hello
everyone we are getting started here on
our August lunch and learn session
presented by Ken group's Atlas customer
experience team my name is Alice Deane I
am the engineering manager for the atlas
customer experience team and I'm excited
to be presenting this month's session on
intermediate level Splunk searching so
thank you all for attending I hope you
get some good ideas out of this uh and
certainly encourage engagement through
the chat uh and I'll have some
information at the end on following up
uh and speaking with my team directly on
any issues uh or interests that you have
uh around these types of Concepts that
we're going to cover today so uh jumping
into an intermediate level uh session I
I do want to say that we have previously
done a basic level uh searching uh
session so that we are really
progressing from that picking up right
where we left off uh we've done that
session with quite a few of our
customers individually uh and highly
recommend if you're interested in doing
that or this session with a larger team
uh we're happy to to discuss and
coordinate that uh so getting started
we're going to take a look at the final
search uh from our basic search session
uh and we're going to walk through that
understand some of the concepts uh and
then we're going to take a step back
look a little more generally at SPL
operations and understanding how
different commands apply to data uh and
really that next level of understanding
for how you can write more complex
searches and understand really uh when
to use certain types of commands uh and
of course uh in the session we're going
to to have a uh series of demos uh using
a few specific commands highlighting the
different SPL command types uh that we
discuss in the second portion uh and get
to see that on the tutorial data uh that
you can also use uh in your environment
in a test environment uh very
simply so I will always encourage uh
especially with search content that you
look into the additional resource that I
have listed here the uh search reference
documentation is one of my favorite
bookmarks that I use frequently in my
own environments and working in customer
environments uh it is really the the
best quick resource to get information
on syntax and examples of any Search
Command uh and is always a great
resource to have the search manual is a
little bit more conceptual but as you're
learning more about different types of
search operations
it's very helpful to be able to review
this
documentation and have reference
material that you can come back to uh as
you are studying and trying to get
better and writing more complex uh
search content I have also linked here
the documentation on how to use the
Splunk tutorial data uh so if you've not
done that before it's a very simple
process uh and there are consistently
updated download files that spun
provides uh that you're able to directly
upload into any spunk environment so
that's what I'm going to be using today
uh and given that you are searching over
uh appropriate time windows for when you
download the tutorial data set uh these
searches will work uh on the tutorial
data as well so highly encourage after
the fact if you want to go through uh
and test out some of the content um
you'll be able to access a recording as
well as if you'd like the slides that
I'm Pres presenting off of today which I
highly encourage because there are a lot
of useful links in here uh reach out to
my team again right at the end of the
slides we'll have that
info so looking at our overview of basic
search uh I just want to cover
conceptually uh the two categories that
we discuss in that session and so those
two are the statistical and charting
functions uh which consist of in those
demos aggregate and time functions so
aggregate functions are going to be your
commonly used statistical functions uh
meant for summarization uh and then time
functions actually using uh the
timestamp field underscore time or any
other time that you've extracted from
data uh and looking at earliest latest
uh relative time values uh in a
summative fashion and then evaluation
functions are the separate uh type where
we discuss comparison and conditional
statements so using your if and your
case commands uh in
evals uh also datetime functions that
apply operations to events uniquely uh
so not necessarily summarization but
interacting with the time values
themselves maybe changing the time
format uh and then multivalue evalve
functions we touch on that very lightly
uh and it is more conceptual in basic
search So today we're going to dive in
as part of our demo and look at
multivalue eval functions uh later in
the
presentation so on this slide here I
have highlighted uh in Gray the search
that we end basic search with uh and so
that is broken up into three segments
where we have uh the first line being a
filter to a data set uh this is very
simply how you are sourcing most of your
data in most of your searches in Splunk
uh and we always want to be a specific
as possible you'll most often see the
The Logical way to do that is by
identifying an index and a source type
possibly some specific values of given
fields in that data before you start
applying other operations in our case we
want to work with a whole data set uh
and then we mve into applying our eval
statements
so in the evals the purpose of these is
to create some new fields to work with
uh and so we have two operations here uh
and you can see that on the first line
we're starting with an error check field
uh these are web access logs so we're
looking at the HTTP status codes as the
status field and we have a logical
condition here we greater than or equal
to 400 we want to return errors and so
very simple example uh making it as easy
as possible if you want to get specifics
on your 200s and your 300s it's the
exact same type of logic to go and apply
