Summary

This wraps up the chapter on searching with Splunk. We've covered the Splunk Web interface, how to create basic Splunk searches, and how to create filters to reduce the result set to just the events we're interested in. We then discussed various search commands that can be used to create new calculated fields from the existing fields in the events, commands to manipulate and format the datasets, and how to visualize the results in tables and charts. Finally, we reviewed how to inspect and optimize the performance of our search commands. In the next chapter, we'll cover Splunk knowledge objects to supplement, enhance, and provide even more value to our data.