Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Splunk Essentials - Second Edition

By : Betsy Page Sigman, Somesh Soni, Erickson Delgado

3.5 (8)

Splunk Essentials

3.5 (8)

By: Betsy Page Sigman, Somesh Soni, Erickson Delgado

Overview of this book

Splunk is a search, analysis, and reporting platform for machine data, which has a high adoption on the market. More and more organizations want to adopt Splunk to use their data to make informed decisions. This book is for anyone who wants to manage data with Splunk. You’ll start with very basics of Splunk— installing Splunk—and then move on to searching machine data with Splunk. You will gather data from different sources, isolate them by indexes, classify them into source types, and tag them with the essential fields. After this, you will learn to create various reports, XML forms, and alerts. You will then continue using the Pivot Model to transform the data models into visualization. You will also explore visualization with D3 in Splunk. Finally you’ll be provided with some real-world best practices in using Splunk.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Splunk in Action

1. Splunk in Action

Your Splunk.com account

Installing Splunk on Windows

Creating a Splunk app

Populating data with Eventgen

Controlling Splunk

Configuring Eventgen

Viewing the Destinations app

Creating your first dashboard

Summary

2. Bringing in Data

2. Bringing in Data

Splunk and big data

Splunk data sources

Creating indexes

Buckets

Data inputs

Splunk events and fields

Extracting new fields

Summary

3. Search Processing Language

3. Search Processing Language

Anatomy of a search

Time modifiers

Filtering search results

Search command - stats

Search command - top/rare

Search commands - chart and timechart

Search command - eval

Search command - rex

Summary

4. Data Models and Pivot

4. Data Models and Pivot

Creating a data model

Data model acceleration

Rearranging your dashboard

Summary

5. Data Optimization, Reports, Alerts, and Accelerating Searches

5. Data Optimization, Reports, Alerts, and Accelerating Searches

Data classification with event types

Data normalization with tags

Data enrichment with lookups

Creating reports

Creating alerts

Search and report acceleration

Scheduling best practices

Summary indexing

Summary

6. Panes of Glass

6. Panes of Glass

Creating effective dashboards

Types of dashboard

Form inputs

Creating a time range input

Creating a radio input

Creating a dropdown input

Static Real-Time dashboard

Creating a map called a choropleth

Summary

7. Splunk SDK for JavaScript and D3.js

7. Splunk SDK for JavaScript and D3.js

Introduction to Splunk SDKs

Practical applications of Splunk's SDK

Creating the final dashboard\jobs.js

Summary

8. HTTP Event Collector

8. HTTP Event Collector

What is the HEC?

How does the HEC work?

How data flows to the HEC?

Summary

9. Best Practices and Advanced Queries

9. Best Practices and Advanced Queries

Temporary indexes and oneshot indexing

Searching within an index

Search within a limited time frame

Quick searches via fast mode

Using event sampling

Splunk Universal Forwarders

Advanced queries

How to improve logs

Summary

Creating indexes

Indexes are where Splunk Enterprise stores all the data it has processed. It is essentially a collection of databases that is, by default, located at $SPLUNK_HOME/var/lib/splunk. Before data can be searched, it needs to be indexed, a process we describe here.

There are two ways to create an index, through the Splunk portal or by creating an indexes.conf file. You will be shown here how to create an index using the Splunk portal, but you should realize that when you do that, it simply generates an indexes.conf file.

You will be creating an index called wineventlogs to store Windows Event Logs. To do this, take the following steps:

In the Splunk navigation bar, go to Settings.
In the Data section, click on Indexes, which will take you to the Indexes page.
Click on New Index.
Now fill out the information for this new index as seen in the following screenshot, carefully going through steps 1 to 4.
Be sure to Save when you are done.

You will now see the new index in the list as shown...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Splunk Essentials

Search

Your notes and bookmarks