principal product manager, splunk senior software engineer ... · how search works in 6.5. 7 search...
TRANSCRIPT
![Page 1: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/1.jpg)
Copyright©2016Splunk Inc.
AlexJamesPrincipalProductManager,Splunk
SearchOptimizationKarthikSabhanatarajanSeniorSoftwareEngineer,Splunk
&
![Page 2: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/2.jpg)
Demo
![Page 3: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/3.jpg)
A B C D L EA B C D L EA B C D LA B C D LA B C D
A B C D L EA B C D L EA B C D LA B C D
Motivation:Taleoftwosearches
3
searchSourceType lookupL evalE searchA&L&E
Diskrawdata&index
searchSourceType&A lookupL searchL evalE searchE
• 10,000,000indexhits• 1,000,000eventscreated(i.e.extractions)• 1,000,000lookups• 1,000,000evals• 1,000,000filters• Produces100,000matchingevents
• 7,000,000fewerindexhits• 700,000 fewereventscreated• 700,000fewerlookups• 800,000fewerevals• Net500,000lessfilters• ProducesIDENTICAL100,000matchingevents
TOTALWORK
SAVINGS
![Page 4: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/4.jpg)
OptimizationPrinciplesDoaslittleworkaspossible– Retrieveonlytherequireddata– Moveaslittledataaspossible– Parallelizeasmuchworkaspossible– Setappropriatetimewindows
ImplicationsbasedonSplunkArchitecture– Filterasmuchaspossibleintheinitialsearch– Join/Lookuponlyonrequireddata– Evalontheminimumnumberofeventspossible– Delaycommandsthatbringdatatothesearchheadasmuchaspossible.
4
![Page 5: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/5.jpg)
NewinSplunk6.5
![Page 6: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/6.jpg)
Howsearchworksin6.4.
6
searchsourcetype=access-*(status=401orstatus=403)|lookup usertogroupuserOUTPUTgroup|where src_category=“email_server”
search lookup
1)Spliton‘|’andcreateprocessorpipeline
2)Distributebetweenindexandsearchheads,passargumentsandexecute
search lookup whereIndexer1
search lookup whereIndexer2
combine
Searchhead
where
![Page 7: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/7.jpg)
Howsearchworksin6.5.
7
searchsourcetype=access-*(status=401orstatus=403)|lookup usertogroupuserOUTPUTgroup|where src_category=“email_server”
search lookup
1)ParseintoAST
search lookupIndexer1
search lookupIndexer2combine
Searchhead
searchsourcetype=access-*(status=401orstatus=403)src_category=“email_server”|lookup usertogroupuserOUTPUTgroup
2)OptimizeAST
3)ConstructPipelinefromAST
JSONAST
OptimizedJSONAST
4)Distributebetweenindexandsearchheads,passargumentsandexecute
![Page 8: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/8.jpg)
Demo
![Page 9: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/9.jpg)
Whatoptimizationsaredone?
9
Pushingpredicatestotheleft(ordown)– For*any*streamingcommandsthatdon’tmodifyafield:
– |rangemap field=scoreF=0-64D=65-69C=70-79B=80-89A=90-100|wherehost=mail30– |wherehost=mail30|rangemap field=scoreF=0-64D=65-69C=70-79B=80-89A=90-100
– SpecialHandlingforsomecommands:ê Rename– |renamesrc asip |whereip=“192.1.2.13”– |wheresrc=“192.1.2.13”|renamesrc asip
ê Eval– |evalsrc=if(isnull(src)ORsrc=“”,“unknown”,src |wheresrc =“192.1.2.13”– |wheresrc =“192.1.2.13”|evalsrc=if(isnull(src)ORsrc=“”,“unknown”,src
ê Byclausefilters– |statscountbyclientip|searchclientip=“192.0.0.0/8”– |searchclientip=“192.0.0.0/8”|statscountbyclientip
Search/Wheremerging– searchERROR|search404|wheresourcetype=“windows”– searchERROR404sourcetype=“windows”
![Page 10: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/10.jpg)
Whatoptimizationsarecominglater?
10
PredicateSplittingPredicateNormalizationCollapsingconsecutivecommandsConvertingEvalFunctionsintoSearchfiltersifpossibleProjectionEliminationRe-usingprevioussearchresults
![Page 11: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/11.jpg)
Whatdoesthismeanforyou?
11
FasterSearchesUpgradeto6.5Scanfor‘inefficientsearches’– Especiallyinscheduledworkloads...
