That is with a first menu.
The second is the format.
One is the rule number.
It is.
Most of these are self-explanatory.
If I click on no, the row numbers are off.
As you can see, beginning stage, they don't seem to have any value or add any value during your analysis,
but probably it might add value for a few of the people who want to keep track of this how many events
have occurred during this window.
But there are much better ways of fetching those information.
That is row number.
I'll disable it.
There are results.
It's self explanatory.
Like it's like any text editor to wrap the logs or not.
If the logs are too lengthier, it will be wrapped something like this.
See, it has been wrapped into three lines, but still it is a single line event.
To the max lines to display by default.
It is violence.
If you want, you can choose and at any time, if you are not able to see more than five lines, all
you are to do is there will be a expand option here if you have larger events which are more than three
lines as of now, we don't have any.
So there will be a expand option here.
You can expand to see the full event.
Even drill down.
There is something called full, inner and outer.
You can choose how to drill down the events.
It's like selecting these events.
It is like if I click now, it will update.
User is equal to admin in my search query.
That is my full.
Let's see here.
It selects only individual fields.
If I select full it selects the complete user is equal to admin wherever I move the cursor across until
the next field.
But whereas outer it is like wherever I click it selects the complete field.
As you can see, if I put even in between the complete text, it selects the full one, whereas the
full it selects the cursor from the place where I start until where I end in the next field.
That is with this menu and a number of events to display.
It will start from ten and it can increase up to 50 if you want to see more events in your.
So speed.
And if you come to our left fields, you can see there are two columns.
One is hide fields.
It can hide and give you more space to view the events and show fields which will pop it back again.
So there are all fields which leads to all the extracted fields.
And sometimes if you are not able to find your field in this, make sure you are selecting all fields
because 1% of the values or the presents in the logs, let's say I'm having 100 events and my field
is in just one event.
It will be hidden from this so that you need to make sure you select all fields to even identify those
1% of the fields.
There are two columns in this.
One is selected fields and interesting fields.
The selected fields, as we discussed it, will be displayed right under your events.
In the list view of the events and the interesting fields are the auto extracted or manually extracted
fields from the Splunk Admin or Splunk RTT to designing this and extracted this information and made
it available.
These interesting fields are extracted from the logs and Splunk.
As auto extracted as of now these logs and you can make them make them as selected field by clicking
on this link.
One more key piece of information is you can see on the field's left side, there is something named
as a asterisks.
It's not Asterix upon Tyne and Asterix.
On the right side, there are numerical numbers.
What it represents is if you see an A.
It is represents the field value is the alpha numeric value.
That means it contains a number and alphabets.
Whenever you see alpha right next to the field, it is represented or it is understandable that it is
the alpha numerical value.
If you see source, type this audit trail here it says.
Just alphabetical value.
But even if you have a number, it works.
So that is one way of saying that it can handle alphanumeric values.
Similarly source.
Similarly Host Host probably might be the best example here because it has the numbers along with Alpha
Alphabet, which are as part of the host name.
If you see some other fails like date underscore time, M, de and R, these are numeric values that
these fields will never have alphabetical values by the name.
It is clear that these are the date fields.
But to understand what this s symbol or.
Alpha numeric symbol means this represents the acceptable field values that it can handle.
On the right side, there is some digits that are represented.
These represent unique values.
Can say data underscore second.
That means it has 60 values.
Of course, each meaning to 60 seconds starts from 0 to 59.
So it has 60 unique values and it is present in almost all the events that will be part of all the events
that says its it is existing in 100% of the event.
From this field's menu, you'll get feel, name and distinct values and the percentage coverage of events
that are we got from our search results.
We'll see the reports menu where it shows the quick options to create visualization.
Let me say top values of the second.
It will give me automatic visualization.
See, by default it is saying to use a bar chart.
If you click on bar chart, you'll get other recommended views.
If you look.
Either visualization.
If it fits you can use what always stick with the recommendation for a better.
Presentation because it already knows what kind of data is available for presenting, so it shows probably
the best values to display.
These are some of the options.
Which you can pick out from the Splunk Web interface.
As I already informed, you'll be getting access to Splunk demo session as a part of the complete package
purchase of this tutorials.
Try to get into the package deal and you'll have access to 30 days.
You can play around with your instance.
You'll have kind of dedicated instance.
You can search, create visualization, create alerts, report all this stuff, and you can probably
even practice your.
Search queries.