5. Progressive Dashboards | Mastering Splunk

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Mastering Splunk

By : James D. Miller

2.7 (3)

Mastering Splunk

2.7 (3)

By: James D. Miller

Overview of this book

This book is for those Splunk developers who want to learn advanced strategies to deal with big data from an enterprise architectural perspective. You need to have good working knowledge of Splunk.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. The Application of Splunk

1. The Application of Splunk

The definition of Splunk

Universal file handling

Confidentiality and security

Conventional use cases

Splunk – outside the box

Splunk in action

Summary

2. Advanced Searching

2. Advanced Searching

Searching in Splunk

Knowledge management

Subsearching

Searching with parameters

Splunk macros

Search results

Summary

3. Mastering Tables, Charts, and Fields

3. Mastering Tables, Charts, and Fields

Tables, charts, and fields

Splunk bucketing

Drilldowns

Pivot

Split

Column values

Pivot table formatting

A quick example

Sparklines

Summary

4. Lookups

4. Lookups

Introduction

Configuring a simple field lookup

Command roundup

Summary

5. Progressive Dashboards

5. Progressive Dashboards

Creating effective dashboards

Form searching

Going back to dashboards

More on searching

Dynamic drilldowns

Real-world, real-time solutions

Summary

6. Indexes and Indexing

6. Indexes and Indexing

The importance of indexing

What is a Splunk index?

Indexes, indexers, and clusters

Managing Splunk indexes

Dealing with multiple indexes

Deleting your indexes and indexed data

Configuring indexes

Moving your index database

Spreading out your Splunk index

Size matters

Hitting the limits

Summary

7. Evolving your Apps

7. Evolving your Apps

Basic applications

BYO or build your own apps

App FAQs

The end-to-end customization of Splunk

Preparation for app development

Summary

8. Monitoring and Alerting

8. Monitoring and Alerting

What to monitor

Advanced monitoring

Location, location, location

Leveraging your forwarders

Can I use apps?

Windows inputs in Splunk

Getting started with monitoring

What does Splunk do with the data it monitors?

Splunk

Viewing the Splunk Deployment Monitor app

All about alerts

Editing alerts

Scheduled or real time

Extended functionalities

Summary

9. Transactional Splunk

9. Transactional Splunk

Transactions and transaction types

Transaction search

Advanced use of transactions

Summary

10. Splunk – Meet the Enterprise

10. Splunk – Meet the Enterprise

General concepts

Best practices

Definition of Splunk knowledge

Strategic knowledge management

Splunk object management with knowledge management

Naming conventions for documentation

Testing

Retrofitting

The enterprise vision

Summary

A. Quick Start

A. Quick Start

Topics

Where and how to learn Splunk

Certifications

The Splunk documentation

www.splunk.com

Splunk answers

Splunkbase

The support portal

The Splexicon

The "How-to" tutorials

User conferences, blogs, and news groups

Professional services

Obtaining the Splunk software

An environment to learn in

Summary

Index

Index

Customer Reviews

2.7 (3)

5 star

33.3%

4 star

0%

3 star

0%

2 star

33.3%

1 star

33.3%

More on searching

Earlier (in this chapter), we said that a search delivers the content of each dashboard panel. A dashboard panel can be one of the several content types. Here, we will take a look at examples of each.

When you add a (new) panel to an existing dashboard, you get to select the panel's content type simply by clicking on the appropriate icon, as shown in the following screenshot:

Inline searches

Dashboard panels can use live, inline searches as the source for the content displayed in the panel. Once you have added a panel to your dashboard, you can click on the panel edit icon and then select Edit Search String. In the Edit Search dialog, edit the Splunk search pipeline, select Time Range, and then click on Save, as shown here:

The Edit Search dialog box

A saved search report

In addition to panels that execute inline searches for content, you can add panels that use a saved Splunk report. Once you add a panel (to a dashboard), you can click on the panel edit icon and select New Report...

Visually different images

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Mastering Splunk

Search

Your notes and bookmarks