RSS

Posts in 2020

  • Troubleshooting Splunk Search Performance by Search Job Inspector

    Last Update: in Splunk

    How to use Splunk Search Job Inspector to troubleshooting search performance issue, understand how search was processed and where splunk spent time.

    Splunk timechart Command – Overview timechart command performs statistical aggregations against time Plots and trends data over time _time is always the x-axis You can optionally split data using the by clause for one other field Each distinct value …

    Read more

  • Troubleshooting Splunk Search Performance by Search Job Inspector

    Last Update: in Splunk

    How to use Splunk Search Job Inspector to troubleshooting search performance issue, understand how search was processed and where splunk spent time.

    What is Search Job Inspector The Search Job Inspector and the Job Details dashboard are tools that let you take a closer look at what your search is doing and see where the Splunk software is spending most of its time. Search Job Inspector allows you …

    Read more

  • Splunk != vs. NOT Difference Detail Explained with Examples

    Last Update: in Splunk

    Different between != and NOT in Splunk search condition, search result and performance impact. How to exclude field from search result?

    When you want to exclude results from your search you can use the NOT operator or the != field expression. However there is a significant difference in the results that are returned from these two methods. != vs. NOT Comparison Both!= field …

    Read more

  • Splunk Search Best Practices for Better Performance Response Time

    Last Update: in Splunk

    Tips on splunk search best practices for better performance response time. Guidelines on create splunk search.

    Splunk search best practices, a quick guideline on splunk search, write better search to improve your search quality and boost query time. Notes from Splunk Fundamentals. Time is the most efficient filter keep the time range short (e.g. last 60 …

    Read more

  • Install Splunk and Forwarder on Linux

    in Splunk

    Step by step install Splunk, Splunk Forwarder, Splunk app free trial version on Linux.

    Install Splunk Download from https://www.splunk.com/en_us/download/splunk-enterprise Download Splunk 8 via Command Line (wget): # .deb For Debian and Ubuntu $ wget -O splunk-8.0.3-a6754d8441bf-linux-2.6-amd64.deb …

    Read more