Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Advanced charting


Charting in itself is one of the most helpful tools to visualize data; however, there are some things that leadership may ask for that are more difficult, and may come down to something as simple as reformatting a chart to switch the X and Y axis, or overlaying results week over week to show change. There are some common techniques that you can use to get the job done, which we will discuss here.

Overlay

Making charts is great; however, sometimes the boss wants everything in a single pane. There are lots of different ways we can make a chart overlay with our data, but here we are only going to discuss a single use case.

In this overlay, we are only going to discuss how to perform these functions using a single axis as your point of overlay.

Host CPU / MEM utilization

Let's say that our Linux engineering team would like a way to be able to view the CPU and MEM utilization of a single host, and search it through time. They would like to build a dashboard with this panel in it...