4 docs tagged with "splunk"

Advanced Splunk SPL — regex extraction (rex), JSON parsing (spath), windowing (eventstats vs streamstats), transaction vs stats, subsearch optimization, and production SRE observability queries.

Principal engineering guide to OpenSearch internals (Apache Lucene segments, FSTs, DocValues, Segment Replication, ISM tiers) and end-to-end Splunk-to-OpenSearch migration (Schema-on-Read vs Schema-on-Write, SPL to PPL/DSL translation, Data Prepper pipelines, and capacity math).

Splunk core architecture (Search Head, Indexers, Forwarders) and SPL fundamentals — pipeline mechanics, fast filtering, bloom filters, boolean logic, and transforming commands.

Deep dive into Splunk eval command functions (case, if, coalesce, strftime/strptime) and time bucketing mechanics (bin, bucket, span, timechart, timewrap).