Multivalue FieldsSMVSPSplunkSP-SMV1.0<p>To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge:
</p>
<ul>
<li>How Splunk works</li><li>Creating search queries</li></ul><ul>
<li>Users/Analysts</li></ul><p><strong>Module 1 – What are Multivalue Fields?</strong></p>
<ul>
<li>Define multivalue fields</li><li>Define self-describing data</li><li>Understand how JSON data is handled in Splunk</li><li>Use the spath command to interpret self-describing data</li><li>Manipulate multivalue fields with mvzip and mvexpand</li><li>Convert single-value fields to multivalue fields with specific commands and functions</li></ul><p><strong>Module 2 – Create Multivalue Fields</strong></p>
<ul>
<li>Create multivalue fields with the makemv command and the split function of the eval command</li></ul><p><strong>Module 3 – Evaluate Multivalue Fields</strong></p>
<ul>
<li>Use the mvcount, mvindex, and mvfilter eval functions to evaluate multivalue fields</li></ul><p><strong>Module 4 – Analyze Multivalue Data</strong></p>
<ul>
<li>Use the mvsort, mvzip, mvjoin, mvmap, and mvappend eval functions and the mvexpand command to analyze multivalue data</li></ul>To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge:
- How Splunk works
- Creating search queries- Users/AnalystsModule 1 – What are Multivalue Fields?
- Define multivalue fields
- Define self-describing data
- Understand how JSON data is handled in Splunk
- Use the spath command to interpret self-describing data
- Manipulate multivalue fields with mvzip and mvexpand
- Convert single-value fields to multivalue fields with specific commands and functions
Module 2 – Create Multivalue Fields
- Create multivalue fields with the makemv command and the split function of the eval command
Module 3 – Evaluate Multivalue Fields
- Use the mvcount, mvindex, and mvfilter eval functions to evaluate multivalue fields
Module 4 – Analyze Multivalue Data
- Use the mvsort, mvzip, mvjoin, mvmap, and mvappend eval functions and the mvexpand command to analyze multivalue data3 Stunden500.00500.00420.00500.00500.00690.00550.00500.0050.0050.0050.0050.0050.0050.0050.0050.0050.0050.00