Learning a new language is always fun(?). Many folks start with existing paradigms and look for comparisons. I'm no different while trying to learn LogScale's Query Language or LQL.
I've looked for various cheetsheets and haven't found much. I'll paste a very rough one I've created below and hope to update it over time. Feel free to pass over anything I should add or tweak! There also has to be a better way to post this other than a pasted image from Excel. I'm a Luddite /shrug
This is for my man Destry who I met recently in person. He
was giving me a bit of good-natured fun at not posting more frequently. So
Destry, this is for you!
I’m doing a Splunk tips & tricks workshop this week with
some folks who, among other things, had asked for a query to identify log
volume anomalies. Ahh volume anomalies. So many variations of this. Several
apps can be found on Splunkbase which have been developed by the user
community. One might ask why Splunk hasn’t incorporated more of this sort of
thing in the Monitoring Console /shrug.
My normal recommendation to folks is run a few queries to
capture log volume (internal index license log) and event counts (tstats) in a ‘summary index’ for long term retention and quicker analysis. Some of that is likely
found in the introspection index but I’ve not done a deep dive there TBH. The workshop I’m
doing is with folks in a multi-tenant environment where each would like to do
their own quick analysis.
So let’s define a few goals
The bug to write has bit again.
There aren’t a ton of quick resources nor do many orgs place a lot of emphasis on training for new managers. I’ve done a good bit of candidate prospecting and hiring over the last year so I’ll write through a bit through that lens across a few posts. I’m no expert but do have some thoughts on the subject.
You’re at a point where you must hire someone. What does
that process look like and where do you even start?
I’d begin by contemplating the following
After giving those a good think, here are some additional framework-y things to do some mental gymnastics on before you start. You will inevitably have to adjust as you go but limit how much of the plane you are building after it is in the air.
Whenever I see an article title like “<insert framework>: One framework to rule them all” as recently discussed here I’m simultaneously reminded of the following xkcd cartoon, which touches on the N+1 issues of framework consolidation, and my grandmother saying "you can’t change the direction of a parked car." Relative to achieving framework compliance I’m not sure if those two thoughts live on the same spectrum or make up 2 corners of a compliance related iron triangle. Not sure what the 3rd iron triangle corner would be though.
In part of one of this series I went down the path of Splunking game data from a 2 day, single challenge event. In this installment I'm going to dive into a bit of data from an event that encompassed several different challenges.
In looking back at the dashboard I created, how I was working with some of the data, and the sheer volume of data across all of the challenges - the dashboard itself might not have much value from a game analytic perspective lol. I also realized how much I focused on one challenge - waves. In looking back I think that was largely due to the numbers being smaller. The approaches to displaying the data will work across all of the events so at some level it would be a lot of copy and paste as well. At any rate hopefully folks will take something away from the underlying queries and some of the challenges with trying to display the data/volume of data. TBH this is the more primary focus of this overall effort.
Data was captured across 4 challenges, 3 player level brackets, and listed scores for the top 100 positions (other than the clan boss fight).
