Power of Splunk Search Processing Language (SPL)

Editor's Notes

• #2: This presentation has some animations and content to help tell stories as you go. Feel free to change ANY of this to your own liking! I found it is best to pre-load all of the demo dashboards with the search examples instead of clicking on each picture (link to the search) from the slides and moving between the PowerPoint presentation and a Splunk demo instance too frequently. I would definitely practice your flow once or twice before a presentation. There is A LOT of content to get through in 1 hour. The slides with search examples can be unhidden if needed. Here is what you need for this presentation: You should have the following installed: 6.3 Overview App - https://splunkbase.splunk.com/app/2828/ OI Demo 3.1 – Get it from box: https://splunk.box.com/s/vlt3qve9hmil8gsgxjouizjceu8h33uf Optional: Splunk Search Reference Guide handouts Mini buttercups or other prizes to give out for answering questions during the presentation
• #3: Safe Harbor Statement
• #4: Add your own About Me info, if you want to include.
• #5: Disclaimer: What this class is vs. what it is not? - This class is meant to showcase examples of the Splunk Search Processing Language. We’ll go through basic steps of how to use a few of commands, but for the most part it is meant to demo, however you can learn much more in depth by enrolling in the Basic and Advanced Search and Reporting classes or read up on the docs online. Don’t worry - anything you see I’ll provide references and the examples will be available for d/l after the session. Opening Tell for each Agenda Item: What and why is it important? Anatomy of a Search: - First we’ll do a quick refresher on the anatomy of a search and why it’s useful. It’s important to understand the basic flow of the language and also the benefits of it. Examples of SPL: - Next we’ll show how both basic and more advanced search commands can be used to answer real world questions and build operation intelligence. In fact, we’ll breakdown a few of the searches in the Operational Intelligence demo you saw on the main stage. Additionally we’ll look at how SPL can help you explore new and complex data. In my opinion, this is an often overlooked and really powerful benefit of SPL. Custom Commands: - Lastly, I’ll show how to extend the Splunk search language using custom commands. This is also exciting due to the fact that the community has already made so many additions. Q&As: - And ofcourse we’ll finish with some Q & A’s. Time: (Total 60 min) Overview: 5 min Examples of SPL: 35 min Custom Commands 10 min Q & A: 10 min
• #7: “The Splunk search language has over 140+ commands, is very expressive and can perform a wide variety of tasks ranging from filtering to data, to munging or modifying, and reporting.” “The Syntax was …” “Why? Because SQL is good for certain tasks and the Unix pipeline is amazing!” This is great BUT… WHY WOULD WE WANT TO CREATE A NEW LANGUAGE AND WHY DO YOU CARE?
• #8: <Engage audience here.. Before showing bullet points ask “Why do you think we would want to create a new language?”> <Also Feel free to change pictures or flow of this slide..> -- have buttercups to throw out if anyone answers correctly? - Today we require the ability to quickly search and correlate through large amounts of data, sometimes in an unstructured or semi-unstructured way. Conventional query languages (such as SQL or MDX) simply do not provide the flexibility required for the effective searching of big data. Not only this but STREAMING data. (SQL can be great at joining a bunch of small tables together, but really large joins on datasets can be a problem whereas hadoop can be great with larger data sets, but sometimes inefficient when it comes to many small files or datasets. ) - Machine Data is different: - It is voluminous unstructured time series data with no predefined schema - It is generated by all IT systems– from applications and servers, to networks and RFIDs. - It is non-standard data and characterized by unpredictable and changing formats Traditional approaches are just not engineered for managing this high volume, high velocity, and highly diverse form of data. Splunk’s NoSQL query approach does not involve or impose any predefined schema. This enables the increased flexibility mentioned above, as there are No limits on the formats of data – No limits on where you can collect it from No limits on the questions that you can ask of it And no limits on scale Methods of Correlation enabled by SPL Time & GeoLocation: Identify relationships based on time and geographic location Transactions: Track a series of events as a single transaction Subsearches: Results of one search as input into other searches Lookups: Enhance, enrich, validate or add context to event data SQL-like joins between different data sets In addition to flexible searching and correlation, the same language is used to rapidly construct reports, dashboards, trendlines and other visualizations. This is useful because you can understand and leverage your data without the cost associated with the formal structuring or modeling of the data first. (With hadoop or SQL you run a job or query to generate results, but then you have need to integrate more software to actually visualize it!) “OK.. Let’s move on..”
