The Gauntlet • Room 1

Scenario: The Outage

Your production web application is throwing 500 errors. Using everything you have learned, you need to rapidly triage this incident.

You must combine `tstats` for fast initial scoping, `transaction` to group session flows, and `eventstats` to establish a baseline.

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Write a search to find all HTTP 500 errors in the last hour, grouped by host, showing the count.

Splunk Search Bar