Search in Splunk

Search In Splunk

 we will check selected fields first

 we probably will need to adjust the time frame

Now we have a better view in splunk

How to use field:
CIDR notation for IP address

src_ip="94.75.75.0/24"
src_ip="94.75.75.*"

Wildcard can be use
user=*  host=* .americannetworkinstitute.com

Comparison operators can be uised for numerica values
sourcetype=linux:iptable  src_port >20 src_port ,25

 you can share your job eventually

You can check what mode are  you at

Search modes

You can use the Search Mode selector to provide a search experience that fits your needs.

The search mode selector is on the right side of the Search bar. The modes are Smart, Fast, and Verbose. The default mode is Smart.

Depending on the mode you set, you can see all the data available for your search but at the expense of longer search times, or you can speed up and streamline your search in certain ways.

The Fast and Verbose modes represent the two ends of the search mode spectrum. The default Smart mode switches between the Fast and Verbose modes depending on the type of search that you are running. When you first run a saved search, it runs in the Smart mode.

Using the Fast mode

The Fast mode prioritizes the performance of the search and does not return the nonessential field or event data. This means that the search returns what is essential and required.

• Disables field discovery. Field discovery is the process Splunk software uses to extract fields aside from default fields such as host, source, and sourcetype. The Splunk software only returns information on default fields and fields that are required to fulfill your search. If you are searching on specific fields, those fields are extracted.
• Only depicts search results as report result tables or visualizations when you run a reporting search. A reporting search is a search that includes transforming commands. Under the Fast mode you will see only event lists and event timelines for searches that do not include transforming commands.

Using the Verbose mode

The Verbose mode returns all of the field and event data it possibly can, even if it means the search takes longer to complete, and even if the search includes reporting commands.

• Discovers all of the fields it can. This includes default fields, automatic search-time field extractions, and all user-defined index-time and search-time field extractions. Discovered fields are displayed in the left-hand fields sidebar in the Events results tab.
• Returns an event list view of results and generates the search timeline. It also generates report tables and visualizations if your search includes reporting commands.

You may want to use the Verbose mode if you are putting together a transforming search but are not exactly sure what fields you need to report on, or if you need to verify that you are summarizing the correct events.

I hope this information was useful....and if it was please click "like"