Splunk Search

What are the functions of commas and periods in the Splunk search language?

Justin1224
Communicator

I was just wondering if the commas in this search are just to aid readability of the code, or if they are important to the functioning of the search.

All_Changes.src,All_Changes.Account_Management.src_nt_domain,All_Changes.user

Also, what is the function of the period in between "All_Changes" and "Account_Management.src_nt_domain".

Thank you for your help!

1 Solution

sundareshr
Legend

The commas are for readability (you can substitute w/space) and the periods could be to represent data hierarchy. So, All_Changes.src could mean the src node under All_Changes. This is applicable when your orginal data is represented either in JSON or XML format

View solution in original post

sundareshr
Legend

The commas are for readability (you can substitute w/space) and the periods could be to represent data hierarchy. So, All_Changes.src could mean the src node under All_Changes. This is applicable when your orginal data is represented either in JSON or XML format

Justin1224
Communicator

Great thank you for your answer!

So All_Changes.src,All_Changes.Account_Management.src_nt_domain,All_Changes.user
is the same as: All_Changes.src All_Changes.Account_Management.src_nt_domain All_Changes.user

So does that mean that there is an implied "AND" where the commas are? I recall learning that there is an implied AND between terms with spaces. Or is that only true regarding functions or commands?

Also, I found a definition on the Splunk website that stated that the definition for: All_Changes.src was: The resource where the change was originated. I'm not really sure what change that is talking about. My original search query was:

| tstats `summariesonly` count from datamodel=Change_Analysis where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.src,All_Changes.Account_Management.src_nt_domain,All_Changes.user | sort 100 - count | `drop_dm_object_name("All_Changes")` |  `drop_dm_object_name("Account_Management")`

I think that the line I originally posted summarizes the statistics I'm getting with the tstats function but I'm not sure how it's summarizing the data as I don't have access to Splunk right now.

Thank you for all your help!

Justin1224
Communicator

One last thing,

What does the -- All_Changes.result="lockout" -- do?

Thank you so much for your help!

0 Karma

sundareshr
Legend

All_Changes.result="lockout" filters all events in the datamodel where the value for result attribute in the datamodel called 'All_Changes" is "lockout"

Justin1224
Communicator

Ok great thank you very much.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...