Intermediate Searching in Splunk

hello

everyone we are getting started here on

our August lunch and learn session

presented by Ken group's Atlas customer

experience team my name is Alice Deane I

am the engineering manager for the atlas

customer experience team and I'm excited

to be presenting this month's session on

intermediate level Splunk searching so

thank you all for attending I hope you

get some good ideas out of this uh and

certainly encourage engagement through

the chat uh and I'll have some

information at the end on following up

uh and speaking with my team directly on

any issues uh or interests that you have

uh around these types of Concepts that

we're going to cover today so uh jumping

into an intermediate level uh session I

I do want to say that we have previously

done a basic level uh searching uh

session so that we are really

progressing from that picking up right

where we left off uh we've done that

session with quite a few of our

customers individually uh and highly

recommend if you're interested in doing

that or this session with a larger team

uh we're happy to to discuss and

coordinate that uh so getting started

we're going to take a look at the final

search uh from our basic search session

uh and we're going to walk through that

understand some of the concepts uh and

then we're going to take a step back

look a little more generally at SPL

operations and understanding how

different commands apply to data uh and

really that next level of understanding

for how you can write more complex

searches and understand really uh when

to use certain types of commands uh and

of course uh in the session we're going

to to have a uh series of demos uh using

a few specific commands highlighting the

different SPL command types uh that we

discuss in the second portion uh and get

to see that on the tutorial data uh that

you can also use uh in your environment

in a test environment uh very

simply so I will always encourage uh

especially with search content that you

look into the additional resource that I

have listed here the uh search reference

documentation is one of my favorite

bookmarks that I use frequently in my

own environments and working in customer

environments uh it is really the the

best quick resource to get information

on syntax and examples of any Search

Command uh and is always a great

resource to have the search manual is a

little bit more conceptual but as you're

learning more about different types of

search operations

it's very helpful to be able to review

this

documentation and have reference

material that you can come back to uh as

you are studying and trying to get

better and writing more complex uh

search content I have also linked here

the documentation on how to use the

Splunk tutorial data uh so if you've not

done that before it's a very simple

process uh and there are consistently

updated download files that spun

provides uh that you're able to directly

upload into any spunk environment so

that's what I'm going to be using today

uh and given that you are searching over

uh appropriate time windows for when you

download the tutorial data set uh these

searches will work uh on the tutorial

data as well so highly encourage after

the fact if you want to go through uh

and test out some of the content um

you'll be able to access a recording as

well as if you'd like the slides that

I'm Pres presenting off of today which I

highly encourage because there are a lot

of useful links in here uh reach out to

my team again right at the end of the

slides we'll have that

info so looking at our overview of basic

search uh I just want to cover

conceptually uh the two categories that

we discuss in that session and so those

two are the statistical and charting

functions uh which consist of in those

demos aggregate and time functions so

aggregate functions are going to be your

commonly used statistical functions uh

meant for summarization uh and then time

functions actually using uh the

timestamp field underscore time or any

other time that you've extracted from

data uh and looking at earliest latest

uh relative time values uh in a

summative fashion and then evaluation

functions are the separate uh type where

we discuss comparison and conditional

statements so using your if and your

case commands uh in

evals uh also datetime functions that

apply operations to events uniquely uh

so not necessarily summarization but

interacting with the time values

themselves maybe changing the time

format uh and then multivalue evalve

functions we touch on that very lightly

uh and it is more conceptual in basic

search So today we're going to dive in

as part of our demo and look at

multivalue eval functions uh later in

the

presentation so on this slide here I

have highlighted uh in Gray the search

that we end basic search with uh and so

that is broken up into three segments

where we have uh the first line being a

filter to a data set uh this is very

simply how you are sourcing most of your

data in most of your searches in Splunk

uh and we always want to be a specific

as possible you'll most often see the

The Logical way to do that is by

identifying an index and a source type

possibly some specific values of given

fields in that data before you start

applying other operations in our case we

want to work with a whole data set uh

and then we mve into applying our eval

statements

so in the evals the purpose of these is

to create some new fields to work with

uh and so we have two operations here uh

and you can see that on the first line

we're starting with an error check field

uh these are web access logs so we're

looking at the HTTP status codes as the

status field and we have a logical

condition here we greater than or equal

to 400 we want to return errors and so

very simple example uh making it as easy

as possible if you want to get specifics

on your 200s and your 300s it's the

