point, we have learned how to search for and retrieve raw events, but you will most likely want to create tables and charts to expose useful patterns. Thankfully, the reporting commands in Splunk make short work of most reporting tasks. We will step through a few common-use cases in this chapter. Later in the chapter, we will learn how to create custom fields for even more custom reports.

Specifically, in this chapter we will cover the following topics:

  • The pipe symbol

  • Using top to show common field values

  • Using stats to aggregate values

  • Using chart to turn data

  • Using timechart to show values over time

  • Working with fields

  • Acceleration