Using Chart

0:00Welcome back and this time we are diving more into Splunk and a Power User. Now, before we get underway and into the weeds on the actual technicals and getting into labs and all that stuff, a quick refresher if you will. There is a link below this video, yes right below this video, that takes us back to the actual Splunk core certification course. So if you want to be able to get the basics in, let's say you've gotten this course first and you're like, I want a little bit more basics before continuing, that course is right below. That being said, I don't want you to think that the two courses are reliant upon each other. We make these courses and skills to be more standalone, so that way if you start here and go through the entirety of the course overall, you should have a very firm understanding of what it is that we're getting into. But just in case you want that little beginner or refresher, if you want to go back and kind of freshen up a little bit, it is below. Now that being said, the difference between that course and this course is the actual word of power in terms of Power User. That's right. See, in the previous course, we covered Splunk user capabilities as in terms of like, you know, in a SOC, Security

1:17Operations Center. Somebody's just in as a regular user inside of Splunk and they're able to pull up basic reports and features, get some information from search results in the SPL, all sorts of great stuff. But as we continue on and we want to be able to customize and make Splunk work more for us in ways that we need that are more tailored to our organization, we need more permissions and more capabilities. And that's where the actual Power User comes into place at. See, it's not all the way the administrator of Splunk itself, but it does carry with it a little bit more weight in terms of configurability and also flexibility.

2:01Now we'll cover real quick just the basics between a standard user and a Power User. Not that that's really going to have a full force effect on the rest of this course, because we're more focused on actually using and leveraging Splunk in that power mode. Now, the account that we have inside of Splunk does have a lot of administrative privileges already using the learner. And in fact, if you look below where the lab link is inside of the skill, you'll see a little sticky with the username and passwords. That'll become more important here very shortly. That being said, the way this lab was set up doesn't truly define differences between regular user and Power User, because we had to make some modifications to make it a debt lab friendly. So that's why I wanted to cover with you the differences between standard user and Power User before we moved on. And as a standard user, our primary focus was basically searching, analyzing data and personal reporting, tailored to me, the individual. And as a Power User, we start building shared knowledge objects to be able to share throughout the actual organization itself and optimizing team workflows. So instead of just making it just for me,

3:18let's say I'm the actual sock shift leader for nighttime, which is what I did in the army for a good bit. I would make those dashboards and search queries and alerts for our team and nighttime monitoring and the overall OSC or officer in charge would have their own flow of things that they would do that we would monitor as well. So a power, power user, if you will. Now that trickles down into what we know already is like different properties of different level accounts with permissions. Just applying that mindset into Splunk itself is what we're going to be working with throughout the rest of this course. Now, as a power user, you're going to have more object ownership, the more capabilities to save searches and actual alerts. Now this ties into the actual dashboard capabilities as well, along with the detailed searching terms that you want to be able to use. Now, like for example, in this skill, we're actually going to be getting into chart pretty quickly. This shows us how we can actually optimize the data that comes up in the actual inputs. Now that takes us into why are we doing this as a power user? Well, as a power

4:36user, we are able to make the information display pretty is the very simplistic way of putting it and creating those workflows for our teams. Allow is a way for us to be able to make the information that is being ingested into Splunk more manageable and less scary for everybody working with Splunk or in the SOC overall. We may have certain methods, operating procedures, SOPs, policies, whatever the case may be within our organization, the states, how we have to actually handle certain types of information and long events. And that plays into a large part of what's going inside of this particular course. Do remember this though, regardless of how it is that we as individuals want our actual Splunk in the enterprise environment, always consider and, you know, take into account the corporate policy set forth by either the CEO, CIO, CISO, anybody in that C-suite that is directly above. Now, if you are that CIO, CISO, good for you.

5:45And I hope you take into this, into some bits of advice for the actual workers inside of the SOC working in with Splunk and also regurgitating those events in ways that make it pretty for the executive suite.

0:01I wanted to start off with some lab notes for you real quick. If you have not taken the previous course, that's okay. Remember that. That's perfectly okay. But if you're starting here, there's a couple of things I want to get you used to real quick. What we are taking a look at here is going to be the general lab that we use throughout the rest of this course. And one thing that you'll notice is that when the lab starts up, you get this virtual machine connection error. I have not figured this out yet, and I apologize. But all you got to do is just click OK. After that, we're going to go inside a Splunk VM that's on the top right.

