Splunk is a powerful tool to collect, store, alert, report, and study machine data. This machine data usually comes from server logs, but it could also be collected from other sources. Splunk is, by far, the most flexible and scalable solution available to tackle the huge problem of making machine data useful.
The goal of the original version of this book was to serve as an organized and curated guide to Splunk 4.3. This version endeavors to preserve that objective, while focusing on the latest version (at the time of writing) of Splunk—6.2.0. In fact, care has been taken to call out the differences between the versions. In addition, new content has been added, covering search acceleration methods, backfilling, data replication, and Hunk.
As the documentation and community resources available to Splunk are vast, finding important pieces of knowledge can be daunting at times. My goal is to present what is needed for the effective implementation of Splunk in as concise and useful a manner as possible.
Chapter 1, The Splunk Interface, walks you through the elements of the user interface.
Chapter 2, Understanding Search, covers the basics of the searches, paying particular attention to writing efficient queries.
Chapter 3, Tables, Charts, and Fields, shows you how you can use fields for reporting and then covers the process of building your own fields.
Chapter 4, Data Models and Pivots, explains and defines Splunk data models and pivots, along with the pivot editor, pivot elements and filters, Sparklines, and more.
Chapter 5, Simple XML Dashboards, first uses the Splunk web interface to build our first dashboards. The chapter then examines how you can build forms and more efficient dashboards.
Chapter 6, Advanced Search Examples, walks you through examples of using Splunk's powerful search language in interesting ways.
Chapter 7, Extending Search, exposes a number of features in Splunk to help you to categorize events and act upon search results in powerful ways.
Chapter 8, Working with Apps, covers the concepts of an app, helps you in installing a couple of popular apps, and then helps you in building your own app.
Chapter 9, Building Advanced Dashboards, explains the concepts of advanced XML dashboards and covers practical ways to transition from simple XML to advanced XML dashboards.
Chapter 10, Summary Indexes and CSV Files, introduces the concept of summary indexes and shows you how they can be used to improve performance. It also discusses how CSV files can be used in interesting ways.
Chapter 11, Configuring Splunk, explains the structure and meaning of common configurations in Splunk. The chapter also explains the process of merging configurations in great detail.
Chapter 12, Advanced Deployments, covers common questions about multi-machine Splunk deployments, including data inputs, syslog, configuration management, and scaling up.
Chapter 13, Extending Splunk, demonstrates ways in which code can be used to extend Splunk for data input, external querying, rendering, custom commands, and custom actions.
To work through the examples in this book, you will need an installation of Splunk, preferably a nonproduction instance. If you are already working with Splunk, then the concepts introduced by the examples should be applicable to your own data.
Splunk can be downloaded for free from http://www.splunk.com/download, for most popular platforms.
The sample code was developed on a UNIX system, so you will probably have better luck using an installation of Splunk that is running on a UNIX operating system. Knowledge of Python is necessary to follow certain examples in the later chapters.
This book should be useful to new users, seasoned users, dashboard designers, and system administrators alike. This book does not try to act as a replacement for the official Splunk documentation but should serve as a shortcut for many concepts.
For some sections, a good understanding of regular expressions would be helpful.
For some sections, the ability to read Python would be helpful.
In this book, you will find a number of text styles that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning.
Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: " The address will look like http://mysplunkserver:8000 or http://mysplunkserver.mycompany.com:8000"
A block of code is set as follows:
sourcetype="impl_splunk_gen" (mary AND error) NOT debug NOT worthless NOT logoutclass
Any command-line input or output is written as follows:
$SPLUNK_HOME/bin/splunk reload deploy-server
New terms and important words are shown in bold. Words that you see on the screen, for example, in menus or dialog boxes, appear in the text like this: " Clicking on Settings, on the top bar, takes you to the Settings page."
Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or disliked. Reader feedback is important for us as it helps us develop titles that you will really get the most out of.
To send us general feedback, simply e-mail <[email protected]>, and mention the book's title in the subject of your message.
If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide at www.packtpub.com/authors.
Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.
You can download the example code files from your account at http://www.packtpub.com for all the Packt Publishing books you have purchased. If you purchased this book elsewhere, you can visit http://www.packtpub.com/support and register to have the files e-mailed directly to you.
Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you could report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the Errata Submission Form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website or added to any list of existing errata under the Errata section of that title.
To view the previously submitted errata, go to https://www.packtpub.com/books/content/support and enter the name of the book in the search field. The required information will appear under the Errata section.
Piracy of copyrighted material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works in any form on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy.
Please contact us at <[email protected]> with a link to the suspected pirated material.
We appreciate your help in protecting our authors and our ability to bring you valuable content.
If you have a problem with any aspect of this book, you can contact us at <[email protected]>, and we will do our best to address the problem.