Oct 8, 11:00 PM – Oct 9, 1:00 AM (UTC)
Can Summary Index (SI) data be made to behave like Accellerated Data Models (i.e. "|tstats ... summariesonly=f")? Come to DASUG & you will leave understanding: 1: How & WHY to provide an SPL-based "API" for specific searches 2: How to seamlessly return data from EITHER (or BOTH) SI (when it IS available) or raw (when SI is NOT available) 3: Some "gotchas" and workarounds when using "prestats" data
Can Summary Index (SI) data be made to behave like Accellerated Data Models (i.e. "|tstats ... summariesonly=f")?
In this session, Gregg Woodcock will walk through (and provide a full app with the SPL) for doing exactly that!
Come to DASUG & you will leave understanding:
1: How & WHY to provide an SPL-based "API" for specific searches
2: How to seamlessly return data from EITHER (or BOTH) SI (when it IS available) or raw (when SI is NOT available)
3: Some "gotchas" and workarounds when using "prestats" data
This will be BOTH a virtual event AND a live event @ the Trace3 (AKA Set Solutions) venu in Frisco:
25N Coworking Frisco
9355 John W. Elliott Dr #25
Frisco, TX 75033
Located in the first floor of the Waterford Market apartments.
See map for the main entrance and parking information:
https://drive.google.com/file/d/1BOQD6k4ou-FZiBg3bim-Avh9j_RAC1eo
Feel free to start the conversation early in the #dallas channel of splunk-usergroups.slack.com (sign up with http://splk.it/slack).
October 8 – 9, 2024
11:00 PM – 1:00 AM (UTC)
| 11:00 PM | Soft Start |
| 11:30 PM | Hard Start |
| 12:30 AM | QandA |
| 1:00 AM | Free Time |
Contact Us
