Hi, As per the query you posted, here is the possible solution I managed to get which you can follow-  Open your snort logs in the tool or platform you are using for log analysis. Look for a feature or option that allows you to define custom extraction rules or create new fields based on the log data. This may vary depending on the specific tool you are using. Find the option to add a new field or define a custom extraction rule. Name the new field "Priority" or any desired name. Specify the extraction rule for the "Priority" field. In this case, you want to extract the string value. Depending on the tool, you may need to provide a regular expression or a pattern that matches the desired string. For example, you could use a pattern like Priority : (\d) to capture the priority value. Adjust the pattern as per your specific log format. Save the new field or extraction rule. Apply the newly created "Priority" field to your log analysis or visualization. Depending on the tool, you may need to re-run the analysis or refresh the visualization. Once the "Priority" field is applied, you should be able to generate a pie chart by searching for snort | top Priority. This should display the different priority values as distinct slices in the chart. By defining a custom extraction rule or field (https://docs.splunk.com/Documentation/Splunk/9.1.0/Data/Configureindex-timefieldextraction) for the priority value, you can ensure that it treats different values, such as "Priority : 3" and "Priority : 2", as separate entities rather than merging them into a single value. Note: The specific steps may vary depending on the log analysis tool or platform you are using. Please consult the documentation or support resources for your specific tool for more accurate instructions tailored to your environment. Also, this Splunk certification resource will help you understand it more better. ... View more

Hi, I have prepared some useful info for you. Go through all of these. Splunk certification can certainly help demonstrate your knowledge and understanding of the platform, but it's not the only factor that employers consider when hiring for Splunk administration positions. Other skills such as scripting, linux, networking, and data analysis can also be important, depending on the role and organization. You may want to consider enhancing your skills in these areas to increase your chances of securing an entry-level job in Splunk administration. To gain real-world experience with Splunk, you can explore the following options: Participate in online communities such as Splunk's community portal, Stack Overflow, and Reddit, where you can ask questions, participate in discussions, and share your knowledge with others. Try out real-world scenarios using the free trial version of Splunk to practice setting up data sources, creating dashboards, and searching data. Contribute to open-source projects that use Splunk, or find volunteer opportunities that allow you to work with the platform. Consider enrolling in online Splunk Training, courses or taking part in online workshops to further enhance your skills. In terms of which certifications to aim for first, the following may be a good starting point: Splunk Fundamentals, Part 2 Splunk Core Certified User Splunk Power User Splunk Certified Admin Good luck in your journey back to the technology field!     Thanks ... View more

Buckets start rolling when they reach a specific size or age, whichever comes first. You must set the size restriction high enough so that it is not a consideration in order to make time the only determining factor. It is advantageous if your hot buckets are set up to just hold one day's worth of data. Splunk does not manage frozen buckets. When they are eliminated, you decide (using cron, etc.).   I hope, it matches your requirements. Thanks ... View more