The Settings section, in a nutshell, is an interface for managing configuration files. The number of files and options in these configuration files is truly daunting, so the web interface concentrates on the most commonly used options across the different configuration types.
Splunk is controlled exclusively by plain text configuration files. Feel free to take a look at the configuration files that are being modified as you make changes in the admin interface. You will find them by hitting the following commands:
$SPLUNK_HOME/etc/system/local/ $SPLUNK_HOME/etc/apps/
You may notice configuration files with the same name at different locations. We will cover in detail; the different configuration files, their purposes, and how these configurations merge together in Chapter 11, Configuring Splunk. Don't start modifying the configurations directly until you understand what they do and how they merge.
Clicking on Settings, on the top bar, takes you to the Settings page.
The options are organized into logical groupings, as follows:
Knowledge: Each of the links under Knowledge allows you to control one of the many object types that are used at search time. The following screenshot shows an example of one object type, workflow actions: Searches, reports, and alerts:
System: The options under this section control system-wide settings.
System settings covers network settings, the default location to store indexes, outbound e-mail server settings, and how much data Splunk logs about itself
Server controls contains a single page that lets you restart Splunk from the web interface
Licensing lets you add license files or configure Splunk as a slave to a Splunk license server
Data: This section is where you manage data flow.
Data Inputs: Splunk can receive data by reading files (either in batch mode or in real time), listening to network ports, or running scripts.
Forwarding and receiving: Splunk instances don't typically stand alone. Most installations consist of at least one Splunk indexer and many Splunk forwarders. Using this interface, you can configure each side of this relationship and more complicated setups (we will discuss this in more detail in Chapter 12, Advanced Deployments).
Indexes: An Index is essentially a datastore. Under the covers, it is simply a set of directories, created and managed by Splunk. For small installations, a single index is usually acceptable. For larger installations, using multiple indexes allows flexibility in security, retention, and performance tuning, as well as better use of hardware. We will discuss this further in Chapter 11, Configuring Splunk.
Report acceleration summaries: Accesses automatically-created summaries to speed up completion times for certain kinds of reports.
Distributed Environment: The three options here relate to distributed deployments (we will cover these options in detail in Chapter 12, Advanced Deployments):
Indexer clustering: Access to enabling and configuring Splunk Indexer clustering, which we will discuss later in Chapter 10, Summary Indexes and CSV Files.
Forwarder management: Access to the forwarder management UI distributes deployment apps to Splunk clients.
Distributed search: Any Splunk instance running searches can utilize itself and other Splunk instances to retrieve results. This interface allows you to configure access to other Splunk instances.
Users and authentication: This section provides authentication controls and an account link.
Access controls: This section is for controlling how Splunk authenticates users and what users are allowed to see and do. We will discuss this further in Chapter 11, Configuring Splunk.
In addition to the links, the Settings page also presents a panel on the left side of the page. This panel includes two icons Add Data and Distributed Management Console.
Add Data links to the Add Data page. This page presents you with three options for getting data into your Splunk Enterprise instance: Upload, Monitor, and Forward.
Distributed Management Console, where you can view detailed performance information about your Splunk Enterprise deployment.