Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Mastering Splunk

By : James D. Miller

2.7 (3)

Mastering Splunk

2.7 (3)

By: James D. Miller

Overview of this book

This book is for those Splunk developers who want to learn advanced strategies to deal with big data from an enterprise architectural perspective. You need to have good working knowledge of Splunk.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. The Application of Splunk

1. The Application of Splunk

The definition of Splunk

Universal file handling

Confidentiality and security

Conventional use cases

Splunk – outside the box

Splunk in action

Summary

2. Advanced Searching

2. Advanced Searching

Searching in Splunk

Knowledge management

Subsearching

Searching with parameters

Splunk macros

Search results

Summary

3. Mastering Tables, Charts, and Fields

3. Mastering Tables, Charts, and Fields

Tables, charts, and fields

Splunk bucketing

Drilldowns

Pivot

Split

Column values

Pivot table formatting

A quick example

Sparklines

Summary

4. Lookups

4. Lookups

Introduction

Configuring a simple field lookup

Command roundup

Summary

5. Progressive Dashboards

5. Progressive Dashboards

Creating effective dashboards

Form searching

Going back to dashboards

More on searching

Dynamic drilldowns

Real-world, real-time solutions

Summary

6. Indexes and Indexing

6. Indexes and Indexing

The importance of indexing

What is a Splunk index?

Indexes, indexers, and clusters

Managing Splunk indexes

Dealing with multiple indexes

Deleting your indexes and indexed data

Configuring indexes

Moving your index database

Spreading out your Splunk index

Size matters

Hitting the limits

Summary

7. Evolving your Apps

7. Evolving your Apps

Basic applications

BYO or build your own apps

App FAQs

The end-to-end customization of Splunk

Preparation for app development

Summary

8. Monitoring and Alerting

8. Monitoring and Alerting

What to monitor

Advanced monitoring

Location, location, location

Leveraging your forwarders

Can I use apps?

Windows inputs in Splunk

Getting started with monitoring

What does Splunk do with the data it monitors?

Splunk

Viewing the Splunk Deployment Monitor app

All about alerts

Editing alerts

Scheduled or real time

Extended functionalities

Summary

9. Transactional Splunk

9. Transactional Splunk

Transactions and transaction types

Transaction search

Advanced use of transactions

Summary

10. Splunk – Meet the Enterprise

10. Splunk – Meet the Enterprise

General concepts

Best practices

Definition of Splunk knowledge

Strategic knowledge management

Splunk object management with knowledge management

Naming conventions for documentation

Testing

Retrofitting

The enterprise vision

Summary

A. Quick Start

A. Quick Start

Topics

Where and how to learn Splunk

Certifications

The Splunk documentation

www.splunk.com

Splunk answers

Splunkbase

The support portal

The Splexicon

The "How-to" tutorials

User conferences, blogs, and news groups

Professional services

Obtaining the Splunk software

An environment to learn in

Summary

Index

Index

Customer Reviews

2.7 (3)

5 star

33.3%

4 star

0%

3 star

0%

2 star

33.3%

1 star

33.3%

Conventions

In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles, and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "The first step is editing the transforms.conf configuration file to add the new lookup reference."

A block of code is set as follows:

[subsearch]
maxout = 250
maxtime = 120
ttl = 400

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

lookup BUtoBUName BU as "Business Unit" OUTPUT BUName as "Business Unit Name" | Table Month, "Business Unit", "Business Unit Name", RFCST

Any command-line input or output is written as follows:

splunk restart

New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "Go to Settings and then Indexes."

Note

Warnings or important notes appear in a box like this.

Tip

Tips and tricks appear like this.

Visually different images

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Mastering Splunk

Search

Your notes and bookmarks