• #9: “Let’s take a closer look at the syntax, notice the unix pipeline” “The structure of SPL creates an easy way to stitch a variety of commands together to solve almost any question you may ask of your data.” “Search and Filter” - The search and filter piece allows you to use fields or keywords to reduce the data set. It’s an important but often overlooked part of the search due to the performance implications. “Munge” - The munge step is a powerful piece because you can “re-shape” data on the fly. In this example we show creating a new field called KB from an existing field “bytes”. “Report” - Once we’ve shaped and massaged the data we now have an abundant set of reporting commands that are used to visualize results through charts and tables, or even send to a third party application in whatever format they require. “Cleanup” - Lastly there are some cleanup options to help you create better labeling and add or remove fields. Again, sticthing together makes it easier to utilize and understand advanced commands, better flow etc. Additionally the implicit join on time and automatic granularity helps reduces complexity compared to what you would have to do in SQL and excel or other tools. “Let’s look at some more in depth examples”
• #11: “In this next section we’ll take a more in depth look at some search examples and recipes. It would be impossible for us to go over every command and use case so the goal of this is to show a few different commands that can help solve most problems and generate quick time to value in the following area."
• #12: “We’ll start by looking at a few Search and Filter basics. Most searches begin here and it’s important to understand how to reduce your data set down to find what your looking for as well as optimal performance” <The way you present/demo is flexible. The slides can be used as a reference and backup when needed, otherwise you can do most of it in the demo itself> <<<< ALL PICTURES ARE LINKED TO THE SEARCHES IN SPLUNK to help going back and forth>>>>
• #13: Note how the search assistant shows the number of both exact and similar matched terms before you even click search. This can be very useful when exploring and previewing your data sets without having to run searches over and over again to find a result.
• #14: Additionally we can further filter our data set down to a specific host.
• #15: Lastly we can combine filters and keyword searches very easily. “This is pretty basic, but the key here is that SPL makes it incredibly easy and flexible to filter your searches down and reduce your data set to exactly what you’re looking for.
• #16: Remember Munging or Re-shaping our data on the fly? Talk about Eval and it’s importance sourcetype=access*|eval KB=bytes/1024
• #17: sourcetype=access* | eval http_response = if(status == 200, "OK", "Error”)
• #18: sourcetype=access*| eval connection = clientip.":".port
• #19: “There are tons of EVAL commands to help you shape or manipulate your data the way you want it.” Optional <Click on image to go to show and scroll through online quick reference quide>
• #20: Next we’ll talk about Splunk’s charting and statistical commands. Notes: Stats Timechart Trendline Predict Add streamstats and eventstats or keep simple?
• #21: There are 3 commands that are the basis of calculating statistics and visualizing results. Essentially chart is just stats visualized and timechart is stats by _time visualized. These SPL commands are extremely powerful and easy to use. “Let’s go through some examples – additionally we’ll make it more interesting and pull apart some searches and visualizations from one of the demo’s you saw on stage” <Go to IT Ops Visibility, click on Storage indicator> 1. Use Read/Write OPs by instance for STATS, bonus w/ sparkline 2. Use Read/Write OPs for TIMECHART
• #22: *Note these searches are from the latest OI Demo 3, if you don’t want to use OI Demo 3 you can switch back to sourcetype=access* and use the bytes field” <Go to IT Ops Visibility, click on Storage indicator> sourcetype=netapp:perf | stats avg(read_ops) AS Read_OPs
• #23: sourcetype=netapp:perf | stats avg(read_ops) AS Read_Ops sparkline(avg(read_ops) AS Read_Trend Can change out the avg with sum, min, max, etc. Sparkline is bonus option, can interchange with another statistical function but thought it might be fun to show.
• #24: sourcetype=netapp:perf | stats avg(read_ops) AS Read_Ops sparkline(avg(read_ops) AS Read_Trend by instance Final: sourcetype=netapp:perf | stats avg(read_ops) as Read_OPs sparkline(avg(read_ops)) as Read_Trend avg(write_ops) as Write_OPs sparkline(avg(write_ops)) as Write_Trend by instance
• #25: <Back to IT Ops Dashboard – Click on Netapp performance to start timechart example> Show difference between stats and timechart (adds _time buckets, visualize, etc.) Why is this awesome? We can do all of the same statistical calculations over time with almost any level of granularity. For example… <change timepicker from 60min to 15min, add span=1s to search and zoom in> Add below? Due to the implicit time dimension, it’s very easy to use timechart to visualize disparate data sets with varying time frequencies. SQL vs Timechart actual comparison?
