Book Image

Advanced Splunk

By : Ashish Kumar Tulsiram Yadav
Book Image

Advanced Splunk

By: Ashish Kumar Tulsiram Yadav

Overview of this book

Master the power of Splunk and learn the advanced strategies to get the most out of your machine data with this practical advanced guide. Make sense of the hidden data of your organization – the insight of your servers, devices, logs, traffic and clouds. Advanced Splunk shows you how. Dive deep into Splunk to find the most efficient solution to your data problems. Create the robust Splunk solutions you need to make informed decisions in big data machine analytics. From visualizations to enterprise integration, this well-organized high level guide has everything you need for Splunk mastery. Start with a complete overview of all the new features and advantages of the latest version of Splunk and the Splunk Environment. Go hands on with uploading data, search commands for basic and advanced analytics, advanced visualization techniques, and dashboard customizing. Discover how to tweak Splunk to your needs, and get a complete on Enterprise Integration of Splunk with various analytics and visualization tools. Finally, discover how to set up and use all the new features of the latest version of Splunk.
Table of Contents (20 chapters)
Advanced Splunk
Credits
About the Author
Acknowledgements
About the Reviewer
www.PacktPub.com
Preface
Index

Tokens


Tokens are nothing but variables, as in programming languages, which can be used to run dynamic queries taken from input fields or clicked events. Token name works as a reference to the information which captures value that is used to manage dashboard behavior. The delimiter used for the token is having syntax as $token_name$.

The following are a few ways token values can be captured:

  • Tokens can be used to capture values from an input field

  • Define the token to specify actions, based on conditions based on the value of the token

  • Tokens can be defined in a search string, using values based on previously defined tokens

  • Splunk Enterprise pre-defined default tokens

The tokens can be used in various locations and use cases on the Splunk dashboard, as described here:

  • Search events: The result of a search based on the token value can be changed using search metadata tokens

  • Form inputs: Depending upon the selection of the input value, the results in the visualization change

  • Drilldown tokens: Depending...