Book Image

Splunk Essentials - Second Edition

By : Betsy Page Sigman, Erickson Delgado
Book Image

Splunk Essentials - Second Edition

By: Betsy Page Sigman, Erickson Delgado

Overview of this book

Splunk is a search, analysis, and reporting platform for machine data, which has a high adoption on the market. More and more organizations want to adopt Splunk to use their data to make informed decisions. This book is for anyone who wants to manage data with Splunk. You’ll start with very basics of Splunk— installing Splunk—and then move on to searching machine data with Splunk. You will gather data from different sources, isolate them by indexes, classify them into source types, and tag them with the essential fields. After this, you will learn to create various reports, XML forms, and alerts. You will then continue using the Pivot Model to transform the data models into visualization. You will also explore visualization with D3 in Splunk. Finally you’ll be provided with some real-world best practices in using Splunk.
Table of Contents (15 chapters)
Splunk Essentials Second Edition
Credits
About the Authors
About the Reviewer
www.PacktPub.com
Preface

Creating a dropdown input


Dropdown inputs function exactly the same as radio inputs. The former is used when the selection is huge and you do not want the list of choices to unnecessarily clutter the entire page. The http_uri field has numerous results, so this makes a drop-down the ideal candidate for input here.

Follow the same procedure as for radio input creation, but make sure you have selected Dropdown instead. Use the following information and screenshots as guides to complete the task:

  1. Click on Edit | Edit Panels.

  2. Select Add Input | Dropdown.

  3. Click the Editicon in the newly created input.

  4. In the Labelfield, type in Select HTTP URI to name your new drop-down.

  5. As you did when you created a radio button, enable Search on Changeby checking the checkbox.

  6. In the Token field, type http_uri.

  7. Under Token Options section, in Default, select ALL.

  8. Under Token Options section, in Initial Value, select ALL.

  9. For Static Options, type { Name: ALL, Value: * }.

  10. Under Dynamic Options, be sure the search icon is...