exact same type of logic to go and apply

uh likely a case statement to get some

additional conditions uh and more unique

output in an error check or some sort of

field uh indicating uh what you want to

see out of your status code so this case

simple errors or the value of non here

if we have say at

200 we're also using a Time function to

create a second field called day uh you

may be familiar with some of the uh

fields that you get out of uh by default

for most any events in Splunk uh and

that they're related to breakdowns of

the time stamps uh you have day month uh

and many others in this case I want to

get a specific format for day so we use

a strif Time function uh and we have a

time format variable here on the actual

extracted time stamp first of BL so

coming out of the second line we've

accessed our data we have created two

new fields to use and then we are

actually performing uh charting with a

statistical function and so that is

using time chart and we can see here

that we are counting our events that

actually have the error value uh for our

created error check field and so I'm

going to Pivot over to uh Splunk here

and we're going to look at this search

and I have commented out uh most of the

logic we'll step back through it uh we

are looking at our web access log events

here uh and we want to then apply our

eval and so by applying the eval we can

get our error check field that provides

error or non-error we're seeing that we

have mostly non-error

events uh and then we have the day field

and so day is actually providing the

full name of day for the time stamp for

all these events so with our time chart

this is the summarization uh with a

condition actually that we're spanning

by default over a single day so this may

not be a very logical use of a split by

day when we are already using a time

chart command that is dividing our

results by the time bin uh effectively a

span of one day but what we can do uh is

change our split by field to host and

get a little bit more of a reasonable

presentation we were able to see with

the counts in the individual days not

only split through the time chart but by

the day field that we only had values

where our Matrix matched up for the

actual day so here we have our uh hosts

one two and three and then across days

counts of the error events that we

observe so that is uh the search that we

end on in basic search the concepts

there being accessing our data uh

searching in a descriptive manner using

our metadata Fields the index and the

Source type uh the evaluation functions

where we're creating new Fields

manipulating data uh and then we have a

time chart function uh that is providing

some uh summarized statistics here based

on the time

range so we will pivot back and we're

going to take a step back out of the SPL

for a second just to talk about these

different kinds of search operations

that we just performed so you'll hear

these terms uh if you are really kind of

diving deeper into actual operations of

Splunk searching uh and you can get very

detailed regarding the optimization of

searches uh around uh these types of

commands and the order in which you

choose to execute SPL today I'm going to

focus on how these operations actually

apply to the data and helping you to

make better decisions about what

commands are best for the scenario that

you have or the output that you want to

see uh and in future sessions we will

discuss the actual optimization of

searches uh through this optimal order

of functions uh and some other means uh

but just a caveat there that we're going

to talk uh pretty specifically today

just about these uh individually how

they work with data uh and then how you

see them in

combination so our types of SPL command

the top three in bold we'll focus on in

our examples the first of which is

streaming

operations uh which are executed on

individual events as they return by a

search uh so you can think of this like

your

eval um that is going to be doing

something to every single event uh

modifying Fields when they're available

uh we do have generating functions uh so

generating function are going to be used

situationally where you're sourcing data

from uh non-indexed data sets and so you

would see that from uh either input

lookup commands uh or maybe tstats

pulling information from the tsid X

Files uh and so generating the

statistical output based on the data

available there transforming commands uh

you will see uh as often as streaming

commands generally speaking and more

often than generating commands where

transforming is intended to order

results into a data table and I often

think of this much like how we discuss

the statistical functions in basic

search as summarization functions where

you're looking to condense your overall

data set uh into really manageable

consumable results uh so these

operations that apply that summarization

are transform perform we do have two

additional types of SPL commands uh the

first is orchestrating uh you can read

about these I will not discuss in great

detail uh they are used to manipulate

how searches are actually U processed or

or how commands are processed uh and

they don't directly affect the results

in a search how we think about say

applying a stats or an eval uh to a data

set uh so if you're interested

definitely check it out uh link

documentation has details there um data

set processing is seen much more often

uh and you do have uh some conditional

uh scenarios where commands can act as

data set processing so the uh

distinction for data set processing is

going to be that you are operating in

bulk on a single completed data set at

one time so we'll we'll look at an

example of

that I want to Pivot back to our main

three that we're going to be focusing on

and I have mentioned some of these

examples already uh the eval functions

that we've been talking about so far are

