This session will unveil the power of the Splunk Search Processing Language (SPL). See how to use Splunk's simple search language for searching and filtering through data, charting statistics and predicting values, converging data sources and grouping transactions, and finally data science and exploration. We'll begin with basic search commands and build up to more powerful advanced tactics to help you harness your SplunkFu!

1. © 2017 SPLUNK INC.
The Power of SPL
Samuel Vogel | Sr. Sales Engineer
MAY 2017 | ZURICH

2. © 2017 SPLUNK INC.
2
Disclaimer
During the course of this presentation, we may make forward looking statements
regarding future events or the expected performance of the company. We caution you
that such statements reflect our current expectations and estimates based on factors
currently known to us and that actual events or results could differ materially. For
important factors that may cause actual results to differ from those contained in our
forward-looking statements, please review our filings with the SEC. The forward-
looking statements made in the this presentation are being made as of the time and
date of its live presentation. If reviewed after its live presentation, this presentation
may not contain current or accurate information. We do not assume any obligation to
update any forward looking statements we may make.
In addition, any information about our roadmap outlines our general product direction
and is subject to change at any time without notice. It is for informational purposes
only and shall not, be incorporated into any contract or other commitment. Splunk
undertakes no obligation either to develop the features or functionality described or to
include any such feature or functionality in a future release.

3. © 2017 SPLUNK INC.
3
Agenda
Overview & Anatomy of a Search
– Quick refresher on search language and structure
SPL Commands and Examples
– Searching, charting, converging, mapping,
transactions, anomalies, exploring
Dashboard Montgomery County Traffic Violations
3

4. © 2017 SPLUNK INC.
Splunk overview

5. © 2017 SPLUNK INC.
5
SPL Overview
Over 140+ search commands
Syntax was originally based upon the Unix pipeline and SQL
and is optimized for time series data
The scope of SPL includes data searching, filtering, modification,
manipulation, enrichment, insertion and deletion
Includes anomaly detection and machine learning
5

6. © 2017 SPLUNK INC.
6
Why Create a New Query Language?
Flexibility and
effectiveness on
small and big data
6

7. © 2017 SPLUNK INC.
7
Why Create a New Query Language?
Flexibility and
effectiveness on
small and big data
Schema at Read
7

8. © 2017 SPLUNK INC.
8
Why Create a New Query Language?
Flexibility and
effectiveness on
small and big data
Schema on the Fly
More/better methods
of correlation
8
Data

9. © 2017 SPLUNK INC.
9
Why Create a New Query Language?
Not just analyze,
but visualize
9
Data
BIG Data

10. © 2017 SPLUNK INC.
10
Why Create a New Query Language?
Not just analyze,
but visualize
New Custom
Visalisations
10
Data
BIG Data

11. © 2017 SPLUNK INC.
11
search and filter | munge | report | cleanup
| rename sum(PrxyLgKB) AS "Total KB" dc(ASA_NAT_clientip)
AS "Unique Customers"
| eval KB=bytes/1024
sourcetype=access*
| stats sum(PrxyLgKB) dc(ASA_NAT_clientip)
SPL Basic Structure
11

12. © 2017 SPLUNK INC.
SPL - Examples

13. © 2017 SPLUNK INC.
13
SPL Examples and Recipes
Find the needle in the haystack
Charting statistics and predicting values
Enriching and converging data sources
Map geographic data in real time
Transactions
Data exploration & finding relationships between fields
Custom Commands
13

14. © 2017 SPLUNK INC.
14
Demo
Explanation of Startpage
http 503 Service unavailable
http 503 != webserver 2
Bytes - eval Fieldcreation
Stats Calculate and transform
Sparkline by Clientip , sort
Inlinesearch
Introduction Montgomery county Data
Geostats
Dashboard

15. © 2017 SPLUNK INC.
15
Stats, Timechart, Eventstats, Streamstats
15

16. © 2017 SPLUNK INC.
SPL - Examples

17. © 2017 SPLUNK INC.
17
Machine Learning Toolkit and Showcase
Examples
• Predict Numeric Fields
• Predict Categorical Fields
• Detect Numerical Outliers
• Detect Categorical Outliers
• Forecast Time Series
• Cluster Events
17

18. © 2017 SPLUNK INC.
18
Custom Commands
What is a Custom Command?
– “| haversine origin="47.62,-122.34" outputField=dist lat lon”
Why do we use Custom Commands?
– Run other/external algorithms on your Splunk data
– Save time munging data (see Timewrap!)
– Because you can!
Create your own or download as Apps
– Haversine (Distance between two GPS coords)
– Timewrap (Enhanced Time overlay)
– Levenshtein (Fuzzy string compare)
– Base64 (Encode/Decode)
18

19. © 2017 SPLUNK INC.
19
Just Getting Started!
Splunk Search Quick Reference Guide
19

20. © 2017 SPLUNK INC.
20
For More Information
Additional information can be found in:
– Power Of SPL App!
– Search Manual
– Blogs
– Answers
– Exploring Splunk
20

21. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
THANK YOU

22. © 2017 SPLUNK INC.
Take the Survey on Pony Poll
ponypoll.com/zurich2017