Understanding the Splunk search interface
Now that we’ve understood how Splunk stores indexed data, it’s time to delve into the mechanics of the Splunk query language. We saw examples of simple queries in Chapter 3, Onboarding and Normalizing Data. Some of the queries we wrote in Chapter 3, Onboarding and Normalizing Data, searched the botsv1 index and used keywords such as sourcetype and earliest. Examples included the following:
index=botsv1 earliest=0 index=botsv1 sourcetype=iis http_referer=* index=botsv1 earliest=0 sourcetype=suricata | eval bytes=bytes_in+bytes_out index=botsv1 earliest=0 sourcetype=iis referer_domain=* | table _time, cs_Referer, referer_domain index=botsv1 earliest=0 sourcetype="WinEventLog:Security" | stats count by Account_Name
In this section, we will write some basic Splunk queries, but first, let’s look at the Splunk search interface:
- We will type up our Splunk search queries using the Search and Reporting app...