0:32And if at any point, let's say you're in a different skill, and you don't see the sticky inside of this particular skill next to the actual lab link itself in here, that's okay. There's a text document on the desktop called passwords.txt. And this is split up between two credentials here. First, you have Splunk VM, which is the actual top right VM that you're going to be using Splunk out of. And then the Splunk UI that gives us the username and password for being able to go into Splunk itself, because we have Splunk pre-installed with a pre-configured data set as well.

1:10Now, I'm not going to put the link to the actual data set in here, in this particular skill yet. We have it in here, and we'll start talking about how that plays a factor into our data momentarily. Just know that in the previous course, we have that configured for you as well, along with where to get that basic information if you want to build one of these at home yourself. Do keep in mind that the data set that we are using is under the limitations of expensive pricing for Splunk licensing.

1:41So you may not get the full immersion experience inside of Splunk for data reports, but there is a large amount of data that's still in here. That being said, your organization may have 10 times as much information as being ingested into its database. And if that's the case, expect time differences to vary between real life and what we have here in the DevLab. And we see here that we have Splunk on localhost. You may have to go in and press start, but it's at a save state.

2:12It may take just a couple of minutes to fire up and warm up for you and have the services running. I tell you all this to kind of prep you for the actual rest of the course overall as we start getting into church.

0:00As we continue throughout the skills and of course you may see some little time jumps here and there and that's because I'm cutting out a lot of the waiting time. So let's go ahead and start out up here over there with logging into our Splunk UI and that is again in the sticky note upstairs and we are going to start off with a learner and go ahead and sign in and there's a couple things I want to show you here real quick once we get inside of Splunk. Once we're logged in, we're taken to our default screen inside of Splunk because nothing has been set up yet in terms of like dashboard and all that other great stuff.

0:34There's a couple of tidbits I'd like for you to keep in mind as we do throughout this course together. First, let's go down to search your data and that will be on the main bookmarks page of Splunk when you first log in. I'm going to zoom in for you here real quick so you can see it. Search your data. Now this is the standard SPL and when we go in here, you'll see that we have a search bar and SPL search history. There's two things to keep in mind here. Number one is the primary index that we will be searching through is index bot SV3 and I will have this in a code box below for you.

1:11Now along with that, we need to understand that the data set that we have in here is a tad bit dated a couple of years in fact. So if you're wanting to do a raw search like this inside of index bot SV3, you will need to go to this drop down just to the right of the search bar up yonder and select a time range of all time just to get an idea of how all of this information comes up. And as we sort through here, notice that it is taking a second to load the information up, but you are getting events that have been ingested into Splunk.

1:49Now this was a predefined data set and normally you would have ingest points and also forwarders, either normal forwarders or heavy forwarders going into Splunk itself, but this is the actual information that you'll be getting in the actual raw data form. And that brings us into the main focus of the skill and that is creating charts out of this, because we can go through here and search specifically for different things and different events, so to speak, as granular as we want to or as broad as we want to, but as we are creating our dashboard events or something for our team to use, we would want to use a chart to be able to represent something pretty simplistic to view, especially when you're dealing with the executive folks. Now, I'm not trying to pick on executives or anything like that, but I will pick on army officers, because army officers love green and whenever something is not green, they panic.

2:54So when they see the charts that we will develop in here, if there's any red on there, they will panic, but that's just their nature. But the charts are for us to be able to get a quick visualization of what's actually happening within different points of our data that were specifically highlighted inside of our index or data set. And remember, you can have multiple data sets inside of your Splunk. I don't have that here in this lab, but we are simulating the fact that we have multiple sets by setting index equal bot SV3 as our primary search index or data set.

3:36Now, as you can see here, I have gone further by refining my search results, not just inside of index bot SV3, but I have also searched, as I zoom in for you, my source of stream semicolon, colon, semicolon DNS, meaning I'm looking at all the events within my data set of bot SV3 that match a source of stream DNS. You can see that first event there that happened on 8-20-18 at 8-18 a.m. If we go ahead and scroll that down, you can see in there where we will have a source of stream DNS, specifically like with destination port 53, that port lining up to be in DNS.

4:26Now, there's more that you can take out of this as well, too, but you'll also notice specifically as I zoom in for you, there are 175,094 events that match the criteria for what we just put inside of our search bar of index and then the actual source of stream DNS. So, there's a lot of events that match this broad spectrum criteria, but in order for us to be able to visualize what's actually happening a little bit further, we can implement the command of chart, and we will do this by including a pipe.

