Comparing Values

Upcoming Classes

Online

Instructor-led online training

Location	Apr 2023	May 2023	Jun 2023	Jul 2023	Aug 2023	Sep 2023
AMER Brazil Time - Virtual (Portuguese)	Apr 6 Apr 18	May 9 May 23		Jul 4	Aug 9 Aug 29	Sep 5
AMER Pacific Time - Virtual	Apr 12		Jun 28
APAC Sydney - Virtual	Apr 13	May 23
AMER Eastern Time - Virtual	Apr 19 Apr 26	May 17	Jun 1 Jun 13
APAC Singapore - Virtual	Apr 25		Jun 6	Jul 25		Sep 5
EMEA Greenwhich Mean Time - Virtual		May 10	Jun 6
AMER Eastern Time - Virtual (Spanish)		May 16
Fast Lane Italia - Milano				Jul 10
EMEA UK Time - Virtual					Aug 30

Summary

This three-hour course is for power users who want to learn how to compare field values using eval functions and eval expressions. Topics will focus on using the comparison and conditional functions of the eval command, and using eval expressions with the fieldformat and where commands.

Description

Using eval to Compare
Filtering with where

Duration

3 hours

Objectives

Topic 1 – Using eval to Compare

Understand the eval command
Explain evaluation functions
Identify and use comparison and conditional functions
Use the fieldformat command to format field values

Topic 2 – Filtering with where

Use the where command to filter results
Use wildcards with the where command
Filter fields with the information functions, isnull and isnotnull

Topic 3 – Using Fields in Searches

Use fields correctly in basic searches
Use fields with operators
Use the rename command
Use the fields command to improve search performance

Topic 4 – Comparing Temporary versus Persistent Fields

Differentiate between temporary and persistent fields
Create temporary fields with the eval command
Extract temporary fields with the erex and rex commands

Topic 5 – Enriching Data

Understand how fields from lookups, calculated fields, field aliases, and field extractions enrich data

Audience

Search Experts Knowledge Managers

Prerequisites

To be successful, students should have a solid understanding of the following:

How Splunk works
Creating Search queries

Additional Notes

Individuals who enroll in this class will also be enrolled in an (eLearning with Labs) component. Completion of labs and quizzes is required in order to receive proof of completion.

Public Training

AMER Brazil Time - Virtual (Portuguese)

Apr 6

9:00 AM - 12:00 PM BRT

$ 500.00 USD
Apr 18

9:00 AM - 12:00 PM BRT

$ 500.00 USD
May 9

9:00 AM - 12:00 PM BRT

$ 500.00 USD
May 23

9:00 AM - 12:00 PM BRT

$ 500.00 USD
Jul 4

9:00 AM - 12:00 PM BRT

$ 500.00 USD
Aug 9

9:00 AM - 12:00 PM BRT

$ 500.00 USD
Aug 29

9:00 AM - 12:00 PM BRT

$ 500.00 USD
Sep 5

9:00 AM - 12:00 PM BRT

$ 500.00 USD

AMER Pacific Time - Virtual

Apr 12

9:00 AM - 12:00 PM PDT

$ 500.00 USD
Jun 28

9:00 AM - 12:00 PM PDT

$ 500.00 USD

APAC Sydney - Virtual

Apr 13

9:00 AM - 12:00 PM AEST

$ 500.00 USD
May 23

9:00 AM - 12:00 PM AEST

$ 500.00 USD

AMER Eastern Time - Virtual

Apr 19

9:00 AM - 12:00 PM EDT

$ 500.00 USD
Apr 26

9:00 AM - 12:00 PM EDT

$ 500.00 USD
May 17

9:00 AM - 12:00 PM EDT

$ 500.00 USD
Jun 1

2:00 PM - 5:00 PM EDT

$ 500.00 USD
Jun 13

9:00 AM - 12:00 PM EDT

$ 500.00 USD

APAC Singapore - Virtual

Apr 25

9:00 AM - 12:00 PM SGT

$ 500.00 USD
Jun 6

9:00 AM - 12:00 PM SGT

$ 500.00 USD
Jul 25

9:00 AM - 12:00 PM SGT

$ 500.00 USD
Sep 5

9:00 AM - 12:00 PM SGT

$ 500.00 USD

EMEA Greenwhich Mean Time - Virtual

May 10

9:00 AM - 12:00 PM BST

$ 500.00 USD
Jun 6

9:00 AM - 12:00 PM BST

$ 500.00 USD

AMER Eastern Time - Virtual (Spanish)

May 16

9:00 AM - 12:00 PM EDT

$ 500.00 USD

Fast Lane Italia - Milano

Jul 10

9:30 AM - 12:30 PM CEST

$ 500.00 USD

EMEA UK Time - Virtual

Aug 30

9:00 AM - 12:00 PM BST

$ 500.00 USD

Don't see a date that works for you?

Request Class

Comparing Values

Comparing Values