# Kibana for Splunk SPL Users

**URL:** <https://discuss.elastic.co/t/kibana-for-splunk-spl-users/228652>\
**Category:** Elastic Training\
**Created:** [April 18, 2020, 2:45pm UTC](https://discuss.elastic.co/t/kibana-for-splunk-spl-users/228652 "2020-04-18T14:45:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vinoth\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinoth_kumar/32/59998_2.png) [@vinoth\_kumar](https://discuss.elastic.co/u/vinoth_kumar)\
**Post date:** [April 18, 2020, 2:45pm UTC](https://discuss.elastic.co/t/kibana-for-splunk-spl-users/228652/1 "2020-04-18T14:45:13Z")

</div>

Hi All,

In the 1st lab exercise of this Training -Kibana for Splunk SPL Users, I have doubt in the below questions

2)Create filter  
g)How many events downloaded zip files using Legacy OS?  
h)How many events from China downloaded zip files?  
i)How many events from China, downloaded zip files using Legacy OS?

Regards,  
Vinoth

---

<div class="post-metadata">

**Author:** ![b-elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b-elastic/32/43403_2.png) [@b-elastic](https://discuss.elastic.co/u/b-elastic)\
**Post date:** [April 18, 2020, 3:23pm UTC](https://discuss.elastic.co/t/kibana-for-splunk-spl-users/228652/2 "2020-04-18T15:23:35Z")

</div>

Hi vinoth,

Happy to help. What's your question?

---

<div class="post-metadata">

**Author:** ![vinoth\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinoth_kumar/32/59998_2.png) [@vinoth\_kumar](https://discuss.elastic.co/u/vinoth_kumar)\
**Post date:** [April 18, 2020, 3:40pm UTC](https://discuss.elastic.co/t/kibana-for-splunk-spl-users/228652/3 "2020-04-18T15:40:51Z")

</div>

HI Bharat ,

How to frame filter for the above questions ?  
i cannot understand it .

Regards,  
Vinoth kumar.S

---

<div class="post-metadata">

**Author:** ![b-elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b-elastic/32/43403_2.png) [@b-elastic](https://discuss.elastic.co/u/b-elastic)\
**Post date:** [April 20, 2020, 1:16pm UTC](https://discuss.elastic.co/t/kibana-for-splunk-spl-users/228652/4 "2020-04-20T13:16:51Z")

</div>

> g)How many events downloaded zip files using Legacy OS?  
> Click to +Add filter and create filters  
> `file.extension is zip`  
> h)How many events from China downloaded zip files?  
> `file.extension is zip`  
> `client.geo.country_iso_code is CN`  
> List of ISO country codes can be found [here](https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes)  
> i)How many events from China, downloaded zip files using Legacy OS?  
> `file.extension is zip`  
> `client.geo.country_iso_code is CN`  
> `user_agent.os.name is one of [Windows Vista, Windows XP, Windows Vista, Windows 7]`  
> If you have more questions, I'd recommend watching the videos again where these are explained with a demo. Good luck!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2020, 1:16pm UTC](https://discuss.elastic.co/t/kibana-for-splunk-spl-users/228652/5 "2020-05-20T13:16:57Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.