5:01We usually shift right below the delete key on the backspace key on the keyboard, so top right section, and I'm going to paste one in here for you, chart count by source IP address. So, what we want to do is create a chart that is giving us a count by the actual source IP addresses, count meaning that it's going to count the number of occurrences each source IP address that's unique pops up inside of our actual count here.

5:35And when we search for this, do know that it may take a few minutes or seconds, depending on how you start this VM up or have your own server running, but as you can see here, we have a chart now of all the actual source IP addresses. You can see that on the left, we have the individual IP addresses, and then on the right, the actual counts that they actually came into. Now, don't worry, we will be getting more into different types of charts and everything like that later on. I just wanted to give you a basic of what the actual chart is and can do.

6:10So, as we scroll through here, we are seeing that we have all those unique IP addresses and the number of times that they come up. So, on the left, you can see that we have, for example, 172.16.0.13. On the right, you can see that it appeared 6,041 times. And we are not sorting by the count, but in a fashioned order of numerical sense inside of our actual source IP, which was inside of our actual search criteria for the actual chart itself.

0:01Now where we left off allows me to show you and demonstrate the differences between chart and stats. What we're really taking a look at here, even though we use the chart command as a pipe on the actual search itself to give us the information that we requested, we are actually taking a look at a stats representation. And as you can see, this is not a chart by any means whatsoever. So what is the difference between stats and charts? Now stats is what you see here just by the numbers or by the raw data broken up into statistical representations of numerical counts.

0:39And the actual chart is going one step further to display it in prettiness. And we do that by zooming in and you see where stats 35 has a square around it. We want to go into the actual visualization. So let's take a click on the visualization, scroll down, and now you see a chart. That's right. All the different pieces of information that we got out of our specified search using the chart pipe, allow us to be able to create a representation in chart form.

1:13And if we scroll down even further, we can see that all our actual data is right below it. Now we can hover over these different points of data inside of our chart and see the actual source IP address and count. I will zoom in for you. This is important because this is specifically what we requested inside of our search itself when we said by source IP address. And also keep in mind that the basic of the search itself was through stream colon DNS.

1:48So if we took out the source type of stream DNS, you would see all the pieces of data here, and the chart would be created based on the actual source IP address that we put into our pipe command. Basically we're just segmenting the different searches, the broad search, to give us a more detailed view of what's happening inside of our data set. Now the more that you're actually looking for in terms of search criteria, the more you focus in on that, the more detailed that your chart is going to be.

2:23You will see that this is based in two different categories, meaning that the x-axis here is the source IP address that we were searching for, or sorting by, and that the count is the y-axis. So if you look, you can see that it goes all the way up to 40,000. Now it's not 40,000 that you're going to see in there, but you will see some because the chart is sorting by 10,000 here. The source IP address 17231-1276 has a count of 28,804.

2:57And on the source IP address, again, it's getting some semblance of numerical ordering for us to be able to compare to. Now you can go even further by making this chart more customized for you. And you do this by going to the top left of the actual chart itself to select the actual visualization. Some of these words are tongue twisters, bear with me. You can see that we have all sorts of different visualization types, and I do want to point out that if you click on Find More Visualizations here, you aren't really going to get anything back because we have the internet turned off for the actual Splunk VM itself due to how Splunk operates.

3:41But that's okay. The basics are what we really want to have in here. You have bar graphs, you have pie graphs, you have scatter charts, you have all sorts of different things that make you shudder and happen to go through stats, which ain't a math class inside of a graduate course. So as a demonstration, let's pick on the actual pie chart for a second. And you can see here that this is what we get. Not only do we get the IP addresses in IPv4, but you'll notice on the top left there is an IPv6 address as well.

4:13And it gives us many, many different colors to represent the slices of the pie that each one of those source IP addresses that was searched for in our initial search represents a different color. So if you were to click on one of these, what would happen instead of just hovering over it? Because we're hovering over orange here, and it tells us the actual source IP address, the count, and the actual count percentage of the overall search criteria.

4:43Well, if we click on it, we can go to see that it gives us a very detailed view of the actual search criteria. Instead of putting chart command in there, it modifies the SPL to say, index our data set, the source that we've already been looking for, and now it modifies it, takes out the chart, with the actual source IP of 172.16.0.178. Now look, I want to show you something.