uh likely a case statement to get some
additional conditions uh and more unique
output in an error check or some sort of
field uh indicating uh what you want to
see out of your status code so this case
simple errors or the value of non here
if we have say at
200 we're also using a Time function to
create a second field called day uh you
may be familiar with some of the uh
fields that you get out of uh by default
for most any events in Splunk uh and
that they're related to breakdowns of
the time stamps uh you have day month uh
and many others in this case I want to
get a specific format for day so we use
a strif Time function uh and we have a
time format variable here on the actual
extracted time stamp first of BL so
coming out of the second line we've
accessed our data we have created two
new fields to use and then we are
actually performing uh charting with a
statistical function and so that is
using time chart and we can see here
that we are counting our events that
actually have the error value uh for our
created error check field and so I'm
going to Pivot over to uh Splunk here
and we're going to look at this search
and I have commented out uh most of the
logic we'll step back through it uh we
are looking at our web access log events
here uh and we want to then apply our
eval and so by applying the eval we can
get our error check field that provides
error or non-error we're seeing that we
have mostly non-error
events uh and then we have the day field
and so day is actually providing the
full name of day for the time stamp for
all these events so with our time chart
this is the summarization uh with a
condition actually that we're spanning
by default over a single day so this may
not be a very logical use of a split by
day when we are already using a time
chart command that is dividing our
results by the time bin uh effectively a
span of one day but what we can do uh is
change our split by field to host and
get a little bit more of a reasonable
presentation we were able to see with
the counts in the individual days not
only split through the time chart but by
the day field that we only had values
where our Matrix matched up for the
actual day so here we have our uh hosts
one two and three and then across days
counts of the error events that we
observe so that is uh the search that we
end on in basic search the concepts
there being accessing our data uh
searching in a descriptive manner using
our metadata Fields the index and the
Source type uh the evaluation functions
where we're creating new Fields
manipulating data uh and then we have a
time chart function uh that is providing
some uh summarized statistics here based
on the time
range so we will pivot back and we're
going to take a step back out of the SPL
for a second just to talk about these
different kinds of search operations
that we just performed so you'll hear
these terms uh if you are really kind of
diving deeper into actual operations of
Splunk searching uh and you can get very
detailed regarding the optimization of
searches uh around uh these types of
commands and the order in which you
choose to execute SPL today I'm going to
focus on how these operations actually
apply to the data and helping you to
make better decisions about what
commands are best for the scenario that
you have or the output that you want to
see uh and in future sessions we will
discuss the actual optimization of
searches uh through this optimal order
of functions uh and some other means uh
but just a caveat there that we're going
to talk uh pretty specifically today
just about these uh individually how
they work with data uh and then how you
see them in
combination so our types of SPL command
the top three in bold we'll focus on in
our examples the first of which is
streaming
operations uh which are executed on
individual events as they return by a
search uh so you can think of this like
your
eval um that is going to be doing
something to every single event uh
modifying Fields when they're available
uh we do have generating functions uh so
generating function are going to be used
situationally where you're sourcing data
from uh non-indexed data sets and so you
would see that from uh either input
lookup commands uh or maybe tstats
pulling information from the tsid X
Files uh and so generating the
statistical output based on the data
available there transforming commands uh
you will see uh as often as streaming
commands generally speaking and more
often than generating commands where
transforming is intended to order
results into a data table and I often
think of this much like how we discuss
the statistical functions in basic
search as summarization functions where
you're looking to condense your overall
data set uh into really manageable
consumable results uh so these
operations that apply that summarization
are transform perform we do have two
additional types of SPL commands uh the
first is orchestrating uh you can read
about these I will not discuss in great
detail uh they are used to manipulate
how searches are actually U processed or
or how commands are processed uh and
they don't directly affect the results
in a search how we think about say
applying a stats or an eval uh to a data
set uh so if you're interested
definitely check it out uh link
documentation has details there um data
set processing is seen much more often
uh and you do have uh some conditional
uh scenarios where commands can act as
data set processing so the uh
distinction for data set processing is
going to be that you are operating in
bulk on a single completed data set at
one time so we'll we'll look at an
example of
that I want to Pivot back to our main
three that we're going to be focusing on
and I have mentioned some of these
examples already uh the eval functions
that we've been talking about so far are
perfect examples of our streaming
