I was just wondering if the commas in this search are just to aid readability of the code, or if they are important to the functioning of the search.
Also, what is the function of the period in between "AllChanges" and "AccountManagement.srcntdomain".
Thank you for your help!
The commas are for readability (you can substitute w/space) and the periods could be to represent data hierarchy. So, AllChanges.src could mean the src node under AllChanges. This is applicable when your orginal data is represented either in JSON or XML format
Great thank you for your answer!
is the same as: AllChanges.src AllChanges.AccountManagement.srcntdomain AllChanges.user
So does that mean that there is an implied "AND" where the commas are? I recall learning that there is an implied AND between terms with spaces. Or is that only true regarding functions or commands?
Also, I found a definition on the Splunk website that stated that the definition for: All_Changes.src was: The resource where the change was originated. I'm not really sure what change that is talking about. My original search query was:
| tstats `summariesonly` count from datamodel=Change_Analysis where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.src,All_Changes.Account_Management.src_nt_domain,All_Changes.user | sort 100 - count | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Account_Management")`
I think that the line I originally posted summarizes the statistics I'm getting with the tstats function but I'm not sure how it's summarizing the data as I don't have access to Splunk right now.
Thank you for all your help!
One last thing,
What does the -- All_Changes.result="lockout" -- do?
Thank you so much for your help!
All_Changes.result="lockout" filters all events in the datamodel where the value for
result attribute in the datamodel called 'All_Changes" is "lockout"