perfect examples of our streaming

commands uh so where we are creating new

fields for each entry or log event uh

where we are modifying values for all of

the results that are available uh that

is where we are streaming um with the

search functions input lookup is

possibly one of the most common

generating commands that I see uh

because someone is intending to uh

Source a data set stored in a CSV file

or a KV store collection uh and you're

able to bring that back as a report and

use that logic uh in your

queries so that is

uh not requiring the index data uh or

any index data to actually return the

results that you want to

see and we've talked about stats very

generally speaking uh with a lot of

unique functions you can apply there uh

where this is going to provide a tabular

output uh and is serving that purpose of

summarization so we're really

reformatting the data uh into that

tabular report

so we see in this example search here uh

that we are often combining these

different types of search operations so

in this example that we have uh I have

data that already exists in a CSV file

we are applying a streaming command here

uh where evaluating each line to see if

we match a condition and then returning

the results

based on that evaluation and then we're

applying a transforming command at the

end which is that stats summarization

getting the maximum values uh for the uh

count of errors and the host that is

associated with that so let's PIV over

to Splunk and we'll take a look at that

example so I'm just going to grab my

search here and I pre- commented out

uh the specific uh lines following input

lookup just to see that this generating

command here is not looking for any

specific index data uh we're pulling

directly the results that I have in a

CSV file uh here into this output and so

we have a count of Errors observed

across multiple hosts our where command

uh you might think is reformatting data

in this sense it it is transforming the

results but the evaluation of a wear

function does apply effectively to every

event that is returned uh so it is u a

streaming command that is going to

filter down our result set based on our

condition that the error count is less

than

200 so the following line is our

transforming command where we have two

results left uh 187 for host 3 we want

to see our maximum values here of 187 on

host 3 so our scenario here has really

uh covered where you may have uh hosts

that are trending toward a negative

State you're aware that uh the second

host had already exceeded its uh

threshold value for errors but host 3

also appears to be trending toward this

threshold uh so being able to combine

these types of commands uh understand

the logical condition that you're

searching for uh and then also providing

that consumable output uh so combining

all three of our types of commands

here so uh I'm going to jump to an SPL

demo and as I go through these different

commands uh I'm going to be referencing

back to the different command types that

we're working with I'm going to

introduce in a lot of these searches uh

a lot of small commands uh that I won't

talk about in great detail and that

really is the purpose of using your

search manual uh using your search

reference documentation uh so I will

glance over the use case uh talk about

how it's meant to be applied and then

using in your own scenarios uh where you

have problem you need to solve uh

referencing the docs to find out where

you can apply uh similar functions to

what we observe in the the demonstration

here so the First Command I'm going to

focus on is the Rex command so Rex is a

streaming command that you often see

applied to data sets that do not fully

have data extracted in the format that

you want to be using um in your

reporting or in your logic uh and so

this could very well be handled actually

in the uh configuration of props and

transforms and extracting fields at the

right times and indexing data but as

your bringing new data sources you need

to understand what's available for use

in spunk a lot of times you'll find

yourself needing to extract new fields

in line in your searches uh and be able

to use those in your search Logic Rex

also has uh a said mode that I also see

testing done for masking of data in line

prior to actually putting that into

indexing

configurations um so Rex you would

generally see used um when you don't

have those fields available you need to

use them at that time uh and then we're

going to take a look at an example of

masking data as well uh to test your

Syntax for a said style replace uh in

config files so we will jump back over

so I'm going to start with a search on

an index Source type uh my tutorial data

and then this is actual uh Linux secure

logging uh so these are going to be OS

security logs and we're looking at all

of our web hosts uh that we've been

focusing on

previously in our events you can see

that we have uh first here uh an EV that

has fail password for invalid user in

that we're provided a source IP a source

port and we go to see the fields that

are extracted and that's that's not

being done for us automatically so just

to start testing our logic to see if we

can get uh the results we want to see

we're going to use the Rex command and

in doing so we are applying this

operation across every event again a

streaming command we are looking at the

raw field so we're actually looking at

the raw text of each of these log events

and then the rec syntax is simply to

provide in double quotes uh a Rex uh

match and we're using named groups for

field extractions so for every single

event that we see failed password for

invalid user we are actually extracting

a user field The Source IP field and the

source Port field for the sake of

Simplicity I tried to keep the RX simple

you can make this as complex as you need

to for your needs for your data uh and

so in our extracted Fields uh I've

