Book Image

Splunk Best Practices

Book Image

Splunk Best Practices

Overview of this book

This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk.
Table of Contents (16 chapters)

Types of apps


An app will be called something different depending on which tier it is placed on. Splunk would have you believe that there are only two types of apps: apps and add-ons. However those of you that have used Splunk for a while know that this is simply not true. Using general terminology, an app is something that goes on a search head, whereas an add-on is something that could go on almost any component of Splunk depending on its purpose. It can be quite confusing if you're just stepping into the Splunk world and someone says Let's install <insert app name here> app, and god forbid if someone says Let's install the enterprise security app, and they task you (a new(ish) admin) with its installation.

Search apps

This type of apps are deployed on the search head only, and primarily comprises knowledge objects. These are event types, lookup files, field extractions, and the like, as well as all the .xml files that make up the actual dashboards. This is the visualization component...