Book Image

Splunk 7 Essentials - Third Edition

By : J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman
Book Image

Splunk 7 Essentials - Third Edition

By: J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman

Overview of this book

Splunk is a search, reporting, and analytics software platform for machine data, which has an ever-growing market adoption rate. More organizations than ever are adopting Splunk to make informed decisions in areas such as IT operations, information security, and the Internet of Things. The first two chapters of the book will get you started with a simple Splunk installation and set up of a sample machine data generator, called Eventgen. After this, you will learn to create various reports, dashboards, and alerts. You will also explore Splunk's Pivot functionality to model data for business users. You will then have the opportunity to test-drive Splunk's powerful HTTP Event Collector. After covering the core Splunk functionality, you'll be provided with some real-world best practices for using Splunk, and information on how to build upon what you've learned in this book. Throughout the book, there will be additional comments and best practice recommendations from a member of the SplunkTrust Community, called "Tips from the Fez".

Related Content you might be interested in

Current Title:

Small book image
Splunk 7 Essentials - Third Edition
J-P Contreras | Steven Koelpin | Erickson Delgado | Betsy Page Sigman
Mar, 2018 | 220 pages
Small book image
Splunk 7.x Quick Start Guide
James H Baxter
Nov, 2018 | 298 pages
Small book image
Splunk Operational Intelligence Cookbook
Paul R Johnson | Derek Mock | Josh Diakun
May, 2018 | 541 pages
Small book image
Mastering Splunk 8
James D Miller
Dec, 2020 | 456 pages
Table of Contents (10 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
Free Chapter
1
Splunk – Getting Started
Splunk – Getting Started
Your Splunk account
Installing Splunk on Windows
Installing Splunk on Linux
Creating a Splunk app
Populating data with Eventgen
Controlling Splunk
Configuring Eventgen
Viewing the Destinations app
Creating your first dashboard
Summary
2
Bringing in Data
Bringing in Data
Splunk and big data
Splunk data sources
Creating indexes
Buckets
Log files as data input
Splunk events and fields
Extracting new fields
Summary
3
Search Processing Language
Search Processing Language
Anatomy of a search
Time modifiers
Filtering search results
Search command – stats
Search command – top/rare
Search commands – chart and timechart
Search command – eval
Search command – rex
Summary
4
Reporting, Alerts, and Search Optimization
Reporting, Alerts, and Search Optimization
Data classification with Event Types
Data normalization with Tags
Data enrichment with Lookups
Creating and scheduling reports
Creating alerts
Search and Report acceleration
Scheduling options
Summary indexing
Summary
5
Dynamic Dashboarding
Dynamic Dashboarding
Creating effective dashboards
Types of dashboards
Form inputs
Creating a time range input
Creating a radio input
Creating a drop-down input
Static real-time dashboard
Creating a choropleth map
Summary
6
Data Models and Pivot
Data Models and Pivot
Creating a data model
Data model acceleration
Rearranging your dashboard
Summary
7
HTTP Event Collector
HTTP Event Collector
What is the HEC?
How does the HEC work?
How data flows to the HEC
Summary
8
Best Practices and Advanced Queries
Best Practices and Advanced Queries
Indexes for testing
Searching within an index
Search within a limited time frame
Quick searches via fast mode
Using event sampling
Use the fields command to improve search performance
Advanced searches
Summary
9
Taking Splunk to the Organization
Taking Splunk to the Organization
Common organizational use cases
Splunk architecture considerations
The Splunk community and online resources
Summary

Installing Splunk on Linux

If you choose to install Splunk on a Linux machine, these are the instructions you need to follow. Take your time and do not rush the installation. For this Linux installation, the steps assume you will run Splunk in your user profile's home directory:

  1. Decompress the .tgz file you downloaded. The result of the decompression is a splunk folder and all the related Splunk files contained inside.
  2. Change the working directory to $SPLUNK_HOME/bin.
  3. Run the following command to start Splunk for the first time:
./splunk start
  1. Accept the Splunk license when prompted.
  2. Splunk will start successfully and the end results should appear like this:
Tip from the Fez: In most organizational environments, it is common to install Splunk in /opt/. When installing on Linux, it is best practice to adjust the ulimit settings and disable transparent hugh page functionality for Splunk applications that will be loading data in real time, supporting a community of users.
Tip from the Fez: Unlike Windows installations, Splunk Linux installations aren't automatically configured to start upon reboot of the Splunk server. Ensure that you configure your Splunk instance on Linux for what is known as boot start so that if the Linux instance is restarted, Splunk will automatically restart with the operating system.
Tip from the Fez: In an enterprise environment, create a Linux user specifically for running Splunk and use that. Do not run Splunk as the Linux root user or an individuals user.

Logging in for the first time

Launch the application for the first time in your default browser. You can also manually access the Splunk web page via the http://localhost:8000 URL if you have installed locally. If using a cloud instance, use http://ipaddress:8000 since you are connecting via a traditional internet connection as opposed to locally.

Splunk requires you to use a modern browser. It supports most versions of Google Chrome, Firefox, and newer versions of Internet Explorer. It may not support older versions of Internet Explorer.

Log in with the default username as admin and password as changeme, as indicated in the following screenshot:

The next step is to change the default administrator password, while keeping the default username. Do not skip this step. Make security an integral part of your day-to-day routine. Choose a password that will be secure.

Assuming that all goes well, you will now see the default Splunk Enterprise landing page as follows:

Running a simple search

You are ready to run your first Splunk search:

  1. Click directly on the green Search & Reporting app button. In this example, you use Splunk's very own internal index; this is Splunk's way of splunking itself (or collecting detailed information on all its underlying processes).
An index is the term given to where Splunk stores event data captured from log files, APIs, HTTP events, delimited files, and other machine data sources. It is in some ways like a database, but should not be compared to traditional relational databases in functionality or performance.
  1. In the New Search input, type in the following search query (more about the Search Processing Language (SPL) in Chapter 3, Search Processing Language):
SPL> index=_internal sourcetype=splunkd
The SPL> prefix will be used as a convention in this book to indicate a Splunk Search command. Since SPL is submitted via the Splunk user interface, there is no difference whether operating in Windows or Linux environments. The underscore before the index name _internal means that it is a system index internally used by Splunk. Omitting the underscore will not yield any result, as internal is not a default index.
  1. This search query will have as an output the raw events from the metrics.log file that is stored in the _internal index. A log file keeps track of every event that takes place in the system. The _internal index keeps track of every event that occurs and makes it easily accessible.
  1. Take a look at these raw events, as shown in the following screenshot. You will see fields listed on the left side of the screen. The important Selected Fields are host, source, and sourcetype. We will go into more detail about these later, but suffice to say that you will frequently search on one of these, as we have done here. As you can see from the highlighted fields, we indicated that we were looking for events where sourcetype=splunkd. Underneath Selected Fields, you will see Interesting Fields. As you can tell, the purposes of many of these fields are easy to guess as seen in the following screenshot:
Previous Section
End of Section 4
Next Section