Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Types of dashboard search panel


In Splunk, each panel within a dashboard can be one of a series of types. Designing your dashboard virtually before you implement it, leveraging some of these panels, is very helpful in creating optimized performance. The architecture of your dashboard and which search queries you decide to use directly relate to the performance of your dashboard.

Raw data search panel

This is a search panel with a single query in it that searches raw data each time the dashboard loads. This is usually the fastest way of creating dashboards; however, the more of these panels you add to your dashboard, the slower the performance.

Shared search panel (base search)

These are also sometimes referred to as post-process panels. These panels reference a single root search hidden within the XML source code of the page and then perform a function such as stats or timechart on the results. This assists performance by allowing the dashboard to load by running only a single search to populate...