Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Best practices with search anatomy


There are three basic components of search anatomy. You will have a better working knowledge of search query syntax after reading the following information.

The root search

Always make sure to list as many metadata fields as you can in this section because that will speed up your search results. If you just put a host=host2 call in this part of the search, Splunk will scrub every index, every sourcetype, and every source within your selected time-range for that host, which takes a lot longer than if you specify the data location you want. The proper use of this portion usually looks something like this:

index=MyIndex sourcetype=iisLogs source=".../inetpub/*.log" host=host1 OR host=host2 

This small action can reduce your search times significantly.

Calculation/evaluation

Because this portion of the search query is usually the longest, the order of operation is critical here, as well as calling out all necessary fields and passing them down to the next part...