Leveraging Lookups and Subsearches (LLS)

Voraussetzungen

To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge:

• Intro to Splunk
• Using Fields (SUF)
• Visualizations
• Working with Time (WWT)
• Statistical Processing (SSP)
• Comparing Values (SCV)
• Result Modification (SRM)
• Scheduling Reports & Alerts (SRA)
• Introduction to Dashboards (ITD)

Zielgruppe

• Users/Analysts
• Administrators
• Engineers

Detaillierter Kursinhalt

Module 1 – Using Lookup Commands

• Understand lookups
• Use the inputlookup command to search lookup files
• Use the lookup command to invoke field value lookups
• Use the outputlookup command to create lookups
• Invoke geospatial lookups in search

Module 2 – Adding a Subsearch

• Define subsearch
• Use subsearch to filter results
• Identify when to use subsearch
• Understand subsearch limitations and alternatives

Module 3 – Using the return Command

• Use the return command to pass values from a subsearch
• Compare the return and fields commands