Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Mastering Splunk

By : James D. Miller

2.7 (3)

Mastering Splunk

2.7 (3)

By: James D. Miller

Overview of this book

This book is for those Splunk developers who want to learn advanced strategies to deal with big data from an enterprise architectural perspective. You need to have good working knowledge of Splunk.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. The Application of Splunk

1. The Application of Splunk

The definition of Splunk

Universal file handling

Confidentiality and security

Conventional use cases

Splunk – outside the box

Splunk in action

Summary

2. Advanced Searching

2. Advanced Searching

Searching in Splunk

Knowledge management

Subsearching

Searching with parameters

Splunk macros

Search results

Summary

3. Mastering Tables, Charts, and Fields

3. Mastering Tables, Charts, and Fields

Tables, charts, and fields

Splunk bucketing

Drilldowns

Pivot

Split

Column values

Pivot table formatting

A quick example

Sparklines

Summary

4. Lookups

4. Lookups

Introduction

Configuring a simple field lookup

Command roundup

Summary

5. Progressive Dashboards

5. Progressive Dashboards

Creating effective dashboards

Form searching

Going back to dashboards

More on searching

Dynamic drilldowns

Real-world, real-time solutions

Summary

6. Indexes and Indexing

6. Indexes and Indexing

The importance of indexing

What is a Splunk index?

Indexes, indexers, and clusters

Managing Splunk indexes

Dealing with multiple indexes

Deleting your indexes and indexed data

Configuring indexes

Moving your index database

Spreading out your Splunk index

Size matters

Hitting the limits

Summary

7. Evolving your Apps

7. Evolving your Apps

Basic applications

BYO or build your own apps

App FAQs

The end-to-end customization of Splunk

Preparation for app development

Summary

8. Monitoring and Alerting

8. Monitoring and Alerting

What to monitor

Advanced monitoring

Location, location, location

Leveraging your forwarders

Can I use apps?

Windows inputs in Splunk

Getting started with monitoring

What does Splunk do with the data it monitors?

Splunk

Viewing the Splunk Deployment Monitor app

All about alerts

Editing alerts

Scheduled or real time

Extended functionalities

Summary

9. Transactional Splunk

9. Transactional Splunk

Transactions and transaction types

Transaction search

Advanced use of transactions

Summary

10. Splunk – Meet the Enterprise

10. Splunk – Meet the Enterprise

General concepts

Best practices

Definition of Splunk knowledge

Strategic knowledge management

Splunk object management with knowledge management

Naming conventions for documentation

Testing

Retrofitting

The enterprise vision

Summary

A. Quick Start

A. Quick Start

Topics

Where and how to learn Splunk

Certifications

The Splunk documentation

www.splunk.com

Splunk answers

Splunkbase

The support portal

The Splexicon

The "How-to" tutorials

User conferences, blogs, and news groups

Professional services

Obtaining the Splunk software

An environment to learn in

Summary

Index

Index

Customer Reviews

2.7 (3)

5 star

33.3%

4 star

0%

3 star

0%

2 star

33.3%

1 star

33.3%

Obtaining the Splunk software

To obtain the Splunk software, you need to carry out the steps explained in the following sections.

Disclaimer

The first step is to read the Splunk Software License Agreement (which can be found at http://www.splunk.com/view/SP-CAAAAFA; once you install the software, you'll find it in the installation folder).

Note

Note that although you have the ability to download a full-featured copy of Splunk Enterprise for free, the software license agreement rules the installation and uses, and it is incumbent on you to understand.

Disk space requirements

The next step is typical for any software installation, that is, evaluating your hardware to ensure that you can successfully run Splunk to meet your requirements. Though Splunk is extremely optimized, a best practice is if you are evaluating Splunk, you should use hardware typical of the environment you intend to employ to. The hardware you use for evaluation should meet or exceed the recommended hardware capacity specifications...

Visually different images

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Mastering Splunk

Search

Your notes and bookmarks