Splunk
Search syntax
- key=value AND OR NOT
- | sort num(ip) desc, -str(url) | sort -value
- | reverse
- | top(or rare) limit=5 name
- | head 5
- | highlight fa, fb
- | dedup fa
- | stats count by method
- | chart count by method url
- | timechart span=15m count by url
earliest=“11/5/2017:20:00:00” latest=“11/12/2017:20:00:00”
Show only Certain Fields
| table field
(Not) contains a field
NOT fa=*
See all values in a field
| top a_number SourceName
Interesting Fields
- Explore and know what values for a field
Events before or after X seconds
- Show logs around current event
Visualizations Tab
Linux
crash or reboot?
ast -n2 -x shutdown reboot
- If this reports a SYSTEM_SHUTDOWN followed by a SYSTEM_BOOT, all is well; however, if it reports 2 SYSTEM_BOOT lines in a row, then clearly the system did not shutdown gracefully
host $ip
Write Troubleshooting Friendly Program
- Name your thread