5:14You'll notice that we still have that visualization tab. And if you click on it here, you'll notice that there's nothing there. Why is this? We didn't chart, that's why. But we can go back to the actual events, which are 23,966, and create a chart on that based on what we want to count by. And in this particular instance, I just pasted that in there because it's what I copied from the previous search. I want to do a chart count by, not source IP, because we're already doing a broad search by that.

5:49Let's say, let's scroll down and take a look at this one here, or a couple of them here real quick. Let's say, destination IP, DEST underscore IP. And do a search on this. And you'll notice that when it finally loads up, we have our destination IP from our source IP. But when we go into visualization, we now have a chart. Now is this very detailed information for us to know?

6:21No, I picked the wrong field to be searching by, from source to destination. My bad. But you get the idea now that we have invoked chart. Chart now knows to run for the visualization because of the sub pipe command on the actual search itself.

0:01Now as you see here on the screen, I already have a chart created and I'm going to explain this for you, so fret ye not. What I've done is I've searched the actual index that we have our data set in that's default for us in this lab for an event code of 4625. Now this is specific to Windows operating systems and event ID 4625 on Windows systems are failed login attempts. And I went ahead and did a pipe to chart to be able to count by the number of hosts.

0:34And when we go to the visualization of this, you can see here that these are all the hosts within our data set that have failed logon attempts to them. And I've customized this to a pie graph because I like pie. And the next thing you may be wondering is that, okay, well, this is all good and everything, but how do we keep an eye on this? Because this can increase if somebody starts logging into a system multiple times and fails continuously.

1:06So how do we keep it to where the actual pie chart is consistent with actual live data? Should we have it just for R or a Splunk? I'm glad you asked. If you look up at the top, you'll see save as right above where it says time range in our drop down menu. And there's a couple options that you could do here. One is add it to an existing dashboard or create a new dashboard with it. And this is where all the dashboards inside of Splunk generally start beginning life at.

1:40Because we do a search, apply criteria like chart and other things that we'll see later on, and then we take that and apply it to an actual dashboard itself. So we're going to create a new dashboard with this. In this dashboard title, I'm going to close out of that demo right there, we're going to call this failed logins. And I don't really need to add a description in there, but right here you'll see in the permissions that this is where the actual power user permissions come into play here.

2:16Because we can set it to private and that's available to every single user regardless of permission levels, but it's only available to us. Whereas if we share it in the app, it's visible to app users and can be elevated by our power user status to be shared to people within our team. And this is why being a power user and leveraging Splunk in this manner is pretty important. Because we can create all this and not have to reinvent the wheel with every single person on our actual teams.

2:51Whether night shift, day shift, or it doesn't matter where they work at. As the manager, you're going to create what's actually important to be monitored and the individual users inside of Splunk are going to be able to create their own dashboards, of course. But it will complement what our actual focus is from the management level. And while the managers that are creating this inside of Splunk may not typically be the C-suite folks, we are getting that directive from the C-suite in order to be able to create something like this.

3:25So we're going to say share in app and then you have a couple of options. Classic dashboard or a dashboard studio. We're just going to go with classic dashboard and I'm just going to call the actual panel title failed login attempts. Make sure I spelled that right. And you see that we have the visualization type I put in pie chart. We can scroll down and make sure that everything's good. But now I can just save this to dashboard.

3:55Now the panel has been created and added to failed logins. You may now view the dashboard. So let's go view the dashboard. Now inside of the actual dashboard itself, you're going to see where it says waiting for data. This will update as more information flows into the actual Splunk ingest point. So if you have multiple Splunks that are important within the organization, you may have to wait a few minutes before everything starts talking all together, depending on latency, speed of the network, etc, etc.

4:28But this is the actual representation of what we just looked for in chart form inside of our actual Splunk search, which narrows down exactly what it is that I as a manager am looking for with interest. Because now I can just hover over and say, well, host SEPM has had two failed logon attempts. Now there is more context missing from this, but I wanted to give you the basic level scratch surface type thing. Are those two failed logon attempts repetitive, like within a second?

5:00If they're within a second, then it's probably automated and malicious in nature. If it's spread out over like a minute or so, somebody probably fat fingered something or they just said, I missed the first time. Take a deep breath. I'll come back and try again later. These don't really ring alarm bells to me as a SOC manager, but I want it to be noticed on the actual dashboard itself. And as like I said, as you start getting in more information through the actual Splunk, through your forwarders, this will grow depending on how many failed attempts actually happen.

