Do you have a search that you just cannot make work? Do you have a search that works sometimes but not all the time? Do you have a search that works with small amounts of data but fails at greater scale? Do you have a production search using "append", "join" or "transaction" (hint: you shouldn't)? What does "cardinality" have to do with anything? Bring us your problems and partial work and let's try to get you to the finish line in realtime! This DASUG will help!
This will be BOTH a virtual event AND a live event @ NEW VENUE: Set Solutions in Frisco!
You will walk away with:
1: Some rules-of-thumb for SPL
2: Optimization strategies for SPL.
3: Ways to debug searches.
This will be BOTH a virtual event AND a live event @ NEW VENUE: Set Solutions in Frisco:
25N Coworking Frisco
9355 John W. Elliott Dr #25
Frisco, TX 75033
Located in the first floor of the Waterford Market apartments.
See map for the main entrance and parking information:
Feel free to start the conversation early in the #dallas channel of splunk-usergroups.slack.com (sign up with http://splk.it/slack).