commands uh so where we are creating new
fields for each entry or log event uh
where we are modifying values for all of
the results that are available uh that
is where we are streaming um with the
search functions input lookup is
possibly one of the most common
generating commands that I see uh
because someone is intending to uh
Source a data set stored in a CSV file
or a KV store collection uh and you're
able to bring that back as a report and
use that logic uh in your
queries so that is
uh not requiring the index data uh or
any index data to actually return the
results that you want to
see and we've talked about stats very
generally speaking uh with a lot of
unique functions you can apply there uh
where this is going to provide a tabular
output uh and is serving that purpose of
summarization so we're really
reformatting the data uh into that
tabular report
so we see in this example search here uh
that we are often combining these
different types of search operations so
in this example that we have uh I have
data that already exists in a CSV file
we are applying a streaming command here
uh where evaluating each line to see if
we match a condition and then returning
the results
based on that evaluation and then we're
applying a transforming command at the
end which is that stats summarization
getting the maximum values uh for the uh
count of errors and the host that is
associated with that so let's PIV over
to Splunk and we'll take a look at that
example so I'm just going to grab my
search here and I pre- commented out
uh the specific uh lines following input
lookup just to see that this generating
command here is not looking for any
specific index data uh we're pulling
directly the results that I have in a
CSV file uh here into this output and so
we have a count of Errors observed
across multiple hosts our where command
uh you might think is reformatting data
in this sense it it is transforming the
results but the evaluation of a wear
function does apply effectively to every
event that is returned uh so it is u a
streaming command that is going to
filter down our result set based on our
condition that the error count is less
than
200 so the following line is our
transforming command where we have two
results left uh 187 for host 3 we want
to see our maximum values here of 187 on
host 3 so our scenario here has really
uh covered where you may have uh hosts
that are trending toward a negative
State you're aware that uh the second
host had already exceeded its uh
threshold value for errors but host 3
also appears to be trending toward this
threshold uh so being able to combine
these types of commands uh understand
the logical condition that you're
searching for uh and then also providing
that consumable output uh so combining
all three of our types of commands
here so uh I'm going to jump to an SPL
demo and as I go through these different
commands uh I'm going to be referencing
back to the different command types that
we're working with I'm going to
introduce in a lot of these searches uh
a lot of small commands uh that I won't
talk about in great detail and that
really is the purpose of using your
search manual uh using your search
reference documentation uh so I will
glance over the use case uh talk about
how it's meant to be applied and then
using in your own scenarios uh where you
have problem you need to solve uh
referencing the docs to find out where
you can apply uh similar functions to
what we observe in the the demonstration
here so the First Command I'm going to
focus on is the Rex command so Rex is a
streaming command that you often see
applied to data sets that do not fully
have data extracted in the format that
you want to be using um in your
reporting or in your logic uh and so
this could very well be handled actually
in the uh configuration of props and
transforms and extracting fields at the
right times and indexing data but as
your bringing new data sources you need
to understand what's available for use
in spunk a lot of times you'll find
yourself needing to extract new fields
in line in your searches uh and be able
to use those in your search Logic Rex
also has uh a said mode that I also see
testing done for masking of data in line
prior to actually putting that into
indexing
configurations um so Rex you would
generally see used um when you don't
have those fields available you need to
use them at that time uh and then we're
going to take a look at an example of
masking data as well uh to test your
Syntax for a said style replace uh in
config files so we will jump back over
so I'm going to start with a search on
an index Source type uh my tutorial data
and then this is actual uh Linux secure
logging uh so these are going to be OS
security logs and we're looking at all
of our web hosts uh that we've been
focusing on
previously in our events you can see
that we have uh first here uh an EV that
has fail password for invalid user in
that we're provided a source IP a source
port and we go to see the fields that
are extracted and that's that's not
being done for us automatically so just
to start testing our logic to see if we
can get uh the results we want to see
we're going to use the Rex command and
in doing so we are applying this
operation across every event again a
streaming command we are looking at the
raw field so we're actually looking at
the raw text of each of these log events
and then the rec syntax is simply to
provide in double quotes uh a Rex uh
match and we're using named groups for
field extractions so for every single
event that we see failed password for
invalid user we are actually extracting
a user field The Source IP field and the
source Port field for the sake of
Simplicity I tried to keep the RX simple
you can make this as complex as you need
to for your needs for your data uh and
so in our extracted Fields uh I've
