Lab Visualization Splunk
Lab Visualization Splunk
Overview
Welcome to the Splunk Education lab environment. These lab exercises will test your knowledge of formatting
commands and your ability to visualize data using transforming and mapping commands.
Scenario
You will use data from the international video game company, Buttercup Games. A list of source types is
provided below.
NOTE: This is a lab environment driven by data generators with obvious limitations. This is not a
production environment. Screenshots approximate what you should see, not the exact output.
Sorts results in Sort the first 100 src_ip values in descending order
descending or ascending
sort command
order by a specified field.
| sort 100 -src_ip
Can limit results to a
specific number.
Returns the sum of the Calculate the sum of the bytes field
statistical values of a field. Can be
sum() function used with stats,
timechart, and chart
| stats sum(bytes)
commands.
Count all events as "events" and count all events that
Returns the number of contain a value for action as "action"
occurrences of all events
count or statistical
or a specific field. Can | stats count as events,
count() function
be used with stats, count(action) as action
timechart, and chart
commands.
Refer to the Search Reference Manual for a full list of commands and functions.
© 2022 Splunk Inc. All rights reserved. Visualizations 11 January 2022 2
Lab Exercises
Description
Configure the lab environment user account. Then, transform data using chart, timechart, top, rare, and
stats commands.
Steps
Task 1: Log into Splunk and change the account name and time zone.
Set up your lab environment to fit your time zone. This also allows the
instructor to track your progress and assist you if necessary.
1. Log into your Splunk lab environment using the username and
password provided to you.
2. You may see a pop-up window welcoming you to the lab environment.
You can click Continue to Tour but this is not required. Click Skip to
dismiss the window.
3. Click on the username you logged in with (at the top of the screen) and
then choose Account Settings from the drop-down menu.
After you complete step 6,
4. In the Full name box, enter your first and last name.
you will see your name in
5. Click Save. the web interface.
6. Reload your browser to reflect the recent changes to the interface.
(This area of the web interface will be referred to as user name.)
NOTE: Sometimes there can be delays in executing an action like saving in the UI or returning results
of a search. If you are experiencing a delay, please allow the UI a few minutes to execute
your action.
Task 2: Use the timechart command to visualize data in an area chart. Then use advanced
formatting options to add a chart overlay.
11. In the top left corner of Splunk Web, select Apps > Search & Reporting. This sets the app context to the
search app.
NOTE: If Search & Reporting has a checkmark then you are in the right app and do not need to
perform step 11.
12. Execute the following search over the Last 24 hours. This search will return successful online purchase
events from the access_combined sourcetype and retail sales events from the vendor_sales sourcetype.
13. Pipe the results to the timechart command so that events are counted by sourcetype with a span
of 1 hour.
Scenario: The Sales team manager liked the visualization but wants to know if you can "make the retail
sales data easier to read."
Task 3: Convert the retail sales data to a chart overlay. Optionally, use the rename command to
rename the sourcetypes.
16. (Optional) If you are currently on the Reports tab then you will need to navigate back to your L1S1 report.
Under Actions for your L1S1 report, click on Open in Search. Then, confirm that you are in the
Visualization tab.
17. Under Visualization, click on the Format tab and use the Chart Overlay tab to assign vendor_sales
data as the Overlay.
18. This report needs to be easier to read for non-IT employees. Use the rename command to rename
vendor_sales as "retailSales" and access_combined as "webSales" to make the legend easier to read.
Use the Common Commands and Functions table in this document for details on the rename command.
20. Click on Save As to save your search as a report with the name L1S2. (Do not click Save or you will
overwrite your L1S1 report.)
Scenario: The Security Operations team would like a visualization of authentication failures that
occurred over the last week with a simple moving average trendline.
Task 4: Use the timechart and trendline commands to visualize authentication failures.
21. Re-initialize the search window by clicking Search in the application bar. This step should be done every
time you save a report so that you do not accidentally overwrite a previous report.
22. Execute the following search over the Last 7 days. This search will return results from the web server that
contain "fail" in the raw data.
index=security sourcetype=linux_secure fail*
23. Use the timechart command to count events with a span of 1 day. Use an as clause to name the output
"failures."
