Book Image

Splunk 7 Essentials - Third Edition

By : J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman
Book Image

Splunk 7 Essentials - Third Edition

By: J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman

Overview of this book

Splunk is a search, reporting, and analytics software platform for machine data, which has an ever-growing market adoption rate. More organizations than ever are adopting Splunk to make informed decisions in areas such as IT operations, information security, and the Internet of Things. The first two chapters of the book will get you started with a simple Splunk installation and set up of a sample machine data generator, called Eventgen. After this, you will learn to create various reports, dashboards, and alerts. You will also explore Splunk's Pivot functionality to model data for business users. You will then have the opportunity to test-drive Splunk's powerful HTTP Event Collector. After covering the core Splunk functionality, you'll be provided with some real-world best practices for using Splunk, and information on how to build upon what you've learned in this book. Throughout the book, there will be additional comments and best practice recommendations from a member of the SplunkTrust Community, called "Tips from the Fez".
Table of Contents (10 chapters)

Reporting, Alerts, and Search Optimization

Finding the data you need in Splunk is relatively easy, as you have seen in previous chapters. Doing the same thing repeatedly for different datasets, however, requires that you employ techniques that make data retrieval faster, easier, and more controlled with reusable configurations. In Chapter 2, Bringing in Data, you were shown how to use data fields and make field extractions. In Chapter 6, Data Models and Pivot, you learned how to create data models. You will continue that journey in this chapter by learning how to classify your data using Event Types, enrich your data using Lookups, and normalize your data using Tags.

Once you have these essentials in place, you will be able to more easily create reports, alerts, and dashboards, and capture analytical value from machine data quickly.

In this chapter, we will cover a wide range...