Book Image

Splunk 7 Essentials - Third Edition

By : J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman
Book Image

Splunk 7 Essentials - Third Edition

By: J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman

Overview of this book

Splunk is a search, reporting, and analytics software platform for machine data, which has an ever-growing market adoption rate. More organizations than ever are adopting Splunk to make informed decisions in areas such as IT operations, information security, and the Internet of Things. The first two chapters of the book will get you started with a simple Splunk installation and set up of a sample machine data generator, called Eventgen. After this, you will learn to create various reports, dashboards, and alerts. You will also explore Splunk's Pivot functionality to model data for business users. You will then have the opportunity to test-drive Splunk's powerful HTTP Event Collector. After covering the core Splunk functionality, you'll be provided with some real-world best practices for using Splunk, and information on how to build upon what you've learned in this book. Throughout the book, there will be additional comments and best practice recommendations from a member of the SplunkTrust Community, called "Tips from the Fez".
Table of Contents (10 chapters)

Creating a radio input

Now, we are going to create radio inputs with dynamic searches used to drive the input value choices. This will allow users to select server and status types, and will affect the information rendered by the panels:

  1. Click on Edit.
  2. Select Add Input | Radio.
  3. Click on the Edit icon in the newly created input.
  4. In the Label field, type in Select Server:.
  5. Enable Search on Change by checking the checkbox.
  6. In the Token field, type server:
  1. Scroll down to Static Options and click on it. In Static Options, add Name as ALL and Value as *.
  2. Click on Dynamic Options, then fill in Search String, entering the following search command:
SPL> index=main | top server_ip
  1. Update the time range to Last 60 minutes.
  2. In Field For Label, type in server_ip.
  3. In Field For Value, type in server_ip:
  1. Now, scroll back up to Token Options.
  2. For Default, select ALL.
  3. For Initial Value...