Fields are searchable key/value pairs in your event data Fields can be searched by their name, for example: area_code=404 action=purchase status=200 When you look for multiple items in the editor an implied AND will be implied unless specified otherwise (AND, OR, NOT) to the search as follows action=purchase AND status=200 Field Discovery Splunk automatically discovers […]
Splunk Series: Field searches Read More »
Every search is also a job, which can be paused, stopped, saved and exported. Here are some interesting things you need to know about Search jobs: Jobs are available for 10 Minutes (By Default) Jobs can have the following permissions as part of the configuration when they are saved Private – Only the creator can
Splunk Series: Saving Search Jobs Read More »
Basic search The search assistant provides a nice way to begin looking up for something in particular. At this stage, you can determine a few different search criteria, such as a term in particular or search directly into a specific Index. The search assistant lets you be flexible and presents you with different options. Before
Splunk Series: Basic Search Read More »
Splunk Index Time Process Data ingestion for Splunk is broken down into 3 different phases Input Phase – Data is handled at the source and is usually done by a forwarder Parsing Phase – Handled by the indexer or Heavy Forwarders, the data is broken into events Indexing Phase – The license meter runs as
Splunk Series: Feeding Data to Splunk Read More »
Addition Splunk Components There are additional components for a Splunk deployment, here is a list Deployment Server Cluster Master License Master Standalone Deployment This deployment is only in 1 server, and all functions needed for this deployment reside on the same server Searching Indexing Parsing Input It is recommended to have 1 test or dev
Splunk Series: Splunk Deployments Read More »
Splunk – Indexer This is the engine that is in charge of processing machine data, stores the results in indexes as events. This is what allows enabling fast searches and analysis As data is indexed, Splunk creates files organized in sets of directories by age. Splunk – Search Head Splunk has its own Search language,
Splunk Series: Components Read More »
What is Splunk Splunk is many things to different groups in an organization, but mostly is an engine that looks you to visualize data in a way that could be understood by the business, what are few of the things that Splunk can help with: Application Management Operations Management Security and Compliance Splunk allows you
Splunk Series: Overview of Splunk Read More »
As with any certification that I attempt I go into it with a mindset of learning by reading, watching videos and doing… Being doing the strongest one in my list of things to do. I want to make sure all the things that I have seen listed in the PCNSE Study Guide I can do,
As the new year hits, I have new resolutions, and these entail getting my feet wet with Palo Alto Networks, due to my job and many other factors I’m open to learning and get certified on the PCNSE, which stands for Palo Alto Networks Certified Network Security Engineer The Certification Requirements This exam contains 75
Palo Alto Networks – PCNSE Certification – Part 1 – Breaking down the Exam Objectives Read More »
I turned my lab back on!!, and guess what, it was a mess, I lost my vCenter server and well… I’ll stop complaining and jump back into the substance of this post. Previous steps after losing the Host I had vCenter on If this has happened to you either in production or in a lab
Upgrading ESXI from 6.5 to 6.7 Read More »
