adam's notes

Splunk Visualizations

Formatting Commands

  • | fields command allows to include or exclude fields from results
    • e.g.,
      • | fields <field names>
      • | fields - <field names>
        • to exclude fields
        • space between operate and fields applies to all arguments
        • if no space (-field) then it only applies to that field
    • limiting fields extracted makes searches more efficient
  • | table specifies fields to transform data into a tabular format
    • similar to fields command
      • but displays as table
    • can use fields command with table command to limit search and make it more efficient
  • | dedup is used to remove duplicate results that share common values
  • | addtotals computes the sum of all numeric fields for each row and creates a total column
    • can add a column summary with | addtotals col=true
      • adds a row to bottom with column totals
    • can add a label with label="Total Sales" and the field to show the label in labelfield="product_name"
    • can change the name of the label of the row totals with fieldname="Total By Product"
    • can disable row totals (only column totals) with row=false
  • | fieldformat is used to format the appearance of values without making a change to the underlying raw data

Visualizing Data

  • Click the Visualization tab in the search results
  • most visualizations requires results structured as tables with at least 2 columns
    • called single series
  • Transforming commands order search results into a data table that can be used for statistical purposes
    • needed to transform search results into a visualization
    • | top
      • finds the most common values of given fields in a results set
      • automatically returns count and percent columns
        • limits results to top ten by default
      • use limit clause to extend or show all results limit=0
      • Clauses
        • limit = int
        • countfield = string
          • title of count column
        • percentfield = string
          • title
        • showcount = True/False
        • showperc = True/False
        • showother = True/False
        • otherstr = string
        • by
          • shows top results split by another field
          • | top product_name by Vendor limit=3
    • | rare
      • same options as top command, but shows the least common values of a fieldset
    • | stats
      • produces statistics from search results
      • common functions
        • count
        • distinct count
        • sum
        • average
        • min
        • max
        • list
        • values
      • as clause to rename the column label to something more intelligible
      • by clause to group by another field
    • | chart
      • has two clauses
        • over
          • tells splunk which fields to be the x axis
          • e.g., | chart count over status
        • by
          • used to split data by additional field
          • can only use one field value
      • usenulls=f removes nulls
        • better to remove nulls before chart command
      • userother=f removes others
    • | timechart
      • performs stat aggregations against time
      • time is always x axis
      • e.g., | timechart count by product_name
      • use span to change the time span of the cluster
        • span=12hr
    • | trendline
      • computes moving averages of field values
      • requires 3 arguments
        • trendtype
          • simple moving average (sma)
          • exponential moving average (ema)
          • weighted moving average (wma)
        • time period to compute the trend
          • integer between 2 and 10000
          • wma2 computes trend over last 2 days
        • field to calculate trend from
      • e.g., | trendline wma2(sales) as trend

Generating Maps

  • | iplocation command is used to add location information from a 3rd party database to an event
    • location data:
      • City
      • Country
      • Region
      • Latitude
      • Longitude
  • | geostats aggregates data for use on a map
    • uses same functions as stats command
    • e.g., | geostats latfield=VendorLatitude longfield=VendorLongitude count by product_name
    • only accepts one by argument
  • Can use geostats command with ip location information generated by iplocation command
    • e.g., | location src_ip | geostats latfield=lat longfield=lon count
    • default lat/lon values from iplocation are lat and lon
  • Choropleth Map use shading to show relative metrics over a predefined locations of a map
    • requires a compressed Keyhole Markup Language file (.kmz)
      • defines region boundaries
    • splunk ships with 2 kmz files:
      • geo_us_states.kmz
      • geo_countries.kmz
    • | geom command prepares events for use in choropleth map
      • adds a field to events that includes geographical data structures that match polygons on a map
      • e.g., | geom geo_countries featureIdField=VendorCountry

Single Value Visualizations

  • 2 types:
    • Single Value
      • displays a single integer
      • formatting allows:
        • adding text
        • add coloring based on ranges
        • change formatting
      • can use timechart command to add a trend to the visualization
        • | timechart sum(price)
      • Trellis option enables splitting visualization by selected field or aggregation
    • Gauges
      • can set color ranges

Visual Formatting

  • Statistical Tables
    • Format button
      • wrap results
      • add data overlay
        • heat map
        • highlight high and low values
      • summary
        • add totals and percentages to columns
  • Chart Overlay
    • useful with trendline
    • Format > Chart Overlay

Graph View

Backlinks