Splunk Search

What is the best way to learn and master Splunk searches?

Contributor

What is the best way of mastering the Splunk development in terms of writing splunk searches and other development in Splunk?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Basically it boils down to one thing: experience

However, there is different ways to get it.

  • Do it. Build lots of searches, fail miserably, learn, improve, fail harder, learn more.
  • The Advanced Searching and Reporting course. I learned a bunch of really good tips there, it's definetely worth the time/money.
  • Stick around in the community. Here on Answers, on Slack, etc. People will post their problems, and you can either try to solve them, or you can just observe and listen how more experienced people will do that. I'd consider this a really good way, because you don't need to make EVERY mistake by yourself - let others make them and learn from it. 😉
  • There are some really good .conf presentations, take a look at those slides.

Hope that helps you!

View solution in original post

SplunkTrust
SplunkTrust

Read About Search Optimization Documentation, specially, Write Better Searches

Also check out Best Practices in Splunk .conf Sessions (PS: I have given 2017 .conf session link, however, you can get the .conf Archive Search App from Splunkbase for searching across various years of .conf Sessions which gets updated every year.

If you intend to use Post Processing you can check out Post Processing Best Practices

If you are using lookup command/geostats/iplocation etc you should see the feasibility of using transforming command first ollowed by the lookup. Refer to documentation on Lookup Optimization.

Once your searches/reports/dashboard/alerts start to get into shape, start using as many Knowledge Objects as possible for easy re usability and maintenance of code.

In order to improve performance of Report/Dashboard/Data Model use Summary Indexing based acceleration.

Above all I would agree to what everyone have mentioned about Splunk Answers. Just spend an hour or go through 10-15 questions here daily and you will learn a lot from what tips and tricks that community experts have hidden under their sleeves. I learn something new almost every day 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Contributor

Just wanted to accept all as answers 🙂

SplunkTrust
SplunkTrust

You can only accept one, but you can upvote as many as you like 😉

Esteemed Legend

The best way is to participate in this forum. Pick a few good answerers (the top 10 is a good place to start) and follow them. Also start trying to answer questions and try for ones that are just beyond your grasp. Review the answers with the most votes and the answers to the questions with the most votes. Tear apart the answers, pipe-by-pipe and see how each one works. Get experience by living through the experience of others, then get your own by contributing your own answers.

Contributor

I think its kinda trickier question to answer .

The best way might to understand what each command does and trying them on the example data makes you better .

Contributor

where do you get the example data?

0 Karma

SplunkTrust
SplunkTrust
0 Karma

Contributor

You need to get well with evengen app which generates example data

https://splunkbase.splunk.com/app/1924/

0 Karma

SplunkTrust
SplunkTrust

Basically it boils down to one thing: experience

However, there is different ways to get it.

  • Do it. Build lots of searches, fail miserably, learn, improve, fail harder, learn more.
  • The Advanced Searching and Reporting course. I learned a bunch of really good tips there, it's definetely worth the time/money.
  • Stick around in the community. Here on Answers, on Slack, etc. People will post their problems, and you can either try to solve them, or you can just observe and listen how more experienced people will do that. I'd consider this a really good way, because you don't need to make EVERY mistake by yourself - let others make them and learn from it. 😉
  • There are some really good .conf presentations, take a look at those slides.

Hope that helps you!

View solution in original post