Book Image

Advanced Splunk

By : Ashish Kumar Tulsiram Yadav
Book Image

Advanced Splunk

By: Ashish Kumar Tulsiram Yadav

Overview of this book

Master the power of Splunk and learn the advanced strategies to get the most out of your machine data with this practical advanced guide. Make sense of the hidden data of your organization – the insight of your servers, devices, logs, traffic and clouds. Advanced Splunk shows you how. Dive deep into Splunk to find the most efficient solution to your data problems. Create the robust Splunk solutions you need to make informed decisions in big data machine analytics. From visualizations to enterprise integration, this well-organized high level guide has everything you need for Splunk mastery. Start with a complete overview of all the new features and advantages of the latest version of Splunk and the Splunk Environment. Go hands on with uploading data, search commands for basic and advanced analytics, advanced visualization techniques, and dashboard customizing. Discover how to tweak Splunk to your needs, and get a complete on Enterprise Integration of Splunk with various analytics and visualization tools. Finally, discover how to set up and use all the new features of the latest version of Splunk.
Table of Contents (20 chapters)
Advanced Splunk
Credits
About the Author
Acknowledgements
About the Reviewer
www.PacktPub.com
Preface
Index

Time


The time subset of commands is used to enrich the data with the ability to search based on time and make data more user friendly for analytics and visualization.

The reltime command

The reltime Splunk command is used to create a relative time field called reltime. It shows the time value in a format that humans can read, relative to current time. The time in reltime would appear as 2 hours ago, 3 days ago, 1 month ago, and so on.

The syntax for the reltime command is as follows:

… | reltime

Refer to the following example for better clarity:

index=_internal |reltime

As shown in the preceding screenshot, reltime creates a more user friendly and human readable format output of relative time, which can be used in analytics and visualizations.

The localize command

The localize command is used to create a list of time ranges in which the results have occurred.

The syntax for the localize command is as follows:

localize maxpause

The maxpause parameter can be used to specify the maximum time between...