About capturing knowledge

About capturing knowledge

Once you master the basics of freeform search as described in the "Search and Investigate" chapter, you'll want to take things to a higher level of precision, because the raw data you get from those searches won't always get you to the answers you need.

Leverage Splunk's ability to marry the flexibility of unstructured search with the power of working with structured data. Add knowledge about the events, fields, transactions, and patterns in your data. Discover similar events and group them together with a collective name (an "event type") so you can search on them like you do any other field. Identify transactions that are associated with clusters of events and track them. Group related fields together with tags and aliases. Interactively extract new fields based on event data or external information (such as lookup tables) and add them to your searches.

In this chapter you will:

• Learn how to identify similar or related events and group them together as event types.
• See a list of the default and internal fields automatically extracted by Splunk during the indexing process and see examples of their use in searches.
• Find out how to group fields with related values together through tags and aliases.
• Learn how to interactively extract and add new fields.
• Discover how you can identify event clusters related to transactions and use them to your advantage in searches.
• See a detailed example of interactive field extraction.
• Learn how to create a saved search string and share the results of searches with others.
• Manage both in-process and completed search jobs and review their results.
• Learn about Splunk knowledge objects and how they can be shared with others and promoted among apps.