These results are piped into the eval command, which uses the cidrmatch() function to compare the IP addresses to a subnet range (192.0.0.0/16). This example searches for Web access data and uses the dedup command to remove duplicate values of the IP addresses ( clientip) that access the server. Sourcetype=access_* | dedup clientip | eval network=if(cidrmatch("192.0.0.0/16", clientip), "local", "other") | table clientip, network Search for IP addresses and classify the network they belong to. Then, run this search using the time range, All time. Download the data set from the Add data tutorial and follow the instructions to get the sample data into your Splunk deployment. This example just illustrates how the table command syntax allows you to specify multiple fields using the asterisk wildcard.Įxample 3 This example uses the sample dataset from the tutorial but should work with any format of Apache Web access log. (The table command doesn't let you rename or reformat fields, only specify the fields that you want to show in your tabulated results.)įinally, it pipes the results into the table command and specifies both coordinate fields with lat*, lon*, the magnitude with mag, and the date and time with time. Then it pipes these events into the rename command to change the names of the coordinate fields, from lat and lon to latitude and longitude. This example begins with a search for all recent earthquakes in Northern California ( Region="Northern California"). Index=usgs_* source=usgs place=*California | rename lat as latitude lon as longitude | table time, place, lat*, lon*, mag Show the date, time, coordinates, and magnitude of each recent earthquake in Northern California. The data is a comma separated ASCII text file that contains magnitude (mag), coordinates (latitude, longitude), region (place), etc., for each earthquake recorded. This simply reformats your events into a table and displays only the fields that you specified as arguments.Įxample 2 This example uses recent earthquake data downloaded from the USGS Earthquakes website. Index=usgs_* source=usgs place=*California | table time, place, mag, depth Search for recent earthquakes in and around California and display only the time of the quake ( Datetime), where it occurred ( Region), and the quake's magnitude ( Magnitude) and depth ( Depth). You can download a current CSV file from the USGS Earthquake Feeds and add it as an input to your Splunk deployment. If truncate_report is set to 0, the max_count parameter is not applied.Įxamples Example 1 This example uses recent earthquake data downloaded from the USGS Earthquakes website. The number of results is controlled by the max_count parameter in the stanza. In the stanza, if the value for the truncate_report parameter is 1, the number of results returned is truncated. The table command truncates the number of results returned based on settings in the nf file. If you're going to rename a field, do it before piping the results to table. The table command doesn't let you rename fields, only specify the fields that you want to show in your tabulated results. If you are looking for a streaming command similar to the table command, use the fields command. The table command is a non-streaming command. To generate visualizations, the search results must contain numeric, datetime, or aggregated data such as count, sum, or average. The table command is a transforming command. For example, if you want to specify all fields that start with "value", you can use a wildcard such as value*. You can use the asterisk ( * ) as a wildcard to specify a list of fields with similar names. The list can be space-delimited or comma-delimited. Description: A list of valid field names. With the exception of a scatter plot to show trends in the relationships between discrete values of your data, you should not use the table command for charts. Use table command when you want to retain data in tabular format. The table command is similar to the fields command in that it lets you specify the fields you want to keep in your results. Columns are displayed in the same order that fields are specified. The table command returns a table that is formed by only the fields that you specify in the arguments.
0 Comments
Leave a Reply. |