Translating Business Requirements into Syntax

[therevenant]

If you were to query the following:

the total number of quarantined files for a particular End point software

What does that translate to you syntax wise?

[richgalloway]

That's not a business requirement. It's not even a full sentence. Go back and ask the stakeholder to clarify.

[therevenant]

I guess at this point, it would be useful in getting your insight.
If you want to understand a new splunk environment, what are things you look for? What searches do you generally perform?

index=* | stats values(index)
sourcetype=* |stats values(sourcetype)

What else?

[richgalloway]

Splunk has an entire document dedicated to understanding a new Splunk environment. See https://docs.splunk.com/Documentation/Splunk/7.2.3/InheritedDeployment/Introduction.

[therevenant]

If you wanted to search for quarantined files though, how is that queried through Splunk?

[richgalloway]

It depends on how information about quarantined files is stored in Splunk.