Book Image

Implementing Splunk (Update)

Book Image

Implementing Splunk (Update)

Overview of this book

Related Content you might be interested in

Current Title:

Small book image
Implementing Splunk (Update)
Jul, 2015 | 506 pages
No titles found
Table of Contents (20 chapters)
Implementing Splunk Second Edition
Implementing Splunk Second Edition
Credits
Credits
About the Authors
About the Authors
About the Reviewers
About the Reviewers
www.PacktPub.com
www.PacktPub.com
Preface
Preface
Free Chapter
1
The Splunk Interface
The Splunk Interface
Logging into Splunk
The home app
The top bar
The search & reporting app
Using the time picker
Using the field picker
The settings section
Summary
2
Understanding Search
Understanding Search
Using search terms effectively
Boolean and grouping operators
Clicking to modify your search
Using fields to search
Using wildcards efficiently
All about time
Making searches faster
Sharing results with others
Search job settings
Saving searches for reuse
Creating alerts from searches
Summary
3
Tables, Charts, and Fields
Tables, Charts, and Fields
About the pipe symbol
Using top to show common field values
Using stats to aggregate values
Using chart to turn data
Using timechart to show values over time
Working with fields
Summary
4
Data Models and Pivots
Data Models and Pivots
What is a data model?
What does a data model search?
Creating a data model
Lookup attributes
What is a pivot?
A quick example
Sparklines
Summary
5
Simple XML Dashboards
Simple XML Dashboards
The purpose of dashboards
Using wizards to build dashboards
Converting the panel to a report
Back to the dashboard
Editing XML directly
UI examples app
Building forms
Features replaced
Autorun dashboard
Scheduling the generation of dashboards
Summary
6
Advanced Search Examples
Advanced Search Examples
Using subsearches to find loosely related events
Using transaction
Determining concurrency
Calculating events per slice of time
Rebuilding top
Acceleration
Summary
7
Extending Search
Extending Search
Using tags to simplify search
Using event types to categorize results
Using lookups to enrich data
Using macros to reuse logic
Creating workflow actions
Using external commands
Summary
8
Working with Apps
Working with Apps
Defining an app
Included apps
Installing apps
Building your first app
Editing navigation
Customizing the appearance of your app
Object permissions
The app directory structure
Summary
9
Building Advanced Dashboards
Building Advanced Dashboards
Reasons for working with advanced XML
Reasons for not working with advanced XML
The development process
The advanced XML structure
Converting simple XML to advanced XML
Module logic flow
Understanding layoutPanel
Reusing a query
Using intentions
Creating a custom drilldown
Third-party add-ons
10
Summary Indexes and CSV Files
Summary Indexes and CSV Files
Understanding summary indexes
When to use a summary index
When not to use a summary index
Populating summary indexes with saved searches
Using summary index events in a query
Using sistats, sitop, and sitimechart
How latency affects summary queries
How and when to backfill summary data
Reducing summary index size
Calculating top for a large time frame
Using CSV files to store transient data
Summary
11
Configuring Splunk
Configuring Splunk
Locating Splunk configuration files
The structure of a Splunk configuration file
The configuration merging logic
An overview of Splunk .conf files
User interface resources
Summary
12
Advanced Deployments
Advanced Deployments
Planning your installation
Splunk instance types
Common data sources
Sizing indexers
Planning redundancy
Working with multiple indexes
Deploying the Splunk binary
Using apps to organize configuration
Configuration distribution
Using LDAP for authentication
Using Single Sign On
Load balancers and Splunk
Multiple search heads
Summary
13
Extending Splunk
Extending Splunk
Writing a scripted input to gather data
Using Splunk from the command line
Querying Splunk via REST
Writing commands
Writing a scripted lookup to enrich data
Writing an event renderer
Writing a scripted alert action to process results
Hunk
Summary
Index
Index

Writing an event renderer

Event renderers give you the ability to make a specific template for a specific event type. To read more about creating event types, see Chapter 7, Extending Search.

Event renderers use mako templates (http://www.makotemplates.org/).

An event renderer is comprised of the following:

  • A template stored at $SPLUNK_HOME/etc/apps/[yourapp]/appserver/event_renderers/[template].html

  • A configuration entry in event_renderers.conf

  • An optional event type definition in eventtypes.conf

  • Optional CSS classes in application.css

Let's create a few small examples. All the files referenced are included in $SPLUNK_HOME/etc/apps/ImplementingSplunkExtendingExamples. These examples are not shared outside this app, so to see them in action you will need to search from inside this app. Do this by pointing your browser at http://[yourserver]/app/ImplementingSplunkExtendingExamples/flashtimeline.

Using specific fields

If you know the names of the fields you want to display in your output, your template...

Previous Section
End of Section 7
Next Section