Using Fields in Splunk
- shows all fields extracted at search time
- broken down into:
- Selected fields
- fields that are of utmost important
- show at the top of the fields list
- show at the bottom of events
- default fields
host, source, and sourcetype are selected by default
- Interesting fields
- fields that have values in at least 20% of the events
a next to a field denotes a string value# next to a field denotes a numeral- clicking a field shows the top values by count and percent
- can add field to search
- can view quick reports of this field
- can add to selected fields list
- can view all fields for the search by clicking
All Fields at the top of the fields list
Fields in Search Queries
- field names are case sensitive
- values are not case sensitive
- field operators
= and !=
- can be used with numerical or string values
>, >=, <, <=
- can only be used with numerical values
- field can be added to search by clicking on a value in the fields window
- Fields Lists > Field > Value
IN operator syntax: index=web status IN ("500, "503", "505")- Fields command is used to include or exclude fields from a search
| fields- uses
+ or - operator to specify if field should be included or excluded
| rename command renames fields
- e.g.,
| rename status as "HTTP Status", count as "Number of Events"
Fields in Search Results
- Fields can be extracted at:
| eval can be used to run operation a field
- can rename the field or add a temporary field at search time
- e.g.,
| eval bandwidth = Bytes/1024/1024
Enriching Data with Knowledge Objects
- Can store an eval command in a calculated field
- can create a field alias
- Lookups allow adding other fields and values to events that are not part of the indexed data
- can be configured to automatically append to events at search time
- Search time operations order:
- Field Extractions
- Field Aliases
- Calculated Fields
- Lookups
- Event Types
- Tags