About this document

Splunk Search Under the Hood Guide by alphabitic Razandrimanjaka is a document available to read on EtoBox.

Here is the lispy expression for searching the web server data where the source port is 1062: (search index=web sourcetype="linux_secure" src_port=1062) Scenario: Optimize the search to return only the src_ip, src_port, and action fields. Task 3: Optimize the search expression. 12. Click on the lispy expression from the previous step and modify it to return only the src_ip, src_port, and action fields. (search index=web sourcetype="linux_secure" | fields src_ip src_port action) Scenario: Use th

Author

alphabitic Razandrimanjaka

Language

EN