Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Chapter 10. Advanced Data Routing

Data routing is something that is becoming more common place in an enterprise. As many people are using big data platforms like Splunk to move data around their network things such as firewalls and data stream loss, sourcetype renaming by environment can become administratively expensive. There are some easier ways to get data to another data center or a different environment leveraging only Splunk and some of its more advanced features. We will delve a little deeper into the architecture in this chapter in order to subvert some firewalls, and some license restrictions.

In this chapter, we will learn about:

  • Splunk architecture (enterprise level):

    • Clustering

      • Multi-site redundancy

    • Leveraging load balancers (F5)

      • Failover methods

    • Putting it all together

  • Network Segments:

    • Production

    • Standard Integration Testing (SIT)

    • Quality assurance

    • Development

    • DMZ (a.k.a. App tier)

  • The data router:

    • Building roads and maps

    • Building the UF input/output paths

    • Building the HF input/output...