Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Setting expectations


I expect that every organization is different with respect to their criteria for what they are alerting on. However, I can tell you from working across many sectors, and at some major institutions, that leadership generally wants the same thing no matter what company you work for. Allow me to give you a breakdown list of what leaderships' expectations are of Splunk and its alerting capabilities, across industries.

Splunk should be able to:

  • Alert on the future

  • Predict the future

  • Automatically know when all users are experiencing problems simultaneously

  • Tame dragons

  • Slay gods

  • Perform prophetic-like miracles in real-time

  • Save them billions of dollars

  • Automate their departments' workflow

After all, it is a Big Data platform with machine learning capabilities, right?

I am exaggerating here, but Splunk is both a big data platform and one that has machine learning capabilities. Contrary to popular belief it is not SkyNet nor the Matrix. I've checked under the hood; I didn't see Arnold...