Chapter 1, The Application of Splunk, provides an explanation of what Splunk is all about and how it can fit into an organization's architectural roadmap. The evolution aspect is also discussed along with what might be considered standard or typical use cases for this technology. Finally, some more out-of-the-box uses for Splunk are given.

Chapter 2, Advanced Searching, demonstrates advanced searching topics and techniques, providing meaningful examples as we go along. It focuses on searching operators, command formats and tags, subsearching, searching with parameters, efficient searching with macros, and search results.

Chapter 3, Mastering Tables, Charts, and Fields, provides in-depth methods to leverage Splunk tables, charts, and fields. It also provides working examples.

Chapter 4, Lookups, covers Splunk lookups and workflows and discusses more on the value and designing aspect of lookups, including file and script lookups.

Chapter 5, Progressive Dashboards, explains the default Splunk dashboard and then expands into the advanced features offered by Splunk for making business-effective dashboards.

Chapter 6, Indexes and Indexing, defines the idea of indexing, explaining its functioning and its importance and goes through the basic to advanced concepts of indexing step by step.

Chapter 7, Evolving Your Apps, discusses advanced topics of Splunk applications and add-ons, such as navigation, searching, and sharing. Sources to find additional application examples are also provided.

Chapter 8, Monitoring and Alerting, explains monitoring as well as the alerting capabilities of the Splunk technology and compares Splunk with other monitoring tools.

Chapter 9, Transactional Splunk, defines and describes Splunk transactions from an enterprise perspective. This chapter covers transactions and transaction types, advanced use of transactions, configuration of types of transactions, grouping events, concurrent events in Splunk, what to avoid during transactions, and so on.

Chapter 10, Splunk – Meet the Enterprise, introduces the idea of Splunk from an enterprise perspective. Best practices on important developments, such as naming, testing, documentation, and developing a vision are covered in detail.

Appendix, Quick Start, gives examples of the many resources one can use to become a Splunk master (from certification tracks to the company's website, and support portal, and everything in between). The process to obtain a copy of the latest version of Splunk and the default installation of Splunk is also covered.

If you don't have the time for formal training or to read through gigabytes of help files, but still want to master Splunk, then this book is for you. All you need is a Windows computer, general skills with Windows, and the data that you want to explore.

Whether you know Splunk basics or not, this book will transform you into a master Splunker by providing masterful insights and step-by-step, unusual Splunk solution examples.

In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles, and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "The first step is editing the transforms.conf configuration file to add the new lookup reference."

A block of code is set as follows:

[subsearch]
maxout = 250
maxtime = 120
ttl = 400

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

lookup BUtoBUName BU as "Business Unit" OUTPUT BUName as "Business Unit Name" | Table Month, "Business Unit", "Business Unit Name", RFCST

Any command-line input or output is written as follows:

splunk restart

New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "Go to Settings and then Indexes."

Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or may have disliked. Reader feedback is important for us to develop titles that you really get the most out of.

To send us general feedback, simply send an e-mail to <[email protected]>, and mention the book title via the subject of your message.

If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide on www.packtpub.com/authors.

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.