Detail kurzu

Multivalue Fields

EDU Trainings s.r.o.

Popis kurzu

This three-hour course is for power users who want to become experts on searching and manipulating multivalue data. Topics will focus on using multivalue eval functions and multivalue commands to create, evaluate, and analyze multivalue data.

Obsah kurzu

Topic 1 – What are Multivalue Fields?

Understand multivalue fields
Understand multivalue fields
Define self-describing data
Understand how JSON data is handled in Splunk
Use the spath command to interpret self-describing data
Use the mvzip and mvexpand commands to manipulate multivalue fields
Convert single-value fields to multivalue fields with specific commands and functions

Topic 2 – Creating Multivalue Fields

Create multivalue fields with the makemv command and the split function of the eval command

Topic 3 – Evaluating Multivalue Fields

Use the mvcount, mvindex, and mvfilter eval functions to evaluate multivalue fields

Topic 4 – Manipulating Multivalue Data

Use the mvsort, mvzip, mvjoin, mvmap, and mvappend eval functions and the mvexpand command to analyze multivalue data
Certifikát Na dotaz.
Hodnotenie




Organizátor



Ďalšie termíny kurzu
Termín Cena Miesto konania Zarezervovať