In this chapter, we cover the various ways you can powerfully enhance and enrich machine data with user-defined fields and datasets to help harness that information in a smarter and more focused way. Event types, tags, and aliases allow you to classify and normalize similar events; field extractions create fields from otherwise-unlabeled segments of an event. Lookups enhance your data with additional information, such as the meaning of HTTP status codes. Data models are pre-prepared representations of one or more datasets created to drive pivot tables and allow business users to create complex reports and visualizations without having to use the Search Processing Language (SPL). All of these enhancements create what are known as knowledge objects, and these capabilities help make Splunk a much more useful and valuable business analytics tool, so you&apos...
Splunk 7.x Quick Start Guide
By :
Splunk 7.x Quick Start Guide
By:
Overview of this book
Splunk is a leading platform and solution for collecting, searching, and extracting value from ever increasing amounts of big data - and big data is eating the world! This book covers all the crucial Splunk topics and gives you the information and examples to get the immediate job done. You will find enough insights to support further research and use Splunk to suit any business environment or situation.
Splunk 7.x Quick Start Guide gives you a thorough understanding of how Splunk works. You will learn about all the critical tasks for architecting, implementing, administering, and utilizing Splunk Enterprise to collect, store, retrieve, format, analyze, and visualize machine data. You will find step-by-step examples based on real-world experience and practical use cases that are applicable to all Splunk environments. There is a careful balance between adequate coverage of all the critical topics with short but relevant deep-dives into the configuration options and steps to carry out the day-to-day tasks that matter.
By the end of the book, you will be a confident and proficient Splunk architect and administrator.
Related Content you might be interested in
Current Title:
Splunk 7.x Quick Start Guide
Table of Contents (12 chapters)
Preface
Free Chapter
Introduction to Splunk
Architecting Splunk
Installing and Configuring Splunk
Getting Data into Splunk
Administering Splunk Apps and Users
Searching with Splunk
Splunk Knowledge Objects
Splunk Reports, Dashboards, and Alerts
Splunk Applications
Advanced Splunk
Other Books You May Enjoy
Customer Reviews