• #26: Walk through trendline basic options
• #27: Walk through predict basic options “The timechart command plus other SPL commands make it very easy to visualize your data any way you want.”
• #28: “Again, don’t forget about the quick reference guide. There are many more statistical functions you can use with these commands on your data.”
• #29: Implicit join on time Appendcols Lookup Join – not sure if adding this yet?
• #30: Context is everything when it comes to building successful operational intelligence. When you are stuck analyzing events from a single data source at a time, you might be missing out on rich contextual information or new insights that other data sources can provide. Let’s take a quick look at a few powerful SPL commands that can help make this happen.
• #31: “Don’t forget that you already have an implicit join on time across all of your data sources. Without even using additional commands we can find insights just by looking at the simple frequency and patterns of data.” index=* http | timechart count by sourcetype
• #32: “Let’s look at another example from the Operational Intelligence demo, more specifically the Business Analytics dashboard.” “When operational issues arose the question was asked ‘Can we tell if our “high-value” customers are being impacted by these issues?” “Given a spreadsheet or database with customer information we can do just that by using lookups” <Show excel file of customer_info.csv> “Both our access_logs and customer information data have a user id that we can use as a key” “Just like that we can run real-time analytics on all of the fields from that data source!” “Lookups can be configured automatically so you don’t have to type them in everytime.” sourcetype=access_combined status=503 | lookup customer_info uid | stats count by customer_value
• #33: This is a more complex example, feel free to exchange this out with another “In this example we are going to be converging (or stitching together) multiple searches and use everything we’ve learned so far such as searching and filtering, creating fields, and using stats/timechart.” <Go to IoT Dashboard and show power graph> “While we are monitoring power usage by rack, maybe we want to be more proactive in the future and alert on significant deviations in power. To do this we’ll calculate the 2nd standard deviation of power usage in the past day, and compare it against our results in the past hour.” sourcetype=Kepware units=W row=A | timechart mean(Value) as mean_watts | appendcols [search earliest=-1d sourcetype=Kepware units=W row=A | stats stdev(Value) as hr_stdev] | eval 2stdv_upper = mean_watts + hr_stdev*2 | filldown 2stdv_upper | eval 2stdv_lower = mean_watts - hr_stdev*2 | filldown 2stdv_lower | fields - hr_stdev Might need to redo this example… is it simple enough? Also there is technically a more efficient way using eventstats (IF you are calculating the stdev over the same timerange as the search) .. In this case we are taking the daily stdev and appending that result Need to add JOIN? Talk about how there is a Join command, but many times don’t need it. Can usually use a simple OR instead, add this example when have time. Mention new Machine Learning App to detect and predict outliers
• #34: <Please feel free to add more complex transaction searches here. For now just using the very basic”
• #35: sourcetype=access* | transaction JSESSIONID
• #36: sourcetype=access* | transaction JSESSIONID | stats min(duration) max(duration) avg(duration)
• #37: NOTE: Many transactions can be re-created using stats. Transaction is easy but stats is way more efficient and it’s a mapable command (more work will be distributed to the indexers). sourcetype=access* | stats min(_time) AS earliest max(_time) AS latest by JSESSIONID | eval duration=latest-earliest | stats min(duration) max(duration) avg(duration)
• #38: Use Splunk 6.3 Overview App – AnomalyDetection Example Walk through the dashboard which points out several uses of anomalydetection
• #39: “Data Exploration is when we try to find patterns and relationships between fields, values and formats of data in order to gain additional insight or help narrow down data sets to the most important fields” “It could be a brand new data source or even an existing one that you are already used to. In this case there still could be some unknown value in in terms of patterns, relationships between fields and rare events. This capability gives you confidence to explore new data sources as well because you can quickly look for replacements and nuggets that stick out or help classify data. A colleague once asked me to look at some biomedical data with DNA information. The vocabulary and field definitions were way above me, but I was able to quickly understand patterns and relationships with Splunk just by using some of the basic search commands. With Splunk you literally become afraid of no data!” Alternate text “The ability to identify relationships between fields can be a powerful asset. Understanding values of a field and how these values might have a relationship with other field values within the same event, allows you to calculate the degree of certainty with other field values. This not only helps you explore and understand a data source, but allows you to calculate the degree of certainty the values will provide in future events.” Pull up search: Associate Correlate Ctable/Contingency Arules Cluster
• #40: Feel free to change this and use your own story! “My interpretation of Data Exploration when it comes to Splunk is the process of characterizing and researching behavior of both existing and new data sources.” “ For example while you may have an existing data source you are already used to, but there still could be some unknown value in in terms of patterns, relationships between fields and rare events that could point you to new insights or help with predictive analytics. This capability gives you confidence to explore new data sources as well because you can quickly look for replacements and nuggets that stick out or help classify data. A friend once asked me to look at some biomedical data with DNA information. The vocabulary and field definitions were way above me, but I was able to quickly understand patterns and relationships with Splunk and provide them value instaneously. With Splunk you literally become afraid of no data!” Let’s look at a few quick examples.
