In this chapter, we will work through a few advanced search examples in great detail. The examples and data shown are fictitious, but will, hopefully, spark some ideas that you can apply to your own data. For a huge collection of examples and help topics, check out Splunk answers at http://answers.splunk.com. Our chapter flow will be as follows:
Using subsearches to find loosely related events
Using transaction
Determining concurrency
Calculating events per slice of time
Rebuilding top
Acceleration