Book Image

Mastering Splunk

By : James D. Miller
Book Image

Mastering Splunk

By: James D. Miller

Overview of this book

Table of Contents (18 chapters)
Mastering Splunk
About the Author
About the Reviewers

Knowledge management

As mentioned, you can define or create Splunk transactional types for later use by yourself or for other Splunk users by utilizing the transactiontypes.conf file. A lot of thought should go into a Splunk knowledge management strategy. You will find more on this topic later in this book, but for now, here are the basics you can use to define some Splunk transactions:

  1. If it doesn't already exist, you can use a text editor to create a transactiontypes.conf file in $SPLUNK_HOME/etc/system/local/ or your own custom app directory in $SPLUNK_HOME/etc/apps/.

  2. Next, define transactions using the following arguments:

    maxspan =  [<integer> s|m|h|d|-1]
    maxpause = [<integer> s|m|h|d|-1]
    fields = <comma-separated list of fields>
    startswith = <transam-filter-string>

Let's discover the functions of the code terms in the preceding example:

  • transactiontype: This is the name of the transaction type

  • maxspan...