• #41: “The cluster command is used to find common and/or rare events within your data” <Show simple table search first and point out # of events, then run cluster and sort on cluster count to show common vs rare events> * | table _raw _time * | cluster showcount=t t=.1 | table _raw cluster_count | sort - cluster_count
• #42: Fieldsummary gives you a quick breakdown of your numerical fields such as count, min, max, stdev, etc. It also shows you examples values in the event. I used maxvals to limit the number of samples it shows per field. sourcetype=access_combined | fields – date* source* time* | fieldsummary maxvals=5
• #43: “The correlate command is used to find co-occurrence between fields. Basically a matrix showing the ‘Field1 exists 80% of the time when Field2 exists’” sourcetype=access_combined | fields – date* source* time* | correlate “This can be useful for both making sure your field extractions are correct (if you expect a field to exist %100 of the time when another field exists) and also helping you identify potential patterns and trends between different fields.”
• #44: “The contingency command is used to look for relationships of between two fields. Basically for these two fields, how many different value combinations are there and what are they / most common” sourcetype=access_combined | contingency uri status
• #45: This command is extremely useful for not only looking for meaningful fields in your data, but also for determining which fields to use in linear or logistical regression algorithms in the machine learning app. sourcetype=access_combined | analyzefields classfield=status
• #46: If you want to learn more about Data Science, Exploration and Machine Learning, download the Machine Learning App! You’ll use new SPL commands like “fit” and “apply” to train models on data in Splunk. New SPL commands: fit, apply, summary, listmodels, and deletemodel * Predict Numeric Fields (Linear Regression): e.g. predict median house values. * Predict Categorical Fields (Logistic Regression): e.g. predict customer churn. * Detect Numeric Outliers (distribution statistics): e.g. detect outliers in IT Ops data. * Detect Categorical Outliers (probabilistic measures): e.g. detect outliers in diabetes patient records. * Forecast Time Series: e.g. forecast data center growth and capacity planning. * Cluster Events (K-means, DBSCAN, Spectral Clustering, BIRCH).
• #48: Depending on remaining time can show 1 or more custom command examples. “We’ve gone over a variety of Splunk search commands.. but what happens when we can’t find a command that fits our needs OR want to use a complex algorithm someone already OR even create your own?? Enter Custom Commands.” Additional Text: Splunk's search language includes a wide variety of commands that you can use to get what you want out of your data and even to display the results in different ways. You have commands to correlate events and calculate statistics on your results, evaluate fields and reorder results, reformat and enrich your data, build charts, and more. Still, Splunk enables you to expand the search language to customize these commands to better meet your needs or to write your own search commands for custom processing or calculations.
• #49: <This slide can be optional, again feel free to use your own story> Customer Story: “Awhile back I was working on a project where I was Splunking live aircraft data. I was doing a demonstration with both my manager and customers where I was showing real-time movement of aircraft. In the middle of the presentation the customer asked me if they could see the real-time distance between any two aircraft or the even the airport. While I had lat/lon as fields, I knew I couldn’t write a accurate distance algorithm in a timely manner. I quickly searched “distance” in splunkbase just for the heck of it and whaddya know, there as custom command for it called Haversine. I asked if the audience would give me 5 minutes – downloaded the app and plugged in my lat/lon fields for two different planes, just like a regular search command.” Click #2: “This was my manager’s reaction” Click #3: “And this was what was going through the customer’s head”
• #50: Let’s see Haversine in action. <Pull up search>
• #51: *Note – Coordinates of origin in this Haversine example is currently “Seattle”
• #52: References: Little about each
• #53: TBD
• #54: TBD