Detail kurzu
Multivalue Fields
EDU Trainings s.r.o.
Popis kurzu
This three-hour course is for power users who want to become experts on searching and manipulating multivalue data. Topics will focus on using multivalue eval functions and multivalue commands to create, evaluate, and analyze multivalue data.
Obsah kurzu
Topic 1 – What are Multivalue Fields?Understand multivalue fields
Understand multivalue fields
Define self-describing data
Understand how JSON data is handled in Splunk
Use the spath command to interpret self-describing data
Use the mvzip and mvexpand commands to manipulate multivalue fields
Convert single-value fields to multivalue fields with specific commands and functions
Topic 2 – Creating Multivalue Fields
Create multivalue fields with the makemv command and the split function of the eval command
Topic 3 – Evaluating Multivalue Fields
Use the mvcount, mvindex, and mvfilter eval functions to evaluate multivalue fields
Topic 4 – Manipulating Multivalue Data
Use the mvsort, mvzip, mvjoin, mvmap, and mvappend eval functions and the mvexpand command to analyze multivalue data
Certifikát
Na dotaz.
Hodnotenie
Organizátor
Podobné kurzy
podľa názvu a lokality