Getting data into Splunk can be a long process, and it is often a very important and overlooked process on a Splunk journey. If we do it poorly, there is lots of clean up that we have to do, which is usually much more complicated than just sitting down to plan out how we want our data to get to Splunk, and how we want it to look. This process is known as data scrubbing, or data cleaning. This is the process of breaking events at the proper line, as well as extracting some fields, or masking data before and after Splunk writes it to disk.
Topics that will be covered in this chapter:
Heavy Forwarder management
What is a Heavy Forwarder?
Managing the deployment server
Installing modular inputs
Data formatting
Event management
Knowledge management
Pre/post indexing techniques to clean data before indexing
Pre-indexed field extractions
Data masking
We're going to focus on only a few pieces of a Splunk system in this chapter:
Universal Forwarders
Thin clients that can be installed...