Book Image

Splunk 7 Essentials - Third Edition

By : J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman
Book Image

Splunk 7 Essentials - Third Edition

By: J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman

Overview of this book

Splunk is a search, reporting, and analytics software platform for machine data, which has an ever-growing market adoption rate. More organizations than ever are adopting Splunk to make informed decisions in areas such as IT operations, information security, and the Internet of Things. The first two chapters of the book will get you started with a simple Splunk installation and set up of a sample machine data generator, called Eventgen. After this, you will learn to create various reports, dashboards, and alerts. You will also explore Splunk's Pivot functionality to model data for business users. You will then have the opportunity to test-drive Splunk's powerful HTTP Event Collector. After covering the core Splunk functionality, you'll be provided with some real-world best practices for using Splunk, and information on how to build upon what you've learned in this book. Throughout the book, there will be additional comments and best practice recommendations from a member of the SplunkTrust Community, called "Tips from the Fez".
Table of Contents (10 chapters)

Your Splunk account

First, you will need to register for a Splunk account; go to https://www.splunk.com/. This is the account that you will use if you decide to purchase a license later. Go ahead and do this now. From here on, the password you use for your Splunk account will be referred to as your Splunk password.

Obtaining a Splunk account

To obtain your Splunk account, perform the following steps:

  1. Go to the Splunk sign up page at http://www.splunk.com.
  2. In the upper-right corner, click on the Free Splunk button.
  3. Enter the information requested.
  4. Create a username and password.
  5. You will be taken to the Splunk download page, where you will need to click on the Free Download button under Splunk Enterprise as shown in the following screenshot:
  1. You will then need to download the Splunk Enterprise software. Go to http://download.splunk.com and select the Splunk Enterprise free download. Choose your operating system, being careful to select 32 or 64-bit (whichever is appropriate in your case; most should select 64-bit, which most computers of today use). For Windows, download the *.msi file. For Linux, download the *.tgz file. In this book, we work with version 7.0.1.

The installation is very straightforward. Follow the steps for your particular operating system, whether it is Windows or Linux.

This book assumes a single Splunk standalone installation. Make sure that there is no previous installation of Splunk in your system. If there is any, uninstall the prior version before proceeding with the next steps.