UsetheJobInspectortoseeoptimizationinactionOptimizefurthermanuallyifneeded
![Page 12: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/12.jpg)
Q&A
12
![Page 13: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/13.jpg)
![Page 14: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/14.jpg)
Disclaimer
14
Duringthecourseofthispresentation,wemaymakeforwardlookingstatementsregardingfutureeventsortheexpectedperformanceofthecompany.Wecautionyouthatsuchstatementsreflectourcurrentexpectationsandestimatesbasedonfactorscurrentlyknowntousandthatactualeventsorresultscoulddiffermaterially.Forimportantfactorsthatmaycauseactualresultstodifferfromthose
containedinourforward-lookingstatements,pleasereviewourfilingswiththeSEC.Theforward-lookingstatementsmadeinthethispresentationarebeingmadeasofthetimeanddateofitslivepresentation.Ifreviewedafteritslivepresentation,thispresentationmaynotcontaincurrentoraccurateinformation.Wedonotassumeanyobligationtoupdateanyforwardlookingstatementswemaymake.Inaddition,anyinformationaboutourroadmapoutlinesourgeneralproductdirectionandissubjecttochangeatanytimewithoutnotice.Itisforinformationalpurposesonlyandshallnot,beincorporatedintoanycontractorothercommitment.Splunkundertakesnoobligationeithertodevelopthefeaturesor
functionalitydescribedortoincludeanysuchfeatureorfunctionalityinafuturerelease.
![Page 15: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/15.jpg)
MigratingSlidesforMac1. Forbestresults,simplypasteyourslidesintothis
template.
2. ApplyslidelayoutsusingtheLayout buttonundertheFormattab.
3. IfLayoutstilldoesnotreflectthedesiredMasterLayout,chooseResetLayouttoDefaultsettings.
4. Deleteunwantedtemplateslides(anyslidesafterLastSlide).
5. ChooseSaveAstosavethefilewithoutoverwritingthetemplate.
15
![Page 16: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/16.jpg)
MigratingSlidesforPC1. Forbestresults,simplypasteyourslidesintothistemplate.
– Pastingafterabulletslideisrecommended
2. Reviewallslidesandmakeformattingadjustmentsasneeded– OntheHome ribbon,clickLayout andselectthecorrectslidelayout– ClickReset toresetallslideelementstothedefaultsizeandposition– Checkforhiddentext,suchaswhitetextonawhitebackground
3. Deleteunnecessarytemplateslides4. SaveAstosavethefilewithoutoverwritingthetemplate
16
![Page 17: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/17.jpg)
SlideMasters• Whenimportingslidesfromanotherpresentation,the
SlideMastersassociatedwiththoseslidesmayalsoimporttothistemplate.Thisisa‘feature’ofPPTandcannotbeturnedoff.
• TodeleteunwantedSlideMasters:– makesureallslidesinthepresentationhavethenew
templateSlideMasterLayoutsassigned(first16SlideMastersshownunderLayout)
– GotoView/MastertodeleteanyunwantedSlideMasters
• ThelastSlideMasterinthistemplateiscalledLastSlide.AnySlideMastersafterthisslidewerelikelyimportedfromanotherpresentationandcanbedeleted(ifnolongerusedbyanyslides.)
17
![Page 18: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/18.jpg)
ImportantTips• Thistemplateusesareducedslidesize.Youmayhavetomanuallydecreasethesizeofsomeitemssuchasstrokes andfonts.
• Iffontsappearbiggerthandesired,remembertoassignaLayout toyourslideandResettoDefaultSettings.
• Ifpagenumbersdonotappearorarethewrongformatting,remembertoassignaLayout toyourslideandResettoDefaultSettings.
• Thecolorsinyourgraphicswillautomaticallybeshiftedtothenewpalette.Pleaseadjustasneeded.
18
![Page 19: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/19.jpg)
Agenda
AgendaItemAgendaItemAgendaItem
19
![Page 20: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/20.jpg)
2012GoalsandObjectivesExample
GoalItemGoalItemGoalItem
20
![Page 21: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/21.jpg)
SampleTitle,66pt.Calibri
21
![Page 22: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/22.jpg)
SampleTitle,66pt.Calibri
22
Subhead
![Page 23: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/23.jpg)
TitleOnlySlide,60pt.Calibri
23
![Page 24: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/24.jpg)
TitleOnlySlide,54pt.Calibri
24
![Page 25: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/25.jpg)
Samplewithscreenshot
25
Screenshothere
![Page 26: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/26.jpg)
SampleTwo-columnFormatSubhead
26
Sampletwo-columnformat
• Sampletwo-columnformat,sentence– Secondbullet
Sampletwo-columnformat
![Page 27: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/27.jpg)
SplunkObjectStyleandColor
27
Hardware ProductBusiness/Corporate
HighlightOnlyGenericVirtualization
Generic
Thesearesuggestedusesforcolorsonly.
