Statistical Processing (SSP)

Voraussetzungen

To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge:

• Intro to Splunk
• Using Fields (SUF)
• Visualizations
• Working with Time (WWT)

Zielgruppe

• Users/Analysts
• Administrators
• Engineers

Detaillierter Kursinhalt

Module 1 - What is a Data Series

• Introduce data series
• Explore the difference between single-series, multi-series, and time series data series

Module 2 - Transforming Data

• Use the chart, timechart, top, rare, and stats commands to transform events into data tables

Module 3 – Statistical Aggregation with the stats Command

• Define aggregation
• Explore the stats command and eight of its functions

Module 4 – Manipulating Data with the eval Command

• Explore the eval command
• Explore and perform calculations using mathematical and statistical eval functions
• Perform calculations and concentrations on field values
• Use the eval command as a function with the stats command

Module 5 – Formatting Data

• Use the rename command
• Use the sort command