Let's continue with our discussion of understanding the Splunk Web interface.
So now this is a basic search, as we all know.
It is searching for its local audit logs.
After this, there is an event that is selected, these many events, and below that there is something
called timeline.
This timeline is nothing like Facebook timeline.
This is a different timeline where it shows distribution of events over the selected 60 minute window.
If we see selected 60 minute window for the half of the duration, there are no events.
That means my Splunk instance was down.
There was no events because my Splunk instance was on after 30 minutes.
I bought it up from then these many audit events in my log and it has been distributed over a period
of like.
Every minute.
In the last 60 minutes.
This scale is auto calculated based on the time period you choose.
We choose for 30 days each bar represents.
One day we choose 60 minute, each bar represents one minute.
If we choose 15 minutes, probably less.
It is also calculated by plan to fit it in your browser screen so that the events are spread across
from the beginning to end within this timeline.
This timeline.
If you click on one of the bar.
Everything changes.
You can see there are a total of 3000 786 events, but the selected are 385.
That means at this minute there was high number of events from the longer.
But we can see that.
There were a lot of activity.
The 385 events are only during this minute.
If I click that, it will display only events related to that time.
So if I want to come out, I need to click on the select.
And if you want to select some other time frame using the timeline, you can select and you can zoom
to selection so that it will just zoom in and display only those events and it will be spread across
multiple mode.
So it says total timeline is one minute.
So this one minute has been split across based on milliseconds.
This is how it works.
Let me zoom out.
Now we are back to a last 60 minute search.
Now we understand how to use the timeline.
Let us go one step below.
There are three different venues below that timeline.
These are called the Events Menu.
All these three conditions are part of this event's menu where you can use to modify this view or settings.
Here there is a list option by default selected.
If you choose raw, you can see there will be a change in this display.
If you see it all.
These are the actual locks that are being received from your remote data sources.
This remote data sources are sending this information to Splunk and it is passing this information.
If this is the raw log file, if you extract this ISO or if you go to your remote machine and check
the logs, this is how it will be.
It will be a plain text and it will be every line.
But similar to this, if you click on list, it shows.
You would actually log file along with time.
And along with three fields displayed below, it says host source and source type.
Host source and source type are by default known as selected fields for all data sources in Splunk.
Whichever you are integrating, either it can be a scripted database or.
Windows machine, exchange servers, Linux machine, syslog server.
These three fields are mandatory and by default these three fields will be selected.
When you say selected fields, they will be displayed right next to your event in the list form.
If you click on table.
It will be displaying the time and the selected fields as part of table.
It will not display your complete events until you expand.
So if you expand any event, you'll be able to see the complete event and the fields which it contains.
Let me minimize this.
We are the selected fields.
Let's say I need to add one of these fields into selected fields.
So how can I add that?
It's simple.
Just click on actions.
There is selected or no.
I'll click on as it will be auto updated and you can see my action fields starts populating as in the
table.
If you don't want table, you can select list.
It will come back to a default view where audit it shows the complete logs and selected fields as part
of the next line.