Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Consolidating search apps


Consolidating search apps starts to come in handy when we want to begin to develop the ever-elusive single pane of glass. There is usually a very large amount of data gathered in Splunk, though many people create disparate apps for a unique purpose. Take for instance a Network app that has all router/firewall/switch logs, and then an Active Directory app that has all Microsoft Active Directory data, as well as a Juniper SRX app in order to pay attention to the Quality Assurance environment. While these provide value to a user, the visualization often gets cumbersome on login as you have logs of different apps and titles to sift through to find the data you want to see. App consolidation is a great way to make everything available with a single click, and then a user just navigates to the appropriate set of dashboards.

Creating a custom app

To begin the consolidation process, it's best to start by creating a custom app. The process is quite easy, and there are a couple...