actually pre-selected these so we can
see our user is now available and this
applies to the events where the Rex was
actually valid and matching on the uh
failed password for invalid user Etc
string so now that we have our Fields
extracted we can actually use these and
we want
to do a stats count as failed login so
anytime you see uh a an operation as and
then a unique name just a rename uh
through the transformation function
easier way to uh actually keep
consistency uh with referencing your
Fields as well as not have to rename
later on uh with some additional in this
case you'd have to reference the name
distinct count uh so just a way to keep
things clean and easy to use in further
uh lines of SPL so we are counting our
failed logins we're looking at the
distinct count of the source IP values
that we have and then we're splitting
that by the host and the user so you can
see here uh this tutorial data is
actually pretty flat across most of the
sources so we're not going to have uh
any outliers or spikes in our stats here
but you can see the resulting
presentation in line four we do have a
sort command and this is an example of a
data set processing command where we are
actually evaluating a full completed
data set and reordering it uh given the
logic here we want to descend on these
numeric values uh so keep mind as you're
operating on different fields it's going
to be the same sort of either basic
numeric or the lexicographical ordering
that you typically see in
Splunk so we do have a second example uh
with the said style
replace so you can see in my events here
uh we are searching the tutorial and
vendor sales index and Source type and
I've gone ahead and applied one
operation and this is going to be a
helpful operation to understand really
what we are replacing and how to get
consistent operation on these fields uh
so in this case we are actually creating
an ID length field where we are going to
choose to mask the value of account ID
in our Rex command we want to know that
that's a consistent number of characters
uh through all of our data it's very
simple to spot check uh but just to be
certain we want to apply this to all of
our data in this case streaming command
uh through this eval uh we
are uh changing the type of the data
because account ID is actually numeric
we're making that a string value so that
we can look at the length these are
common functions in any programming
languages uh and so the syntax here in
SPL is quite simple uh just to be able
to get that contextual feeli we
understand we have 16 characters for
100% of our events in the account
IDs so actually applying our Rex command
we are going to now specify a unique
field not just uncore raw uh we are
applying the said mode and this is a
said syntax uh replacement uh looking
for the uh it's a capture group for the
first 12 digits uh and then we're
replacing that with a series of 12 X's
so you can see in our first event the
account ID is now masked we only have uh
the remaining four digits to be able to
identify that and so if our data was
indexed and is appropriately done so uh
in Splunk with the full account IDs but
for for the sake of reporting we want to
be able to mask that um for the audience
then we're able to use the the said
replace and then to finalize a report
this is just an example of the top
command which does a few operations
together uh and makes for a good
shorthand report uh taking all the
unique values of the provided field uh
giving you a count of those values and
then showing the percentage
of the makeup for the total data set
that that unique value accounts for so
again pretty flat in this tutorial data
in seeing a very consistent
.3% uh across these different account
IDs so we have looked at a few examples
with the Rex command uh and that is
again streaming we're going to look at
another streaming command
uh which is going to be a set of
multivalue eval functions and so again
if you're to have a bookmark for search
documentation multivalue eval functions
are a great one to have uh because when
you encounter these uh it really takes
some time to figure out how to actually
operate on data um and so the U
multivalue functions are um really just
a collection that depending on your use
case uh you're able to determine the the
best to apply um you see it often used
with uh Json and XML so data formats
that are actually naturally going to
provide uh a multivalue field where you
have repeated tags or Keys uh across
unique uh events as they're extracted uh
and you often see a lot of times in
Windows event logs you actually have
repeated key values uh where your values
are different and the position in the
event is actually specific to a
condition uh so you may have um a need
for extraction or interaction with one
of those unique values uh to actually
get a reasonable outcome from your
data and so um we're going to use
multivalue eval functions uh when we
have a uh change we want to the
presentation of data uh and we're able
to do so with multivalue Fields this I
would say often occurs when you have
multivalue data uh and then you want to
be able to change the the format of the
multivalue fields there uh and then
we're also going to look at a quick
example of uh actually using multivalue
evaluation uh as a logical
condition so uh the first
example we're going to start with a
simple table looking at our web access
logs uh and so we're just going to pull
in our status and refer domain fields
and so you can see uh we've got a uh
HTTP status code uh and we've got uh the
format of a protocol subdomain uh domain
tldd and our scenario here is that for a
Simplicity of reporting uh we just want
to work with this referred domain field
and be able to simplify that so in
actually splitting out the field in this
case uh split refer domain and then
choosing the period character as our
