Book Image

Splunk 7 Essentials - Third Edition

By : J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman
Book Image

Splunk 7 Essentials - Third Edition

By: J-P Contreras, Steven Koelpin, Erickson Delgado, Betsy Page Sigman

Overview of this book

Splunk is a search, reporting, and analytics software platform for machine data, which has an ever-growing market adoption rate. More organizations than ever are adopting Splunk to make informed decisions in areas such as IT operations, information security, and the Internet of Things. The first two chapters of the book will get you started with a simple Splunk installation and set up of a sample machine data generator, called Eventgen. After this, you will learn to create various reports, dashboards, and alerts. You will also explore Splunk's Pivot functionality to model data for business users. You will then have the opportunity to test-drive Splunk's powerful HTTP Event Collector. After covering the core Splunk functionality, you'll be provided with some real-world best practices for using Splunk, and information on how to build upon what you've learned in this book. Throughout the book, there will be additional comments and best practice recommendations from a member of the SplunkTrust Community, called "Tips from the Fez".
Table of Contents (10 chapters)

Indexes for testing

It is a good idea to use an index for testing purposes, especially when you need to index new data and you are not familiar with its format. You should consider creating an index just for this purpose as you are crafting solutions to load data into Splunk.

When loading data for the first time into Splunk, especially if it is a custom sourcetype, it often will not be loaded properly with all the fields recognized accurately. Performing a one-time load into a temporary Splunk index from a file will ensure that any problems or incorrect field extractions won't cause dirty data to be loaded and stored with clean, tested data.

This is especially crucial when you know you will have to transform the data, for instance, using props.conf and transforms.conf. During that development process, there could be many different configurations that need to be tested and...