25. Find the trendline of failures with the trendline command. Use the simple moving average trendtype
with a period of 2 days. Use an as clause to label this output as "trend."
Scenario: Display the daily sales count of strategy games at Buttercup Games retail locations (i.e., not
online) during the previous week, and display the sales count and trend for the
previous day.
Task 5: Use the timechart command to count retail sales events for strategy games and visualize
results as a single value visualization with a sparkline and trendline.
27. Re-initialize the search window by clicking Search in the application bar. This step should be done every
time you save a report so that you do not accidentally overwrite a previous report.
28. Execute the following search over the Previous week. This search will return retail sales events for
strategy games.
index=sales sourcetype=vendor_sales categoryId="STRATEGY"
29. Use the timechart command to count events with a span of 1 day.
31. Change your visualization to Single Value. You should see the most recent count value, a sparkline
with the difference between today's count value and yesterday's count value, and a trendline under
these two values.
Color
e. Use Colors: Yes
f. Color By: Trend
g. Color Mode: Block background (i.e. white numbers on a color background)
Task 6: Use the chart command to calculate retail sales events for each state and the geom command
to create a choropleth map of the United States.
34. Re-initialize the search window by clicking Search in the application bar. This step should be done every
time you save a report so that you do not accidentally overwrite a previous report.
35. Execute the following search over the Last 7 days. This search returns retail sales events from Vendors in
the United States.
index=sales sourcetype=vendor_sales VendorID < 3000
37. To display the results as a choropleth map, use the geom command to map VendorStateProvince to the
geo_us_states KMZ file.
39. Zoom into the United States using the + button. Then navigate to Format > General and click Populate
with current map settings.
Scenario: Buttercup Games is currently running a global Cyber Monday sale and the Chief Financial
Officer wants to see how online sales are performing across the globe.
Task 7: Use the iplocation and geostats commands to create a cluster map of online retail sales.
41. Re-initialize the search window by clicking Search in the application bar. This step should be done every
time you save a report so that you do not accidentally overwrite a previous report.
42. Execute the following search over the Previous week. This search returns all online sales events
(index=web sourcetype=access_combined action=purchase) that were successful (status=200) and
on sale (sale_price=*).
index=web sourcetype=access_combined action=purchase status=200 sale_price=*
NOTE: The view changes to the Visualization tab when you run the geostats command. You may
need to change the visualization to Cluster Map.
45. You may notice that some of the clusters have an OTHER field. This is because the number of named
categories in a cluster is limited to 10 fields. Remove this limit using the globallimit argument.
47. Re-initialize the search window by clicking Search in the application bar. This step should be done every
time you save a report so that you do not accidentally overwrite a previous report.
48. Complete the missing portion of the following search so that:
a. The stats command counts all events by VendorCountry.
b. The count values calculated by the stats command are listed under a column called "Retail
Events" without using the rename command.
c. The last row of the results displays "Total" in the VendorCountry column and a sum of Retail
Events values in the Retail Events column.
index=sales sourcetype=vendor_sales
| ???
| ???
51. Complete the missing portion of this search so that all non-Business web security appliance events are
counted for each location and split by usage categories over the Last 24 hours.
Challenge: The Buttercup Games San Francisco office recently reopened after being closed due to a
chicken pox outbreak among the Engineering team. The CEO wants all 41 San Francisco employees
back in the office now that quarantine is over. They want to see this data visualized as a single value
with any number under 40 shown in red. (One employee is on parental leave after having quadruplets.)
54. Complete the missing portion of this search so that the search:
a. Removes duplicate values of rfid (the unique ID associated with each employee's badge.)
b. Counts all events and produces a single value as the result.
Choose your Challenge: The Sim Cubicle Game team recently launched a BETA and the Director of
Engineering is eager to see how many unique events have occurred on the server in the past month.
58. Fulfill the scenario request by creating a choropleth map or a cluster map. The basic search for both
solutions will be index=games sourcetype=SimCubeBeta. Run your search over the Last 30 days.
b. If you create the cluster map, you will use 2 commands, 1 function and the user_ip field.
Cluster Map
59. Save your search as LX3.