• Error message : Cannot convert null to int because it is a non-nullable value type(or) INVALID use of NULL.

• Here, some of the key advantages of using splunk which will help you in understanding key features of splunk.

• Identify and resolve issues upto 70% faster.
• Reduces costly escalations by upto 90%.
• Splunk change difficult logs to visual graphs and reports resulting simplified analysis,reporting and troubleshooting

• No separate database requirements like oracle or SQL as splunk stores all data in its index
• Supports any format and any amount of data -enables centralized log management

• Simple to implement and scale
• Continually index all of your IT data in real time.
• Automatically search helpful information inserted in your data, therefore you can’t to spot yourself.
• Search your physical and virtual IT infrastructure for virtually something of interest and find results in seconds.
• Save searches and tag helpful information, to create your system smarter.
• Set up alerts to modify the observation of your system for specific continual events.
• Provide analytical reports with interactive charts, graphs, and tables.
• Share saved searches and reports with fellow Splunk users, and distribute their results to team members and project stakeholders via email.
• Design specialised, information-rich views and dashboards that work the wide-ranging desires of your enterprise.

• The application of splunk are Monitoring, Analyzes machines, security and business performance.
• With intuitive analysis features, machine learning, packaged applications and open APIs, Splunk Enterprise is a comfortable environment that scales from focused use cases to an enterprise-wide analytics backbone.

• A Splunk application is not much more than a structured set of configurations and assets help to achieve an end goal of data collection, indexing, and visualization.
• In order to make a valid Splunk application, you must include the ability to navigate. Without navigation in the application, you would be working on an add-on.
• The performance of application can be monitor vendors Dynatrace and Extrahop have developed apps for Splunk software to help the users to visualize their deep-dive application performance data in the event of all other application data like logs, events, infrastructure performance.

• Proxy logs : It’s better for C2 analysis of files, domains, downloads of DLL/EXE files.
• Anti‐virus logs : It’s good for analysis of malware, vulnerabilities of hosts, laptops, servers, monitor for suspicious file paths.
• Server Operating System logs : These logs are good for analysis of server activities such as users, runaway services, security logs.
• Firewall logs : Logs for network traffic of source/destination ip addresses, ports, protocols.
• Mail logs : Logs for inbound/outbound mail for malicious links, targeted recipients, unauthorized file out bound, data loss, bad attachments.
• Custom apps logs : Logs could be analyze for possible buffer overflow, code injection, SQL injection analyses.

• Intrusion Prevention System logs : To alert on signatures firing off, COTS signatures, threat analysis of bad network packets.
• Database logs : It’s can be capture for authorized access to critical data tables, authorized logons, op ports, admin accounts.
• Virtual Private Network(VPN) logs : Capture logs to analyze users coming into network for situational awareness, monitored foreign ip subnets, compliance monitoring of browsers/apps of connected hosts.
• Authentication logs : To monitor authorized/unauthorized users, times of day of connection, how often, logons/logoffs, BIOS analysis.
• Vulnerability Scan Data : Import data about assets, vulnerabilities, patch data, etc.
• Web Application logs : External facing logs to monitor suspicious SQL keywords, text patterns, REGEX for threats coming in through browser.
• DNS logs: To relate IP address what domain in a client level.
• DHCP logs : To monitor what systems are assign what IP address and how long, how often.

• Active Directory/Domain Controller logs : Monitor user accounts for AD admins, privilege accounts, remote access, multiple admins across the domain, new account creation, event ID’s.
• Badge Access logs : Logs to capture to correlate insider threat, situational awareness, correlate data with authentication logs.
• Router/Switch data (net-‐flow) : Capture this critical data source for APT monitoring, network monitoring, data exfiltration, flow analysis are very important data source.
• Packet Capture logs(PCAP): Very difficult data source to capture for Advanced Persistent Threats, packet analysis, deep packet inspection, malware analysis, etc.
• FW + AV : Will help detect and respond to viruses, worm propagation.
• IPS + AV + FW : Detect/alert on network based attacks such as buffer overflow, reconnaissance scans, code injection.
• PROXY : The web based/application layer is a majority attacks to monitor like: cross-site scripting, session hacking, browse redirects.
• AV + PROXY : Monitor/detect/respond to download of bad files, remote code execution…web-based attacks.
• FW + PROXY : Detect outbound data exfiltration, detect potentially misconfig fw rules.
• IPS + FW : Network packet of signature threats to be monitored.
• AD Server : All user/group modifications, deletes, updates for administrators to be monitored.
• AD + PROXY : Monitor/Detect/Alert on post compromise analysis, lateral movement.