![Page 28: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/28.jpg)
AssignDefaultObjectStyle
28
![Page 29: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/29.jpg)
ApplyingSplunkObjectStyle
29
ToapplytheSplunk objectstyletoanyshape:1. Selecttheshapewiththedesiredstyle2. ClickonFormatPainter(paintbrush)toolintoolbar3. Applystyletoanynewshape
![Page 30: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/30.jpg)
Logos
30
CorporateLogo ProductLogo
![Page 31: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/31.jpg)
Logos
31
![Page 32: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/32.jpg)
Logos
32
![Page 33: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/33.jpg)
Splunk Icons
33
search barchart lock cloud opencloud checkmark envelope
storage- 3storageiPhoneiPadandroid
server indexer forwarder searchhead desktop laptop
datacenter
Splunk server
firewall
![Page 34: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/34.jpg)
Splunk IconsCont’d
34
application virtualmachine virtualserver network wwworglobal tools
logfile RFID router loadbalancer script shoppingcart
user users gears/settings gear messaging tag/ticket
document
alert
gps tower
![Page 35: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/35.jpg)
Splunk Icons
35
Checkmark InfoAlert StopiPhoneiPadAndroid
Twitter Facebook LinkedIn RSS YouTube ShoppingcartGPSTower
Healthcare Hospital Officebuilding VoIPPhone Support POSCardReader RFID
![Page 36: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/36.jpg)
Splunk Icons
36
![Page 37: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/37.jpg)
SecurityIcons
37
FirewallAttacker,Generic
Attacker,Insider
Attacker,Nation/State
Botnet Key
Malware MalwareDocument
MalwarePackaged
SecurityBadge
SecurityServer
Shield VirusFootsteps
![Page 38: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/38.jpg)
TheInternetofThingsIcons
38
POSCardReader
RFIDElectricCar
EMVReaderInternetofThings Meter Factory
SignatureCapture
![Page 39: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/39.jpg)
Arrows
39
![Page 40: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/40.jpg)
TableExample
40
ColumnTitle ColumnTitle ColumnTitle ColumnTitle
Text Text Text Text
Text Text Text Text
Text Text Text Text
Text Text Text Text
Text Text Text Text
![Page 41: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/41.jpg)
TableExample
41
ColumnTitle ColumnTitle ColumnTitle ColumnTitle
Text Text Text Text
Text Text Text Text
Text Text Text Text
Text Text Text Text
Text Text Text Text
![Page 42: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/42.jpg)
SampleCustomerSuccess
42
Customerlogohere
CustomernameCustomercompany
“SplunkmakesitcheaperandeasierforHughestoanalyzenetworktrafficforenterprisecustomersaswellasmanagebandwidthforconsumerandsmallbusinesscustomers.”
BulletplaceholderBulletplaceholderBulletplaceholder
Screenshotorgraphichere
![Page 43: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/43.jpg)
TimelineChart
43
Q1 Q2 Q3 Q4
Milestone Event
![Page 44: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/44.jpg)
ChartExample
44
PlannedActual
Number
Number
Number
Number
Number
FY09 FY10FY08PreviousYear
N%growthoverFYxx
![Page 45: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/45.jpg)
QuoteBox
45
“Apessimistseesthedifficultyineveryopportunity;anoptimistseestheopportunityineverydifficulty.”
-WinstonChurchill
![Page 46: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/46.jpg)
QuoteBox
46
![Page 47: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/47.jpg)
QuoteBox
47
![Page 48: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/48.jpg)
WhatNow?
48
Relatedbreakoutsessionsandactivities…
![Page 49: Principal Product Manager, Splunk Senior Software Engineer ... · How search works in 6.5. 7 search sourcetype=access-* (status=401 or status=403) | lookupusertogroup user OUTPUT](https://reader034.vdocument.in/reader034/viewer/2022042221/5ec7e17245b8f32c372a8cc9/html5/thumbnails/49.jpg)
THANKYOU