Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Modules


Splunk's Simplified XML is basically XML with JavaScript at the backend. Splunk lovingly refers to these JavaScripts as extensions when one is needed for a specific function. In simplified XML, they have some basic modules that someone can access in order to create a dashboard with ease by pointing and clicking, instead of having to know all the advanced XML to render a page.

Each module has a series of tokens that can pass data values down to an underlying search, or even be put in a link to a URL. These become very important in Splunk development in order to display the appropriate information and filter on the click of a button.

There are a few different module types.

Data input

Data input modules are things that add or filter data within a Splunk dashboard. The most common is the time range picker module, which adds the length of time a dashboard will search. There are others such as text input, radio button, check box, drop down, and multi-select to name a few. These are the basis...