actually pre-selected these so we can

see our user is now available and this

applies to the events where the Rex was

actually valid and matching on the uh

failed password for invalid user Etc

string so now that we have our Fields

extracted we can actually use these and

we want

to do a stats count as failed login so

anytime you see uh a an operation as and

then a unique name just a rename uh

through the transformation function

easier way to uh actually keep

consistency uh with referencing your

Fields as well as not have to rename

later on uh with some additional in this

case you'd have to reference the name

distinct count uh so just a way to keep

things clean and easy to use in further

uh lines of SPL so we are counting our

failed logins we're looking at the

distinct count of the source IP values

that we have and then we're splitting

that by the host and the user so you can

see here uh this tutorial data is

actually pretty flat across most of the

sources so we're not going to have uh

any outliers or spikes in our stats here

but you can see the resulting

presentation in line four we do have a

sort command and this is an example of a

data set processing command where we are

actually evaluating a full completed

data set and reordering it uh given the

logic here we want to descend on these

numeric values uh so keep mind as you're

operating on different fields it's going

to be the same sort of either basic

numeric or the lexicographical ordering

that you typically see in

Splunk so we do have a second example uh

with the said style

replace so you can see in my events here

uh we are searching the tutorial and

vendor sales index and Source type and

I've gone ahead and applied one

operation and this is going to be a

helpful operation to understand really

what we are replacing and how to get

consistent operation on these fields uh

so in this case we are actually creating

an ID length field where we are going to

choose to mask the value of account ID

in our Rex command we want to know that

that's a consistent number of characters

uh through all of our data it's very

simple to spot check uh but just to be

certain we want to apply this to all of

our data in this case streaming command

uh through this eval uh we

are uh changing the type of the data

because account ID is actually numeric

we're making that a string value so that

we can look at the length these are

common functions in any programming

languages uh and so the syntax here in

SPL is quite simple uh just to be able

to get that contextual feeli we

understand we have 16 characters for

100% of our events in the account

IDs so actually applying our Rex command

we are going to now specify a unique

field not just uncore raw uh we are

applying the said mode and this is a

said syntax uh replacement uh looking

for the uh it's a capture group for the

first 12 digits uh and then we're

replacing that with a series of 12 X's

so you can see in our first event the

account ID is now masked we only have uh

the remaining four digits to be able to

identify that and so if our data was

indexed and is appropriately done so uh

in Splunk with the full account IDs but

for for the sake of reporting we want to

be able to mask that um for the audience

then we're able to use the the said

replace and then to finalize a report

this is just an example of the top

command which does a few operations

together uh and makes for a good

shorthand report uh taking all the

unique values of the provided field uh

giving you a count of those values and

then showing the percentage

of the makeup for the total data set

that that unique value accounts for so

again pretty flat in this tutorial data

in seeing a very consistent

.3% uh across these different account

IDs so we have looked at a few examples

with the Rex command uh and that is

again streaming we're going to look at

another streaming command

uh which is going to be a set of

multivalue eval functions and so again

if you're to have a bookmark for search

documentation multivalue eval functions

are a great one to have uh because when

you encounter these uh it really takes

some time to figure out how to actually

operate on data um and so the U

multivalue functions are um really just

a collection that depending on your use

case uh you're able to determine the the

best to apply um you see it often used

with uh Json and XML so data formats

that are actually naturally going to

provide uh a multivalue field where you

have repeated tags or Keys uh across

unique uh events as they're extracted uh

and you often see a lot of times in

Windows event logs you actually have

repeated key values uh where your values

are different and the position in the

event is actually specific to a

condition uh so you may have um a need

for extraction or interaction with one

of those unique values uh to actually

get a reasonable outcome from your

data and so um we're going to use

multivalue eval functions uh when we

have a uh change we want to the

presentation of data uh and we're able

to do so with multivalue Fields this I

would say often occurs when you have

multivalue data uh and then you want to

be able to change the the format of the

multivalue fields there uh and then

we're also going to look at a quick

example of uh actually using multivalue

evaluation uh as a logical

condition so uh the first

example we're going to start with a

simple table looking at our web access

logs uh and so we're just going to pull

in our status and refer domain fields

and so you can see uh we've got a uh

HTTP status code uh and we've got uh the

format of a protocol subdomain uh domain

tldd and our scenario here is that for a

Simplicity of reporting uh we just want

to work with this referred domain field

and be able to simplify that so in

actually splitting out the field in this

case uh split refer domain and then

choosing the period character as our

