As we bring this book to a close, we want to leave you with a few extra skills in your Splunk toolkit. Throughout the book, you have gained the essential skills required to use Splunk effectively. In this chapter, we will look at some best practices that you can incorporate in your daily Splunk work. These include the following:
Temporary indexes and oneshot indexing
Searching within an index
Searching within a limited time frame
How to do quick searches via fast mode
How to use event sampling
Using the universal forwarder
We will also list some advanced SPL queries that you can use as templates when the need arises. These include:
Doing a subsearch, or a search within a search
Using
append
andjoin
Using
eval
withif
Using
eval
withmatch
Throughout this book, we have seen how logs can be used to improve applications and to troubleshoot problems. Since logs are such an important component of using data with Splunk, we end the chapter with a few basics...