point to split the data we're creating a
multivalue uh from what was previously
just a a single value field uh and using
this we can actually create a new field
by using the index of a multivalue field
and in this case uh we're looking at
index
012 the multivalue index function allows
us to Target a specific field and then
choose a starting and ending index to
extract given values there are a number
of ways to do this in our case here
where we have three entries it's quite
simple just to give that start and end
of range as the
two entries
apart so as we are working to recreate
our domain and so that is just applying
uh for this new domain field we have
Buttercup games.com and what was
previously the HTTP www. Buttercup
games.com uh we can now use those fields
in a transformation function in this
case simple stats count by status uh in
the
domain so I do want to look at another
uh example here that is similar but
we're going to use a multivalue function
to actually test a condition and so I'm
going
to in this case uh be searching the same
data we're going to start with a stats
command and so a stats count as well as
a values of status and so the values
function is going to provide all the
unique values of a given field uh based
on uh the split by and so that produces
a multivalue field here in the case of
status we have quite a few events uh
that have multiple status codes and as
we're interested in pulling those events
out we can use an MV count function to
eval valate and filter our data set to
those specific events so a very simple
operation here just looking at what has
the uh what has more than a single value
for status uh but very useful as you're
applying this in reporting especially in
combination with others and uh with more
complex conditions
um so uh that is our set of multivalue
eval functions there as streaming
commands so for a uh final section of
the demo I want to talk about a concept
that is not so much a set of functions
uh but really enables uh more complex
and interesting searching and can allow
us to use a few different types of
commands uh in our SPL and so concept of
sub searching for both filtering and
enrichment uh is taking secondary search
results uh and we're using that to
affect a primary search uh so a sub
search will be executed the results
returned and depending on how it's used
uh this is going to be processed in the
original search uh and that is going to
will look at an example that it is
filtering So based on the results we get
a effectively a value equals X or value
equals y uh for one of our fields that
we're looking at in the sub search uh
and then we're also going to look at an
enrichment example so you see this often
when you have uh a data set maybe saved
in a lookup table uh or you just have a
simple reference where you want to bring
in more context maybe descriptions of
event codes things like
that so in that case
we'll look at the First Command here now
I'm going to run my search and we're
going to Pivot over uh to a sub search
tab here and so you can see our sub
search looking at the secure uh logs uh
we are actually just pulling out the
search to see what the results are uh or
what's going to be returned from that
sub search so we're applying the same
rex that we had before to extract our
Fields we're applying a wear a streaming
command looking for anything that's not
null for user we observed that we had
about 60% of our events that were going
to be null based on not having a user
field and so looking at that total data
set uh we're just going to count by our
source IP and this is often a quick way
to really just get a list of unique
values of any given field uh and then
operating on that uh to return just the
the list of values few different ways to
do that uh see stats count pretty often
and in this case we're actually tbling
out just keeping our source IP field and
renaming to client IP so the resulting
data set is a single column table uh
with
182 results and the field name is client
IP so so when returned to the original
search we're running this as a sub
search the effective result of this is
actually client IP equals my first value
here or client IP equals my second value
and so on through the full data set and
so looking at our search here we're
applying this to the access logs you can
see that we had a field named Source IP
in the secure logs uh and we renamed a
client IP so that we could apply this to
the access logs where client IP is the
actual field name for the uh Source IP
data and in this case we are filtering
to the client IPS relevant in the secure
logs for our web access
logs so uncommenting here we have a
series of operations that we're doing uh
and I'm just going to run the mall at
once and talk through uh that we are
counting uh the status or we're counting
the events by status and client IP uh
for the client IPS that were relevant to
authentication failures in the secure
logs we are then creating a status count
field just by combining uh our status
and count Fields uh adding a colant
between them uh and then we are doing a
second uh stats statement here to
actually combine all of our newly
created Fields together in a more
condensed report so transforming command
then streaming for creating our new
field another transforming command and
then our sort for data set processing
actually gives us the results here for a
given client IP and so we are in this
case looking for the scenario that
these client IPS that are involved in
authentication failures to the web
servers in this case these were all over
SSH uh we want to see if there are
interactions by these same Source IPS uh
actually on the uh website that we're
hosting uh so seeing a high number of
failed values looking at actions also is
a use case here for just bringing in
that context and seeing if there's any
sort of relationship between the data uh