• Splunk is a software environment to give search, analyze and event to machine-generated data collect from the websites, applications, sensors,devices etc.,It create for your IT environment and business.
• Splunk is an advanced,scalable and potent technology that system can be stored indexes and searches log files.It also search the machine-generated data to give operational intelligence.
• The below image will help you how to relate Splunk collects data.

• To report real time health condition.
• The patient’s health record and analyze patterns in the Delve deeper.
• When the patient’s health degrades to be Alarms/Alerts for both the doctor and patient.

• It work can be moved as the ‘Google’ for log files.
• Simpler terms to be searched with the use of Search Processing Language (SPL).
• If the Splunk file system to be store the data directly that means it does not require any back-end or any database
• It doesn’t against any single point of failure to be happened.

Some of the additional components that separately and collectively perform the major operations:

• Create an ADODB connection object which is required step for connecting to database as below.

Authentication using Id, Password and details.

• • Provider: For SQL server database the provider is “sqloledb”
  • Server: Open the SQL Server in your machine and Right click on the required Database/ click on properties.

• Click on “View connection Properties”

• User Name and Server details are required from this dialogue box

• objConnection.open “provider=sqloledb; Server=SDWA-160-PC; User Id=SDWA-160; Password=; Database=sample; Trusted_Connection=Yes”
• Hence, Connection setup completed and ready for execution.

• Enter the required SQL query to be executed.
• Execution of the query with the statement below.

• The above mentioned sample script has been executed and the value from the database is retrieved.

• A procedure is a named PL/SQL block which performs one or more specific task.This is similar to a procedure in other programming languages.
• A procedure has a header and a body.
• The header consists of the name of the procedure and the parameters or variables passed to the procedure.
• The body consists declaration section, execution section and exception section similar to a general PL/SQL Block. A procedure is similar to an anonymous PL/SQL Block but it is named for repeated usage.

• A function is a named PL/SQL Block which is similar to a procedure.
• The major difference between a procedure and a function is, a function must always return a value, but a procedure may or may not return a value.

• The oracle is Unlimited of size.There is no limitations for row size in oracle 9i.

• COMP is 2 bytes.
• COMP is used for Binary Representation it allows only S and 9.
• COMP stores the data in the binary format.
• With COMP fields, you have to drag out a calculator and convert the hex value to find out the true value that is being used in a program.
• Memory usage is,
  s9(5)-s9(9) – 4bytes
  s9(1)-s9(4) – 2bytes
  s9(10)-s9(18) – 8bytes

• COMP-3 is 8 bytes.
• Comp-3 is used for Packed Decimal values it allows S 9 V mostly it is useful for Decimal Calculation Values.
• COMP-3 stores the data in the BCD(Binary Coded Decimal)format.
• It is used to avoid rounding issues that occur when binary numbers are used to represent decimal fractions.
• This is particularly vital in systems that method massive volumes of economic transactions/amounts
• Memory usage is
  • n/2 + 1 (Even)
  n+1/2 (odd)

• Banking, Credit cards, etc.

• The usage clause specifies how the data item being stored internally .If no usage clause specified , the default usage clause would Usage is display

• The impala server consist of distributed and massively parallel processing info engine.
• It run on particular hosts among your CDH cluster with a various daemon processes.

• The core impala element may be a daemon method that runs on every node of the cluster, and its physically described by the impalad method.
• Then read and write a informative files; which accepts questions transmitted from the impala-shell command, Hue, JDBC, or ODBC; parallelizes the questions can seperate work to alternative nodes within the impala cluster; and transmits intermediate question results back to the central organizer node.
• The impala daemon running on any node, and that node is the organizer node for that question when You can submit a question.
• The other nodes transmit partial results back to the organizer, that constructs the ultimate result set for a question.
• You may continuously connect with a similar impala daemon for convenience.When running experiments with possibility through the impala-shell command.
• For clusters running production workloads, you would possibly load-balance between the nodes by submitting every question to a distinct impala daemon in round-robin vogue, exploitation the JDBC or ODBC interfaces.
• Its verify that nodes and may settle for new work. Through the impala daemons are in constant communication with the statestore.

