- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Splunk search query examples
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am new to splunk and was wondering if anyone has a document they don't mind sharing detailing "example search queries" as a starting point? any help would be appreciated. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Ghanayem1974, you can refer to Splunk Search Tutorial with mock data and step by step instruction for creation of Splunk Dashboard.
http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/AboutgettingdataintoSplunk
For various Splunk Commands and Examples, you can refer to Splunk Documentation itself which are listed on the left side. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search
For starting with creation of dashboards with examples you can refer to Splunk Dashboard Examples App from Splunkbase: https://splunkbase.splunk.com/app/1603/
You should also go through Splunk Search Fundamentals 1 course for learning Splunk https://www.splunk.com/view/SP-CAAAPX9
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'll self promote here. Sorry, not sorry.
Go check out https://gosplunk.com for a repository of queries shared by a bunch of users.
Another site bbosearch has a few queries as well.
~Joe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In addition to the course
why do not you start with getting data in and do things practically with the help of this beautiful doc:
http://docs.splunk.com/Documentation/Splunk/7.0.1/Search/GetstartedwithSearch
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Ghanayem1974, you can refer to Splunk Search Tutorial with mock data and step by step instruction for creation of Splunk Dashboard.
http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/AboutgettingdataintoSplunk
For various Splunk Commands and Examples, you can refer to Splunk Documentation itself which are listed on the left side. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search
For starting with creation of dashboards with examples you can refer to Splunk Dashboard Examples App from Splunkbase: https://splunkbase.splunk.com/app/1603/
You should also go through Splunk Search Fundamentals 1 course for learning Splunk https://www.splunk.com/view/SP-CAAAPX9
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I suggest looking at the Splunk Fundamentals 1 course, which is free:
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
