Book Image

Mastering Splunk

By : James D. Miller
Book Image

Mastering Splunk

By: James D. Miller

Overview of this book

This book is for those Splunk developers who want to learn advanced strategies to deal with big data from an enterprise architectural perspective. You need to have good working knowledge of Splunk.

Related Content you might be interested in

Current Title:

Small book image
Mastering Splunk
James D. Miller
Dec, 2014 | 344 pages
No titles found
Table of Contents (13 chapters)
Preface
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Free Chapter
1
1. The Application of Splunk
1. The Application of Splunk
The definition of Splunk
Universal file handling
Confidentiality and security
Conventional use cases
Splunk – outside the box
Splunk in action
Summary
2
2. Advanced Searching
2. Advanced Searching
Searching in Splunk
Knowledge management
Subsearching
Searching with parameters
Splunk macros
Search results
Summary
3
3. Mastering Tables, Charts, and Fields
3. Mastering Tables, Charts, and Fields
Tables, charts, and fields
Splunk bucketing
Drilldowns
Pivot
Split
Column values
Pivot table formatting
A quick example
Sparklines
Summary
4
4. Lookups
4. Lookups
Introduction
Configuring a simple field lookup
Command roundup
Summary
5
5. Progressive Dashboards
5. Progressive Dashboards
Creating effective dashboards
Form searching
Going back to dashboards
More on searching
Dynamic drilldowns
Real-world, real-time solutions
Summary
6
6. Indexes and Indexing
6. Indexes and Indexing
The importance of indexing
What is a Splunk index?
Indexes, indexers, and clusters
Managing Splunk indexes
Dealing with multiple indexes
Deleting your indexes and indexed data
Configuring indexes
Moving your index database
Spreading out your Splunk index
Size matters
Hitting the limits
Summary
7
7. Evolving your Apps
7. Evolving your Apps
Basic applications
BYO or build your own apps
App FAQs
The end-to-end customization of Splunk
Preparation for app development
Summary
8
8. Monitoring and Alerting
8. Monitoring and Alerting
What to monitor
Advanced monitoring
Location, location, location
Leveraging your forwarders
Can I use apps?
Windows inputs in Splunk
Getting started with monitoring
What does Splunk do with the data it monitors?
Splunk
Viewing the Splunk Deployment Monitor app
All about alerts
Editing alerts
Scheduled or real time
Extended functionalities
Summary
9
9. Transactional Splunk
9. Transactional Splunk
Transactions and transaction types
Transaction search
Advanced use of transactions
Summary
10
10. Splunk – Meet the Enterprise
10. Splunk – Meet the Enterprise
General concepts
Best practices
Definition of Splunk knowledge
Strategic knowledge management
Splunk object management with knowledge management
Naming conventions for documentation
Testing
Retrofitting
The enterprise vision
Summary
11
A. Quick Start
A. Quick Start
Topics
Where and how to learn Splunk
Certifications
The Splunk documentation
www.splunk.com
Splunk answers
Splunkbase
The support portal
The Splexicon
The "How-to" tutorials
User conferences, blogs, and news groups
Professional services
Obtaining the Splunk software
An environment to learn in
Summary
12
Index
Index

Chapter 1. The Application of Splunk

In this chapter, we will provide an explanation of what Splunk is and how it might fit into an organization's architectural roadmap. The evolution of this technology will also be discussed along with what might be considered standard or typical use cases for the technology. Finally, some more out-of-the-box uses for Splunk will be given.

The following topics will be covered in this chapter:

  • The definition of Splunk
  • The evolution of Splunk
  • The conventional uses of Splunk
  • Splunk—outside the box
Previous Section
End of Section 1
Next Section