5:41But keep in mind too, this does not cover POSIX based systems like Unix and Ubuntu, Kali, etc. This is more focused on the Windows side because what do we do? Well, we search by event code, event type inside of Windows. We can double check this by going to the left side of the screen, going into search and expanding our SPL history. You can see that we actually search for event code 4625, charted it by count by host, which is how we got that pie graph after we changed visualizations and stuff.

6:17But wait, I hear you say, where's the dashboard at? Glad you asked. On the top left, you'll see the three lines there below where it says Splunk. Click on that and go to where it says dashboards. I have my mouse on it. I'm going to zoom in for you right there. It's the second one from the bottom right above modules. You can click on dashboards, go into your actual dashboard listings and see here where the dashboards are being created, shared from, etc.

6:48And the private ones will list in here and the ones shared with you will be listed in here as well. If you're a power user managing a team inside of a SOC, those individual Splunk users with just general user permissions will be able to go into their dashboards and see all the different dashboards that have been created or assigned to them. I come in, I'm a user, I want to look at what's going on and the focus from the boss tonight is failed logins.

7:18So I can very easily go to failed logins, pull up the dashboard and not have to go through all the actual searching in SPL to create the visualization that we have here.

0:00Now you may have noticed that I have changed up my SPL query here for my searching. I'm going to zoom in and show you what I'm talking about. I am still searching for failed logon attempts, but as you can see here, now I'm piping to a new command. Time chart, where we jump in our DeLorean and go 88 miles an hour back to 1985 to figure out who did this and when. You can see that I am sorting in my stats view by time and our time is in 2018.

0:32So this is going to be a little tricky to demonstrate and explain for you because there's a lot of neat things that you could do with time chart. Unfortunately, with our data set in this test environment, we cannot leverage or demonstrate near any of them. The time chart allows us to be able to put a time stamp on everything we've already been through with the actual charting command itself that was piped into our search. So now we're putting a time principle on what actually happened within the organization.

1:05If we remember in the previous chart that we just saw how many failed logon attempts there were, not when they happened or the span of when they happened. I tease that for a very specific reason because that just gives us the overall view of how many failed attempts there were overall. But when you start getting into time chart, we can actually narrow this down and have a more detailed view on things that happened within a specified time frame. And again, this is going to be a little bit difficult to demonstrate, but allow me to regale you here for a second.

1:41So let's say that we have on our dashboard, and you'll see this momentarily, a chart for our failed logins and a chart of all time. And then a chart to show recent failed logins with a span in there to show us how often they actually happen. So remember within a minute or two or within a full second, that raises eyebrows. So here you can see that I have time chart count by user. So now I'm trying to get a count on the actual users and how many times they failed logins so I can kind of pinpoint where my failure point is.

2:19And I can go into visualizations for this and see, you know, bar graph is by default, but I'm going to select pie graph because it's a little bit easier. You can see that, you know, if I scroll down, guest seems to be a big one here and causing the problem. Now again, this is going to cause a little bit of frustration because we can't demonstrate this live. But if you allow me, but allow me here for a second to entertain you.

2:52So if I were to go into my search bar and then after time chart said span equals five minutes, 5M, and then press enter, we're not going to have anything come up because we don't have live data being ingested into this actual Splunk itself. Well, here we go. Proving me wrong. So these all happened within five minutes of each other. So these two right here happened within that time frame. And that may or may not raise eyebrows to you.

3:24So you may say, I want to track failed login attempts for, let's say, if they happen within five minutes or two minutes or one minute, right? By each specified user within the organization. Along with having on your dashboard, the systems in your chart that show you the overall chart event IDs of failed logon. You can compare those two and see if there's an actual system under duress or a user account that is being leveraged or trying to be leveraged as a security manager.

4:03Now, the best question here is, is how do we put these two together? Well, this too will go inside of our dashboard, if you want. That's for you managers out there. We simply go to save as, and then this time we're going to go to an existing dashboard. And we can just drop down and see that we have failed logons. Now, I'm going to call this one time span 5M for five minutes and then save to dashboard.

4:36And we're going to go ahead and click on view so we can see them put together and how this works out for us. Now, this data is still coming in. As you can see there, we have the systems up here that had failed logon attempts to them on the actual systems themselves. And here we saw that a user meeting the criteria of having failed logons within that five minute span. Now, this will also update and will get more muddied up depending on when that time period passes in real time environments.

