Book Image

Splunk Essentials - Second Edition

By : Betsy Page Sigman, Erickson Delgado
Book Image

Splunk Essentials - Second Edition

By: Betsy Page Sigman, Erickson Delgado

Overview of this book

Splunk is a search, analysis, and reporting platform for machine data, which has a high adoption on the market. More and more organizations want to adopt Splunk to use their data to make informed decisions. This book is for anyone who wants to manage data with Splunk. You’ll start with very basics of Splunk— installing Splunk—and then move on to searching machine data with Splunk. You will gather data from different sources, isolate them by indexes, classify them into source types, and tag them with the essential fields. After this, you will learn to create various reports, XML forms, and alerts. You will then continue using the Pivot Model to transform the data models into visualization. You will also explore visualization with D3 in Splunk. Finally you’ll be provided with some real-world best practices in using Splunk.

Related Content you might be interested in

Current Title:

Small book image
Splunk Essentials - Second Edition
Betsy Page Sigman | Erickson Delgado
Sep, 2016 | 236 pages
No titles found
Table of Contents (15 chapters)
Splunk Essentials Second Edition
Splunk Essentials Second Edition
Credits
Credits
About the Authors
About the Authors
About the Reviewer
About the Reviewer
www.PacktPub.com
www.PacktPub.com
Preface
Preface
Free Chapter
1
Splunk in Action
Splunk in Action
Your Splunk.com account
Installing Splunk on Windows
Creating a Splunk app
Populating data with Eventgen
Controlling Splunk
Configuring Eventgen
Viewing the Destinations app
Creating your first dashboard
Summary
2
Bringing in Data
Bringing in Data
Splunk and big data
Splunk data sources
Creating indexes
Buckets
Data inputs
Splunk events and fields
Extracting new fields
Summary
3
Search Processing Language
Search Processing Language
Anatomy of a search
Time modifiers
Filtering search results
Search command - stats
Search command - top/rare
Search commands - chart and timechart
Search command - eval
Search command - rex
Summary
4
Data Models and Pivot
Data Models and Pivot
Creating a data model
Data model acceleration
Rearranging your dashboard
Summary
5
Data Optimization, Reports, Alerts, and Accelerating Searches
Data Optimization, Reports, Alerts, and Accelerating Searches
Data classification with event types
Data normalization with tags
Data enrichment with lookups
Creating reports
Creating alerts
Search and report acceleration
Scheduling best practices
Summary indexing
Summary
6
Panes of Glass
Panes of Glass
Creating effective dashboards
Types of dashboard
Form inputs
Creating a time range input
Creating a radio input
Creating a dropdown input
Static Real-Time dashboard
Creating a map called a choropleth
Summary
7
Splunk SDK for JavaScript and D3.js
Splunk SDK for JavaScript and D3.js
Introduction to Splunk SDKs
Practical applications of Splunk's SDK
Creating the final dashboard\jobs.js
Summary
8
HTTP Event Collector
HTTP Event Collector
What is the HEC?
How does the HEC work?
How data flows to the HEC?
Summary
9
Best Practices and Advanced Queries
Best Practices and Advanced Queries
Temporary indexes and oneshot indexing
Searching within an index
Search within a limited time frame
Quick searches via fast mode
Using event sampling
Splunk Universal Forwarders
Advanced queries
How to improve logs
Summary

Configuring Eventgen

We are almost there. Proceed by first downloading the exercise materials that will be used in this book. Open an Administrator command prompt and make sure you are in the root of the C: drive. If you are using Git, clone the entire project with this Git command:

C:\> git clone https://github.com/ericksond/splunk-essentials.git

You can alternatively just download the ZIP file and extract it in your computer using https://github.com/ericksond/splunk-essentials/archive/master.zip.

The Eventgen configuration you will need for the exercises in this book has been packaged and is ready to go. We are not going into the details of how to configure Eventgen. If you are interested in learning more about Eventgen, visit the project page at http://github.com/splunk/eventgen.

Follow these instructions to proceed:

  1. Extract the project ZIP file into your local machine. Open an administrator console and CD into the directory where you extracted the file.

  2. Create a new samples directory in the Destinations Splunk app. The path of this new directory will be $SPLUNK_HOME/etc/apps/destinations/samples: 

    C:\> mkdir c:\splunk\etc\apps\destinations\samples

  3. Copy all the *.sample files from /labs/chapter01/eventgen of the extracted project directory into the newly-created samples directory. You can also copy and paste using the GUI if you prefer it: 

    C:\> copy splunk-essentials\labs\chapter01\eventgen\*.sample 
           c:\Splunk\etc\apps\destinations\samples\

  4. Now copy the eventgen.conf into the $SPLUNK_HOME/etc/apps/destinations/local directory. You can also copy and paste using the GUI if you prefer it: 

    C:\> copy splunk-essentials\labs\chapter01\eventgen\eventgen.conf 
           c:\Splunk\etc\apps\destinations\local\

  5. Grant the SYSTEM account full access permissions to the eventgen.conf file. This is a very important step. You can either do it using the following icacls command or change it using the Windows GUI:

    C:\> icacls c:\Splunk\etc\apps\destinations\local\eventgen.conf 
           /grant SYSTEM:F

    A successful output of this command will look like this:

    processed file: c:\Splunk\etc\apps\destinations\local\eventgen.conf
Successfully processed 1 files; Failed processing 0 files

  6. Restart Splunk.

Previous Section
End of Section 7
Next Section