Summary

In this chapter, we covered searching in Splunk and doing many useful things with those search results. There are lots of little tricks that we will touch upon as we go forward.

With Splunk version 7.0, event annotation was introduced so we added a section on that topic.

In the next chapter, we will start using fields for more than searches; we'll build tables and graphs, and then we'll learn how to make our own fields.