splunk

+-------------------+
| Splunk Operations |
+-------------------+
# /opt/splunkforwarder/bin/splunk add forward-server <server_name>:<index_port>
# /opt/splunkforwarder/bin/splunk list forward-server
# /opt/splunkforwarder/bin/splunk add monitor /var/log/messages
# /opt/splunkforwarder/bin/splunk start

+------------------------------------+
| Splunk Processing Language Example |
+------------------------------------+
# index="wazuh" rule.description="file added to the system." | timechart span=1d count by host
# index="wazuh" rule.description="file added to the system." | stats count by host
# host="dev-wsplunk-d01" source="homeworkdataset.csv" usr=*  | eval timenew=strftime(_time, "%H:%M")  | table timenew usr