Ed Ferrara, MSIA, CISSP eferrara@temple.edu MIS 5208 Week 13: Visualizing Results With Splunk Ed Ferrara, MSIA, CISSP eferrara@temple.edu
Please signup for this training! Temple, as a member school of Internet2, is entitled to free training and certification exams for Splunk Power Users: http://www.internet2.edu/blogs/detail/10079 If you register and take the courses described in the blog posting yourself, you will have access to the teaching materials in PDF form as part of the elearning course. Reminder
What is Visualization Assists in Communicating Complex Ideas Data Patterns Trends Comparisons over time Assists the viewer in focusing on the substance of an issue (or should) Many numbers – small chart (can be confusing) Allows us to create actionable insights Allows us to answer question such as: What types of customers are buying more? What was the impact of our latest pricing change? What areas of the country or the world were most affected?
Tables and Visualizations
Visualization options and data structures
Tables and Visualizations
Tables and Visualizations
How Does Splunk Deal with Visualization
Create A Top Value Report
Create A Top Value Report
Create A Top Value Report host = MIS5208 | top useragent
Change the Visualization
Change the Visualization
Change the Format
View as a Table
View as a Table
Pivot Tables and Data Models
Using Pivot Tables Describe Pivot Tables Understand the relationship between the Splunk data model and the pivot Select a data model object Create a pivot report Use instant pivot to create a report
Excel Pivot Table
Excel Pivot Table
Completed Pivot
Data Models
Data Model Cheat Sheet Source: http://blogs.splunk.com/2014/02/26/data-model-cheat-sheet/
Create a data model
Using Pivot Tables
Open In Pivot
Select The Time Range
Split Rows
Split Rows
Results
Add Additional Filters
Add Additional Filters
Add Additional Filters
Select a Visualization Format
Modify Visualization Settings
Mouse Actions
Mouse Actions
Save Pivot
Instant Pivot
Mouse Actions
Thank you