Book Image

Splunk 7 Essentials - Third Edition

By : J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman

Book Image

Splunk 7 Essentials - Third Edition

By: J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman

Overview of this book

Splunk is a search, reporting, and analytics software platform for machine data, which has an ever-growing market adoption rate. More organizations than ever are adopting Splunk to make informed decisions in areas such as IT operations, information security, and the Internet of Things. The first two chapters of the book will get you started with a simple Splunk installation and set up of a sample machine data generator, called Eventgen. After this, you will learn to create various reports, dashboards, and alerts. You will also explore Splunk's Pivot functionality to model data for business users. You will then have the opportunity to test-drive Splunk's powerful HTTP Event Collector. After covering the core Splunk functionality, you'll be provided with some real-world best practices for using Splunk, and information on how to build upon what you've learned in this book. Throughout the book, there will be additional comments and best practice recommendations from a member of the SplunkTrust Community, called "Tips from the Fez".

Preface

Who this book is for

What this book covers

To get the most out of this book

Free Chapter

Splunk – Getting Started

Splunk – Getting Started

Your Splunk account

Installing Splunk on Windows

Installing Splunk on Linux

Creating a Splunk app

Populating data with Eventgen

Controlling Splunk

Configuring Eventgen

Viewing the Destinations app

Creating your first dashboard

Bringing in Data

Bringing in Data

Splunk and big data

Splunk data sources

Creating indexes

Log files as data input

Splunk events and fields

Extracting new fields

Search Processing Language

Search Processing Language

Anatomy of a search

Filtering search results

Search command – stats

Search command – top/rare

Search commands – chart and timechart

Search command – eval

Search command – rex

Reporting, Alerts, and Search Optimization

Reporting, Alerts, and Search Optimization

Data classification with Event Types

Data normalization with Tags

Data enrichment with Lookups

Creating and scheduling reports

Creating alerts

Search and Report acceleration

Scheduling options

Summary indexing

Dynamic Dashboarding

Dynamic Dashboarding

Creating effective dashboards

Types of dashboards

Creating a time range input

Creating a radio input

Creating a drop-down input

Static real-time dashboard

Creating a choropleth map

Data Models and Pivot

Data Models and Pivot

Creating a data model

Data model acceleration

Rearranging your dashboard

HTTP Event Collector

HTTP Event Collector

What is the HEC?

How does the HEC work?

How data flows to the HEC

Best Practices and Advanced Queries

Best Practices and Advanced Queries

Indexes for testing

Searching within an index

Search within a limited time frame

Quick searches via fast mode

Using event sampling

Use the fields command to improve search performance

Advanced searches

Taking Splunk to the Organization

Taking Splunk to the Organization

Common organizational use cases

Splunk architecture considerations

The Splunk community and online resources

Customer Reviews

5 star

0

4 star

0

3 star

0

2 star

0

1 star

0

Viewing the Destinations app

Next we will see our Destinations app in action! Remember that we have configured it to draw events from a prototype web company. That is what we did when we set it up to work with Eventgen. Now, let's look at some of our data:

After a successful restart, log back in to Splunk and proceed to your new Destinations app:

In the Search field, type this search query and select Enter:

SPL> index=main

Examine the event data that your new app is enabling to come into Splunk. You will see a lot of references to browsers, systems, and so forth, the kinds of information that make a web-based e-commerce company run.

Try changing the time range to Real-time (5 minute window) to see the data flow in before your eyes:

Congratulations! You now have real-time web log data that we can use in subsequent chapters.

Tip from the Fez: Running a Splunk report under a real-time window places heavier strain on Splunk because it is rerunning the search over and over to generate the live nature of the real-time window. Unless absolutely needed, choose to have reports run for a set time period on user demand or a previously assigned schedule.