5:09So, just open mind here. Know that in a real Splunk environment, you can set this criteria up to where it will auto refresh in your dashboard using that five minutes. So, let's say a user comes in right this second and says, failed logon attempt, failed logon attempt, failed logon attempt. And it's going to pop in that bottom pie chart for us and update instantly because we have data that's constantly being exported or imported into our Splunk.

5:39And you can even see down on the bottom right that we have a refresh button to allow us to be able to manually refresh the update on this because it does it every minute or so. If you want to be able to have eyes on real close and make sure that nobody's blinking at you out of nowhere on this, you can hit refresh, refresh, refresh. I can't say it that fast too many times, but you get the idea. So, time chart is a play on the actual chart itself, but allows us to be able to see charting in a small snippet of time instance, almost like time traveling.

6:17Thank you.

0:01We're going to wrap things up with a challenge by covering our knowledge of the command of chart inside of Splunk. Now I'm going to give you a few hints and everything to get you ready right below this video so that way you're not too out there. Because some of you may or may not be familiar with Windows. Some of you may be more familiar with Mac or POSIX based systems and that's okay. So now what we're looking for is inside of our data set the number of users that have been created through all time in a chart by user.

0:36So again I'm going to put the actual SPL below but where the challenge comes in here is that not only do you need to be able to search for this through all time. But also add it to a dashboard or create a new dashboard for it as well too. So that way it can be shared amongst your team members in the rest of the organization since we are managers of the SOC in this exam. So I'm going to let you do it and then when we come back in the actual solution we'll walk through it together and see if we got it.

1:09Be right back.

0:00Now in our challenge we set out to see if we can create a chart of users being created within our organization. A couple of things to keep in mind is that I gave you the search criteria for SPL inside of Splunk in the challenge. And we need to make sure that our time is set to all time. And I was doing this thinking that I was already on the screen. I wasn't. So here we go. Now after having ran our actual search criteria, we can see that only one account has been created. The actual as I zoom in for you SVC VNC. Again this is only a Windows account creation because we're searching for it by event code 4720 which is native to Microsoft as an event ID for account creation. So I should say that we're looking for accounts created in Windows. Whether it be on a local system or in Active Directory, it doesn't matter. If we have all systems reporting to our Splunk for forwarding events, then that means that we're going to catch all of these events coming from Windows regardless of whether it's a workstation or actual domain controller. And you can see that we're creating a chart count by user. And so in order to turn this into an actual chart itself to take it to our dashboard, we're going to go to visualization. Now as the accounts are

1:19created throughout the organization, you will see this populate and you will see it also go through and expand. But in order for us to do this real quick, we want to go ahead and export this by save as to a new dashboard. And here we're going to say new accounts description and it's up to you. But here in the permissions is kind of what I wanted you to really focus in on. And that is dashboard type is either going to be private for an individual or if you're a manager that needs to share this with your team or organization, it needs to be shared in an app to make it visible to other users. And whether you click a classic dashboard or dashboard studio is up to you.

2:07But I am going to call this user creation under the actual panel title. That's the subsection within the dashboard itself. And save to dashboards. And then I'm going to go view it. And we can see here that we just get the basic bar graph when it pops up, boom shakalaka. And inside we see that our one account has been created. Now we can go in this and get further details, but I wanted to show you as well too as a reminder, on the left when we go into dashboards, you will see here that now we have another dashboard for new accounts and failed logins.

2:46Look on the far right and see if it's a sharing, if it's global, if it's app, if it's who has permissions to it and you can get with the owner of that actual dashboard to see if it's available to you or can be made available to you when you're doing your time on the Splunk inside of your night shift. I do night shift because I can get away with playing games, right? Of course not. We always take night shifts seriously. The important thing is here that we know that we can start creating charts that will natively update themselves automatically based on the amount of data being ingested into our Splunk. And as we start receiving more data, the charts start getting bigger and more detailed and we can formulate these charts to be more, let's say good, bad, ugly, somewhere in between or to find how we see fit for our dashboards in the future. So this allows us to be able to put a pinpoint visual on things that we absolutely want to keep track of, but in pretty colors and also keep a couple of charts going to see if it matches a certain time span criteria using time chart. But I want you to keep this in mind as we move forward and start including all of this together as a power user inside of Splunk.

4:05I hope this has been informative for you and I'd like to thank you for viewing.