Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Implementing Splunk (Update)

By : VINCENT BUMGARNER, James D. Miller

4.5 (4)

Implementing Splunk (Update)

4.5 (4)

By: VINCENT BUMGARNER, James D. Miller

Overview of this book

If you are a data analyst with basic knowledge of Big Data analysis but no knowledge of Splunk, then this book will help you get started with Splunk. The book assumes that you have access to a copy of Splunk, ideally not in production, and many examples also assume you have administrator rights.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. The Splunk Interface

1. The Splunk Interface

Logging into Splunk

The home app

The top bar

The search & reporting app

Using the time picker

Using the field picker

The settings section

Summary

2. Understanding Search

2. Understanding Search

Using search terms effectively

Boolean and grouping operators

Clicking to modify your search

Using fields to search

Using wildcards efficiently

All about time

Making searches faster

Sharing results with others

Search job settings

Saving searches for reuse

Creating alerts from searches

Summary

3. Tables, Charts, and Fields

3. Tables, Charts, and Fields

About the pipe symbol

Using top to show common field values

Using stats to aggregate values

Using chart to turn data

Using timechart to show values over time

Working with fields

Summary

4. Data Models and Pivots

4. Data Models and Pivots

What is a data model?

What does a data model search?

Creating a data model

Lookup attributes

What is a pivot?

A quick example

Sparklines

Summary

5. Simple XML Dashboards

5. Simple XML Dashboards

The purpose of dashboards

Using wizards to build dashboards

Converting the panel to a report

Back to the dashboard

Editing XML directly

UI examples app

Building forms

Features replaced

Autorun dashboard

Scheduling the generation of dashboards

Summary

6. Advanced Search Examples

6. Advanced Search Examples

Using subsearches to find loosely related events

Using transaction

Determining concurrency

Calculating events per slice of time

Rebuilding top

Acceleration

Summary

7. Extending Search

7. Extending Search

Using tags to simplify search

Using event types to categorize results

Using lookups to enrich data

Using macros to reuse logic

Creating workflow actions

Using external commands

Summary

8. Working with Apps

8. Working with Apps

Defining an app

Included apps

Installing apps

Building your first app

Editing navigation

Customizing the appearance of your app

Object permissions

The app directory structure

Summary

9. Building Advanced Dashboards

9. Building Advanced Dashboards

Reasons for working with advanced XML

Reasons for not working with advanced XML

The development process

The advanced XML structure

Converting simple XML to advanced XML

Module logic flow

Understanding layoutPanel

Reusing a query

Using intentions

Creating a custom drilldown

Third-party add-ons

10. Summary Indexes and CSV Files

10. Summary Indexes and CSV Files

Understanding summary indexes

When to use a summary index

When not to use a summary index

Populating summary indexes with saved searches

Using summary index events in a query

Using sistats, sitop, and sitimechart

How latency affects summary queries

How and when to backfill summary data

Reducing summary index size

Calculating top for a large time frame

Using CSV files to store transient data

Summary

11. Configuring Splunk

11. Configuring Splunk

Locating Splunk configuration files

The structure of a Splunk configuration file

The configuration merging logic

An overview of Splunk .conf files

User interface resources

Summary

12. Advanced Deployments

12. Advanced Deployments

Planning your installation

Splunk instance types

Common data sources

Sizing indexers

Planning redundancy

Working with multiple indexes

Deploying the Splunk binary

Using apps to organize configuration

Configuration distribution

Using LDAP for authentication

Using Single Sign On

Load balancers and Splunk

Multiple search heads

Summary

13. Extending Splunk

13. Extending Splunk

Writing a scripted input to gather data

Using Splunk from the command line

Querying Splunk via REST

Writing commands

Writing a scripted lookup to enrich data

Writing an event renderer

Writing a scripted alert action to process results

Hunk

Summary

Index

Index

Working with multiple indexes

An index in Splunk is a storage pool for events, capped by size, time, or both. By default, all events will go to the index specified by defaultDatabase, which is called main but lives in a directory called defaultdb.

The directory structure of an index

Each index occupies a set of directories on the disk. By default, these directories live in $SPLUNK_DB, which, by default, is located in $SPLUNK_HOME/var/lib/splunk.

Look at the following stanza for the main index:

[main]
homePath = $SPLUNK_DB/defaultdb/db
coldPath = $SPLUNK_DB/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb
maxHotIdleSecs = 86400
maxHotBuckets = 10
maxDataSize = auto_high_volume

If our Splunk installation lives at /opt/splunk, the index main is rooted at the path /opt/splunk/var/lib/splunk/defaultdb.

To change your storage location, either modify the value of SPLUNK_DB in $SPLUNK_HOME/etc/splunk-launch.conf or set absolute paths in indexes.conf.

splunk-launch.conf cannot be controlled...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Implementing Splunk (Update)

Search

Your notes and bookmarks