Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Knowledge objects


There are bunch of different types of knowledge object and different ways to use them in Splunk to make searching easier:

Knowledge Object

Description

Reports

Saved searches of specific data and visualizations

Alerts

Saved searches of specific data set to email an alert or commit an action when triggered

Events

A log string that is saved and given a name for later reference during a search query

Field extractions

Very specific values within a log event that can be extracted with regex; often things such as user or dest_addr

Tag

An ancillary category market for disparate yet similar event types/hosts/systems

Field alias

A second name given to a field within a sourcetype - for instance, user can be aliased to src_user

Lookups

Usually a .csv or KV store that enhances the integrity of the data being searched

Workflow actions

Usually a link to a URL or a POST action to gather data from another web source

Macro

A referenced series of functions of query...