8. Monitoring and Alerting | Mastering Splunk

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Mastering Splunk

By : James D. Miller

2.7 (3)

Mastering Splunk

2.7 (3)

By: James D. Miller

Overview of this book

This book is for those Splunk developers who want to learn advanced strategies to deal with big data from an enterprise architectural perspective. You need to have good working knowledge of Splunk.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. The Application of Splunk

1. The Application of Splunk

The definition of Splunk

Universal file handling

Confidentiality and security

Conventional use cases

Splunk – outside the box

Splunk in action

Summary

2. Advanced Searching

2. Advanced Searching

Searching in Splunk

Knowledge management

Subsearching

Searching with parameters

Splunk macros

Search results

Summary

3. Mastering Tables, Charts, and Fields

3. Mastering Tables, Charts, and Fields

Tables, charts, and fields

Splunk bucketing

Drilldowns

Pivot

Split

Column values

Pivot table formatting

A quick example

Sparklines

Summary

4. Lookups

4. Lookups

Introduction

Configuring a simple field lookup

Command roundup

Summary

5. Progressive Dashboards

5. Progressive Dashboards

Creating effective dashboards

Form searching

Going back to dashboards

More on searching

Dynamic drilldowns

Real-world, real-time solutions

Summary

6. Indexes and Indexing

6. Indexes and Indexing

The importance of indexing

What is a Splunk index?

Indexes, indexers, and clusters

Managing Splunk indexes

Dealing with multiple indexes

Deleting your indexes and indexed data

Configuring indexes

Moving your index database

Spreading out your Splunk index

Size matters

Hitting the limits

Summary

7. Evolving your Apps

7. Evolving your Apps

Basic applications

BYO or build your own apps

App FAQs

The end-to-end customization of Splunk

Preparation for app development

Summary

8. Monitoring and Alerting

8. Monitoring and Alerting

What to monitor

Advanced monitoring

Location, location, location

Leveraging your forwarders

Can I use apps?

Windows inputs in Splunk

Getting started with monitoring

What does Splunk do with the data it monitors?

Splunk

Viewing the Splunk Deployment Monitor app

All about alerts

Editing alerts

Scheduled or real time

Extended functionalities

Summary

9. Transactional Splunk

9. Transactional Splunk

Transactions and transaction types

Transaction search

Advanced use of transactions

Summary

10. Splunk – Meet the Enterprise

10. Splunk – Meet the Enterprise

General concepts

Best practices

Definition of Splunk knowledge

Strategic knowledge management

Splunk object management with knowledge management

Naming conventions for documentation

Testing

Retrofitting

The enterprise vision

Summary

A. Quick Start

A. Quick Start

Topics

Where and how to learn Splunk

Certifications

The Splunk documentation

www.splunk.com

Splunk answers

Splunkbase

The support portal

The Splexicon

The "How-to" tutorials

User conferences, blogs, and news groups

Professional services

Obtaining the Splunk software

An environment to learn in

Summary

Index

Index

Customer Reviews

2.7 (3)

5 star

33.3%

4 star

0%

3 star

0%

2 star

33.3%

1 star

33.3%

Location, location, location

You might think that the question whether your data is local or remote is straightforward, but with Splunk, there are a few principles that will determine the answer. These include the following:

The operating system on which Splunk is installed
The kind of data that is directly connected to Splunk
Whether any authentication or other intermediate steps are needed to access the data that you want Splunk to index
The distance and size of the data being monitored

This is represented in the following diagram:

Generally speaking, if there are no intermediate steps between the data and Splunk, it's considered local. Examples of intermediate steps might be:

Attaching or connecting (for example, to a specific network disk or server)
Authentications (for example, communicating through an established firewall)
Mapping a network drive or folder

This is represented in the following diagram:

Simply put, data is considered to be remote when something needs to occur before Splunk can...

Visually different images

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Mastering Splunk

Search

Your notes and bookmarks