Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
SplunkのData Model Accelerationは何故早いのか
Search
odorusatoshi
September 02, 2019
Technology
1
1.3k
SplunkのData Model Accelerationは何故早いのか
Data Model Acceleration(データモデル高速化)の仕組みをご紹介。
odorusatoshi
September 02, 2019
Tweet
Share
More Decks by odorusatoshi
See All by odorusatoshi
入門 PEAK Threat Hunting @SECCON
odorusatoshi
0
180
AWS VPC Traffic Mirroringを使って Fraud監視をスタート!
odorusatoshi
0
230
無償のセキュリティ神Apps10選
odorusatoshi
0
780
SplunkとThreat Hunting
odorusatoshi
1
1.4k
Splunking_webproxy
odorusatoshi
0
410
Splunking_ActiveDirectory
odorusatoshi
0
360
Splunking_fw_dns
odorusatoshi
0
550
Splunking_sysmon
odorusatoshi
0
480
Splunking_AWS_security
odorusatoshi
0
300
Other Decks in Technology
See All in Technology
OCI Success Journey OCIの何が評価されてる?疑問に答える事例セミナー(2025年2月実施)
oracle4engineer
PRO
2
220
Snowflake ML モデルを dbt データパイプラインに組み込む
estie
0
110
RayでPHPのデバッグをちょっと快適にする
muno92
PRO
0
200
急成長する企業で作った、エンジニアが輝ける制度/ 20250227 Rinto Ikenoue
shift_evolve
0
320
サバイバルモード下でのエンジニアリングマネジメント
konifar
21
6.6k
AWSではじめる Web APIテスト実践ガイド / A practical guide to testing Web APIs on AWS
yokawasa
8
770
開発組織を進化させる!AWSで実践するチームトポロジー
iwamot
2
520
IAMのマニアックな話2025
nrinetcom
PRO
6
1.4k
2025/3/1 公共交通オープンデータデイ2025
morohoshi
0
110
20250304_赤煉瓦倉庫_DeepSeek_Deep_Dive
hiouchiy
2
120
Apache Iceberg Case Study in LY Corporation
lycorptech_jp
PRO
0
360
"TEAM"を導入したら最高のエンジニア"Team"を実現できた / Deploying "TEAM" and Building the Best Engineering "Team"
yuj1osm
1
230
Featured
See All Featured
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
33
2.8k
Fontdeck: Realign not Redesign
paulrobertlloyd
83
5.4k
Typedesign – Prime Four
hannesfritz
41
2.5k
Building Adaptive Systems
keathley
40
2.4k
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
233
17k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
280
13k
Thoughts on Productivity
jonyablonski
69
4.5k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
3.7k
[RailsConf 2023] Rails as a piece of cake
palkan
53
5.3k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
30
4.6k
Gamification - CAS2011
davidbonilla
80
5.2k
Java REST API Framework Comparison - PWX 2021
mraible
29
8.4k
Transcript
© 2018 SPLUNK INC. © 2018 SPLUNK INC. Data Model
Acceleration Senior Sales Engineer 2019.07.06 Ver0.2
© 2018 SPLUNK INC. .C
@A024 # "$6 !E3 # # "$/; =Authentication# *#+ # "$172 &+%-D 9B)8 &+% ?: (,$# "$/;5<4 ># "$Authentication'"$
© 2018 SPLUNK INC. Pivot# " $ (=)
!
© 2018 SPLUNK INC. ▶ ,4) • +4)4('#:6A<(&.(2@ -1(.tsidx*2)EC •
-1indexbucket=?N • -17;UQ> -1TRM J -1307;UPO • (&.(2$03!/4D@85 -1@#)3"LKG?(& .(29C@1%#FSHB ▶ I • _raw .tsidx ”” .'+*,.)- !&.#+(.!.$
© 2018 SPLUNK INC. :8'+(.tsidx%,)/= #!(#, *-).10 .tsidx2&.!64?> rawdata
5 < 3;"10 .tsidx2$-97 RawData
© 2018 SPLUNK INC. #! "#!
*%($# +) ($ . "'&0/ • 100% 21($ # +) • 46.12MB- , !
© 2018 SPLUNK INC. VS " 5/ #$-6
0Authentication2 0Authentication!1' +%)$ ,* )$2 (&43 19.202. 4.633.
© 2018 SPLUNK INC. * ' @=+
E/BC46'(Linuxwindows vpn )< %&+46?> &#<1 CIM;D Datamodel9, | datamodel *A+ !(3/246' Datamodel8 ) $ Datamodel *A+ %( :@+ *A(tstats) 8 )F | tstats !(3/246' Datamodel8 SPL !) $ Datamodel *A+ %( :@+ Pivot-78 & #5. | pivot "-7 0 ,$( '# "( ( ) I M f e f e fd C M d
© 2018 SPLUNK INC. |datamodel
|datamodel Authentication search | search
© 2018 SPLUNK INC. |tstats Datamodel
|tstats summariesonly=true count from datamodel=Authentication groupby Authentication.user
© 2018 SPLUNK INC. stats VS tstats VS tstats(summariesonly=t) Firewall
! • 0.299 • tstats summariesonly=t • ! $ • 4.239 • tstats summariesonly=f • #"_raw • 28.966 • stats
© 2018 SPLUNK INC. ▶ #& $"%!& * https://docs.splunk.com/Documentation/Splunk/7.3.0/Knowledge/Aboutsummaryindex
ing ▶ PIVOT vs DATAMODEL vs TSTATS (by Splunk Answers) https://answers.splunk.com/answers/330264/pivot-vs-datamodel-vs-tstats.html ▶ ' How Search Works - $$TSIDXTERM + () https://www.slideshare.net/takashikomatsubara50/how-search-works-tsidxterm