this is discussed often as correlation
of logs I'm usually careful about using
the term correlation in talking about
spun queries especially in Enterprise
security talking about correlation
searches where I typically think of
correlation searches as being
overarching Concepts that cover data
from multiple data sources and in this
case correlating events would be looking
at unique data types that are
potentially related uh in finding that
logical connection uh for the condition
that's a little bit more up to the user
it's not uh quite as easy as say
pointing to a specific data
model so we are going to look at one
more sub search here and this case is
going to apply uh the join command and
so I talk about using lookup files uh or
uh other data returned by sub searches
uh to enrich to bring more data in
rather than filter um we are going to
look at our first part of the command
here uh and this is actually just a
simple uh stats report based on this rex
that keeps coming through uh the SPL to
give us those user and Source IP Fields
uh so our result here is authentication
failures for all these web hosts so
similar to what we had previously
returned and then we're going to take a
look at the results of the sub search
here actually split this up so that we
can see uh the first two lines we're
looking at our web access logs for
purchase actions uh and then we are
looking at uh our stats count for errors
and stats count for successes we have
pretty limited status code to return in
this data so this uh is is uh viable for
the data present uh to observe our
errors and
successes and then we are actually
creating a new field based on the
statistics that we're generating uh
looking at our transaction errors so
where we have uh high or low numbers uh
of failed purchase actions uh and then
summarizing that so in the case of our
final command here another transforming
command of table just to reduce this to
a small data set uh to use in the subur
and so in this case we have our host
value and then our transaction error
rate that we observe from the web access
logs and then over in our other search
here uh we are going to perform a left
join based on this host field so you see
in our secure logs we still have the
same host value and this is going to be
used uh to to actually add our
transaction uh error rates in for each
host so as we observe uh increased
authentication failures if there's a
scenario for a breach and some sort of
interruption to the ability to serve out
or perform these purchase actions that
that are affecting uh the intended
operations of the web servers uh we can
see that here of course our tutorial
data there's not really much that
jumping out or showing uh that there is
any correlation between the two but the
purpose of the join is to bring in that
extra data set to give the context to
further
investigate so um that is uh the final
portion of the SPL demo uh and I do want
to say for any questions I'm going to
take a look at the chat I'll do my best
to answer any questions um and then if
you have any other questions uh please
feel free to reach out to my team at
support keny group.com and we'll be
happy to get back to you and help um I
am taking a look
through
okay seeing some questions on
performance of the uh Rex said Rex
commands um so off the top of my head I
I'm not sure about a direct performance
comparison uh of the individual commands
definitely want to look into that um and
definitely follow up uh if you'd like to
uh explain a more detailed scenario or
look at some SPL uh that we can apply in
observe those
changes um the question on getting the
data set uh that is what I mentioned at
the beginning uh reach out to us for the
slides uh or just uh reach out about the
link and the uh Splunk tutorial data you
can actually search that as well um and
there's documentation on how to use the
tutorial data one of the first links
there uh takes you to a page that has uh
it is a tutorial data zip file uh and
instructions on how to injust that it's
just an upload uh for your specific
environment so uh in add data and then
upload data two clicks uh and upload
your file so that is uh freely available
for anyone uh and again that package is
dynamically updated as well so your time
stamps are pretty close to to normal uh
as you download the app kind of depends
on the time of the the cycle for the
update um but search overall time you
won't have any issues there um and then
yeah again on receiving slides uh reach
out to my team uh and we're happy to to
provide those discuss further and we'll
have uh the um the recording available
for this session you should be able to
after uh the recording processes when
the session ends uh actually use the
same link and you can watch this
reporting and post uh without having to
sign up or transfer that file so
um so okay Chris seeing uh seeing your
comment there um let me know if you want
to reach out to me directly anyone as
well um we can discuss what slides and
presentation you had attended I'm not
sure I have the attendance report uh for
for what You' seen previously so uh
happy to get those for
you all right and uh seeing thanks Brett
so you see Brett Woodruff in the chat
commenting uh systems engineer on the uh
expertise on demand team so very
knowledgeable guy and he's going to be
presenting next month's session uh that
is going to take this concept that we
talked about the subur in as a just
general search topic he's going to go
specifically into Data enrichment using
uh joins lookup commands and how we see
uh that used in the wild so definitely
excited for that one encourage you to
register for for that
event all right I'm not seeing any more
questions
all right with that uh I am stopping my
share I'm going to hang around for a few
minutes uh but thank you all for
attending and we'll see you on the next
session