Knowledge Object Explorer

Splunk Community

Knowledge Object Explorer

Knowledge Object Explorer
The Knowledge Object Explorer helps you understand how Splunk turns a search and your configured knowledge objects into a normalized search. You get a tree visualization for the tags, eventtypes, reverse lookups, fields, field aliases, calculated fields, and plain strings that appear in your search after expansion. For a quick dive into your environment, the Browse page parses all Tags, Event Types, and Data Model Objects for their normalizedSearch length letting you explore and optimize the worst offenders first. This is the companion app to my .conf 2015 talk 'Optimizing Splunk Knowledge Objects', the session includes lots of search expansion background information and some demos of the Knowledge Object Explorer. A note on Splunk Enterprise 6.6: While the Knowledge Object Explorer does work with 6.6, it does not mirror the litsearch optimization attempts built into 6.6.
1 topic and 0 replies mentioned Knowledge Object Explorer in
Latest Topics
Latest Replies
No posts to display.
Top Topics
My Topics
No posts to display.