point to split the data we're creating a

multivalue uh from what was previously

just a a single value field uh and using

this we can actually create a new field

by using the index of a multivalue field

and in this case uh we're looking at

index

012 the multivalue index function allows

us to Target a specific field and then

choose a starting and ending index to

extract given values there are a number

of ways to do this in our case here

where we have three entries it's quite

simple just to give that start and end

of range as the

two entries

apart so as we are working to recreate

our domain and so that is just applying

uh for this new domain field we have

Buttercup games.com and what was

previously the HTTP www. Buttercup

games.com uh we can now use those fields

in a transformation function in this

case simple stats count by status uh in

the

domain so I do want to look at another

uh example here that is similar but

we're going to use a multivalue function

to actually test a condition and so I'm

going

to in this case uh be searching the same

data we're going to start with a stats

command and so a stats count as well as

a values of status and so the values

function is going to provide all the

unique values of a given field uh based

on uh the split by and so that produces

a multivalue field here in the case of

status we have quite a few events uh

that have multiple status codes and as

we're interested in pulling those events

out we can use an MV count function to

eval valate and filter our data set to

those specific events so a very simple

operation here just looking at what has

the uh what has more than a single value

for status uh but very useful as you're

applying this in reporting especially in

combination with others and uh with more

complex conditions

um so uh that is our set of multivalue

eval functions there as streaming

commands so for a uh final section of

the demo I want to talk about a concept

that is not so much a set of functions

uh but really enables uh more complex

and interesting searching and can allow

us to use a few different types of

commands uh in our SPL and so concept of

sub searching for both filtering and

enrichment uh is taking secondary search

results uh and we're using that to

affect a primary search uh so a sub

search will be executed the results

returned and depending on how it's used

uh this is going to be processed in the

original search uh and that is going to

will look at an example that it is

filtering So based on the results we get

a effectively a value equals X or value

equals y uh for one of our fields that

we're looking at in the sub search uh

and then we're also going to look at an

enrichment example so you see this often

when you have uh a data set maybe saved

in a lookup table uh or you just have a

simple reference where you want to bring

in more context maybe descriptions of

event codes things like

that so in that case

we'll look at the First Command here now

I'm going to run my search and we're

going to Pivot over uh to a sub search

tab here and so you can see our sub

search looking at the secure uh logs uh

we are actually just pulling out the

search to see what the results are uh or

what's going to be returned from that

sub search so we're applying the same

rex that we had before to extract our

Fields we're applying a wear a streaming

command looking for anything that's not

null for user we observed that we had

about 60% of our events that were going

to be null based on not having a user

field and so looking at that total data

set uh we're just going to count by our

source IP and this is often a quick way

to really just get a list of unique

values of any given field uh and then

operating on that uh to return just the

the list of values few different ways to

do that uh see stats count pretty often

and in this case we're actually tbling

out just keeping our source IP field and

renaming to client IP so the resulting

data set is a single column table uh

with

182 results and the field name is client

IP so so when returned to the original

search we're running this as a sub

search the effective result of this is

actually client IP equals my first value

here or client IP equals my second value

and so on through the full data set and

so looking at our search here we're

applying this to the access logs you can

see that we had a field named Source IP

in the secure logs uh and we renamed a

client IP so that we could apply this to

the access logs where client IP is the

actual field name for the uh Source IP

data and in this case we are filtering

to the client IPS relevant in the secure

logs for our web access

logs so uncommenting here we have a

series of operations that we're doing uh

and I'm just going to run the mall at

once and talk through uh that we are

counting uh the status or we're counting

the events by status and client IP uh

for the client IPS that were relevant to

authentication failures in the secure

logs we are then creating a status count

field just by combining uh our status

and count Fields uh adding a colant

between them uh and then we are doing a

second uh stats statement here to

actually combine all of our newly

created Fields together in a more

condensed report so transforming command

then streaming for creating our new

field another transforming command and

then our sort for data set processing

actually gives us the results here for a

given client IP and so we are in this

case looking for the scenario that

these client IPS that are involved in

authentication failures to the web

servers in this case these were all over

SSH uh we want to see if there are

interactions by these same Source IPS uh

actually on the uh website that we're

hosting uh so seeing a high number of

failed values looking at actions also is

a use case here for just bringing in

that context and seeing if there's any

sort of relationship between the data uh

