Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Dashboards versus reports


The differences in dashboards and reports is pretty slight, although important to note, because in Splunk you can do different things with each of these, and in some cases you can build dashboards with reports that enhance the performance of your dashboard.

Reports

Reports are basically saved searches that you can access by clicking a link. They can be referenced by dashboards in order to create specific panels, and you can accelerate their performance with Splunk's acceleration option. You cannot accelerate a dashboard without leveraging a report or a data model of some sort. Reports are individual searches that populate results into a single panel.

I'll start by using one of the most common report examples for an operations infrastructure team, the disk space utilization report. I'm going to use Linux-based systems for my example. This example will assume that you have the Splunk_TA_nix add-on installed across your entire Linux environment.

Finding the information...