Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Raw data search


The first thing to note about form dashboard optimizations is that the closer to the root search you can place tokens, the faster your searches will go, meaning that if we use our dashboard inputs to place tokens such as host source, source type, eventtype, or tag within the root search, then we will increase the performance of our searches.

For instance, let's take some dashboards from an app and break them down. I am going to choose the Citrix netscaler app because it's simplistic enough in nature. I'm going to use the Load Balancing Dashboard as the single page of focus within this app.

https://splunkbase.splunk.com/app/370/

The dashboard looks like the following screenshot:

Note

Notice that, when we start delving into each of the modules, there are three text inputs, one time input, and a single Submit button at the top of the page. I will focus on the text inputs and the tokens they are passing for now.

Looking closer at each input, you will notice that each token has...