this is discussed often as correlation

of logs I'm usually careful about using

the term correlation in talking about

spun queries especially in Enterprise

security talking about correlation

searches where I typically think of

correlation searches as being

overarching Concepts that cover data

from multiple data sources and in this

case correlating events would be looking

at unique data types that are

potentially related uh in finding that

logical connection uh for the condition

that's a little bit more up to the user

it's not uh quite as easy as say

pointing to a specific data

model so we are going to look at one

more sub search here and this case is

going to apply uh the join command and

so I talk about using lookup files uh or

uh other data returned by sub searches

uh to enrich to bring more data in

rather than filter um we are going to

look at our first part of the command

here uh and this is actually just a

simple uh stats report based on this rex

that keeps coming through uh the SPL to

give us those user and Source IP Fields

uh so our result here is authentication

failures for all these web hosts so

similar to what we had previously

returned and then we're going to take a

look at the results of the sub search

here actually split this up so that we

can see uh the first two lines we're

looking at our web access logs for

purchase actions uh and then we are

looking at uh our stats count for errors

and stats count for successes we have

pretty limited status code to return in

this data so this uh is is uh viable for

the data present uh to observe our

errors and

successes and then we are actually

creating a new field based on the

statistics that we're generating uh

looking at our transaction errors so

where we have uh high or low numbers uh

of failed purchase actions uh and then

summarizing that so in the case of our

final command here another transforming

command of table just to reduce this to

a small data set uh to use in the subur

and so in this case we have our host

value and then our transaction error

rate that we observe from the web access

logs and then over in our other search

here uh we are going to perform a left

join based on this host field so you see

in our secure logs we still have the

same host value and this is going to be

used uh to to actually add our

transaction uh error rates in for each

host so as we observe uh increased

authentication failures if there's a

scenario for a breach and some sort of

interruption to the ability to serve out

or perform these purchase actions that

that are affecting uh the intended

operations of the web servers uh we can

see that here of course our tutorial

data there's not really much that

jumping out or showing uh that there is

any correlation between the two but the

purpose of the join is to bring in that

extra data set to give the context to

further

investigate so um that is uh the final

portion of the SPL demo uh and I do want

to say for any questions I'm going to

take a look at the chat I'll do my best

to answer any questions um and then if

you have any other questions uh please

feel free to reach out to my team at

support keny group.com and we'll be

happy to get back to you and help um I

am taking a look

through

okay seeing some questions on

performance of the uh Rex said Rex

commands um so off the top of my head I

I'm not sure about a direct performance

comparison uh of the individual commands

definitely want to look into that um and

definitely follow up uh if you'd like to

uh explain a more detailed scenario or

look at some SPL uh that we can apply in

observe those

changes um the question on getting the

data set uh that is what I mentioned at

the beginning uh reach out to us for the

slides uh or just uh reach out about the

link and the uh Splunk tutorial data you

can actually search that as well um and

there's documentation on how to use the

tutorial data one of the first links

there uh takes you to a page that has uh

it is a tutorial data zip file uh and

instructions on how to injust that it's

just an upload uh for your specific

environment so uh in add data and then

upload data two clicks uh and upload

your file so that is uh freely available

for anyone uh and again that package is

dynamically updated as well so your time

stamps are pretty close to to normal uh

as you download the app kind of depends

on the time of the the cycle for the

update um but search overall time you

won't have any issues there um and then

yeah again on receiving slides uh reach

out to my team uh and we're happy to to

provide those discuss further and we'll

have uh the um the recording available

for this session you should be able to

after uh the recording processes when

the session ends uh actually use the

same link and you can watch this

reporting and post uh without having to

sign up or transfer that file so

um so okay Chris seeing uh seeing your

comment there um let me know if you want

to reach out to me directly anyone as

well um we can discuss what slides and

presentation you had attended I'm not

sure I have the attendance report uh for

for what You' seen previously so uh

happy to get those for

you all right and uh seeing thanks Brett

so you see Brett Woodruff in the chat

commenting uh systems engineer on the uh

expertise on demand team so very

knowledgeable guy and he's going to be

presenting next month's session uh that

is going to take this concept that we

talked about the subur in as a just

general search topic he's going to go

specifically into Data enrichment using

uh joins lookup commands and how we see

uh that used in the wild so definitely

excited for that one encourage you to

register for for that

event all right I'm not seeing any more

questions

all right with that uh I am stopping my

share I'm going to hang around for a few

minutes uh but thank you all for

attending and we'll see you on the next

session