Result Modification

Upcoming Classes

Online

Instructor-led online training

Location	Apr 2023	May 2023	Jun 2023	Jul 2023	Aug 2023	Sep 2023
AMER Pacific Time - Virtual	Apr 12		Jun 28
APAC Sydney - Virtual	Apr 13	May 23
AMER Eastern Time - Virtual	Apr 19 Apr 27	May 17	Jun 1 Jun 13	Jul 4	Aug 30
APAC Singapore - Virtual	Apr 25		Jun 6	Jul 25		Sep 5
EMEA Greenwhich Mean Time - Virtual		May 10	Jun 6
AMER Eastern Time - Virtual (Spanish)		May 16
Fast Lane Italia - Milano				Jul 10

Summary

This three-hour course is for power users who want to use commands to manipulate output and normalize data. Topics will focus on specific commands for manipulating fields and field values, modifying result sets, and managing missing data. Additionally, students will learn how to use specific eval command functions to normalize fields and field values across multiple data sources.

Description

Manipulating Output
Modifying Result Sets
Managing Missing Data
Modifying Field Values
Normalizing with eval

Duration

3 hours

Objectives

Topic 1 – Manipulating Output

Convert a 2-D table into a flat table with the untable command
Convert a flat table into a 2-D table with thexyseries command

Topic 2 – Modifying Result Sets

Append data to search results with the appendpipe command
Calculate event statistics with the eventstats command
Calculate "streaming" statistics with the streamstats command
Modify values to segregate events with the bin command

Topic 3 – Managing Missing Data

Find missing and null values with the fillnull command

Topic 4 – Modifying Field Values

Understand the eval command
Use conversion and text eval functions to modify field values
Reformat fields with the foreach command

Topic 5 – Normalizing with eval

Normalize data with eval functions
Identify eval functions to use for data and field normalization

Audience

Search Experts Knowledge Managers

Prerequisites

To be successful, students should have a solid understanding of the following:

How Splunk works
Creating Search queries
Knowledge Objects

Additional Notes

Individuals who enroll in this class will also be enrolled in an (eLearning with Labs) component. Completion of labs and quizzes is required in order to receive proof of completion.

Public Training

AMER Pacific Time - Virtual

Apr 12

1:00 PM - 4:00 PM PDT

$ 500.00 USD
Jun 28

1:00 PM - 4:00 PM PDT

$ 500.00 USD

APAC Sydney - Virtual

Apr 13

1:30 PM - 4:30 PM AEST

$ 500.00 USD
May 23

1:30 PM - 4:30 PM AEST

$ 500.00 USD

AMER Eastern Time - Virtual

Apr 19

1:00 PM - 4:00 PM EDT

$ 500.00 USD
Apr 27

9:00 AM - 12:00 PM EDT

$ 500.00 USD
May 17

1:00 PM - 4:00 PM EDT

$ 500.00 USD
Jun 1

2:00 PM - 5:00 PM EDT

$ 500.00 USD
Jun 13

1:00 PM - 4:00 PM EDT

$ 500.00 USD
Jul 4

2:00 PM - 5:00 PM EDT

$ 500.00 USD
Aug 30

2:00 PM - 5:00 PM EDT

$ 500.00 USD

APAC Singapore - Virtual

Apr 25

2:00 PM - 5:00 PM SGT

$ 500.00 USD
Jun 6

2:00 PM - 5:00 PM SGT

$ 500.00 USD
Jul 25

2:00 PM - 5:00 PM SGT

$ 500.00 USD
Sep 5

2:00 PM - 5:00 PM SGT

$ 500.00 USD

EMEA Greenwhich Mean Time - Virtual

May 10

1:00 PM - 4:00 PM BST

$ 500.00 USD
Jun 6

1:00 PM - 4:00 PM BST

$ 500.00 USD

AMER Eastern Time - Virtual (Spanish)

May 16

1:00 PM - 4:00 PM EDT

$ 500.00 USD

Fast Lane Italia - Milano

Jul 10

2:00 PM - 5:00 PM CEST

$ 500.00 USD

Don't see a date that works for you?

Request Class

Result Modification

Result Modification