• The impala element called the statestore checks on the health of impala daemons on all the nodes during a cluster, and unendingly relays its findings to every of these daemons.
• It is physically described by a daemon method named statestored; you simply would like such a method on one node within the cluster.
• If an impala node goes offline because of hardware failure, network error, software package issue, or alternative reason, the statestore informs all the opposite nodes so future queries will avoid creating requests to the unreached node.

• Performance and quantifiability enhancements.
• Integration with Apache koodoo.
• Security.
• The REFRESH statement currently updates data regarding HDFS block locations.
• [IMPALA-1654] many varieties of DDL operations will currently work on a spread of partitions.

• Impala can query many file format such as Parquet, Avro, Text, RCFile, SequenceFile
• Impala supports data stored in HDFS, Apache HBase and Amazon S3
• Impala supports multiple compression codecs:
  • Snappy (Recommended for its effective balance between compression ratio and decompression speed),
  • Gzip (Recommended when achieving the highest level of compression),
  • Deflate (not supported for text files), Bzip2, LZO (for text files only);
• Impala provides security through authorization based on Sentry (OS user ID)
  • Defining which users are allowed to access which resources,
  • What operations are they allowed to perform authentication based on Kerberos + ability to specify Active Directory username/password,
  • How does Impala verify the identity of the users to confirm that they are allowed exercise their privileges assigned to that user auditing,
  • What operations were attempted,
  • Did they succeed or not, allowing to track down suspicious activity; audit data are collected by Cloudera Manager;
• Impala supports SSL network encryption between Impala and client programs, and between the Impala-related daemons running on different nodes in the cluster;
• Impala allows to use UDFs and UDAFs;
• Impala orders the joins automatically to be the most efficient;
• Impala allows admission control – prioritization and queueing of queries within impala;
• Impala allows multi-user concurrent queries;
• Impala caches frequently accessed data in memory;
• Impala computes statistics (with COMPUTE STATS);
• Impala provides window functions (aggregation OVER PARTITION, RANK, LEAD, LAG, NTILE, and so on) – to provide more advanced SQL analytic capabilities (since version 2.0);
• Impala allows external joins and aggregation using disk (since version 2.0) – enables operations to spill to disk if their internal state exceeds the aggregate memory size;
• Impala allows subqueries inside WHERE clauses;
• Impala allows incremental statistics – only run statistics on the new or changed data for even faster statistics computations;
• Impala enables queries on complex nested structures including maps, structs and arrays;
• Impala enables merging (MERGE) in updates into existing tables;
• Impala enables some OLAP functions (ROLLUP, CUBE, GROUPING SET);
• Impala allows use of impala for inserts and updates into HBase.

• Lazy write is an effect caused by the use of a write-back cache. In a write-back cache, data is first written to the cache and then is later (during a particular time such as an idle machine cycle) is written to the disk or memory.
• This type of cache is more complex to implement, due to the need to track each locations that have been written over and what needs to be marked as dirty to fix later.

Lazy writer in Memory

• Lazy writer is a thread which is present for each NUMA node (and every instance has at least one) that scans through the buffer cache associated with that node.
• The lazy writer thread sleeps for a specific interval of time, and when it wakes up, it examines the size of the free buffer list.
• If the list is below a certain threshold, which depends on the total size of the buffer pool, the lazy writer thread scans the buffer pool to repopulate the free list.
• As buffers are added to the free list, they are also written to disk if they are dirty.
• So if there is no memory pressure and memory notification is stable it sleeps
• The sole purpose of Lazy Writer is to maintain some free buffers in the SQL Server Buffer Pool.
• Lazy writer runs periodically and check which buffers can be flushed and returned to the free pool.
• So even SQL Server is not under memory pressure, it will also work regularly.

• The inner query is executed only once.
• The inner query will get executed first and the output of the inner query used by the outer query.
• The inner query is not dependent on outer query.

• The outer query will get executed first and for every row of outer query, inner query will get executed.
• So the inner query will get executed as many times as number of rows in result of the outer query.
• The outer query output can use the inner query output for comparison. This means inner query and outer query dependent on each other.

SELECT Employee_name,dept_id 
FROM Employee
WHERE Employee_name IN (SELECT Employee_name FROM dept WHERE Employee.dept_id=dept.dept_id);