2. Bringing in Data | Splunk Essentials

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Splunk Essentials - Second Edition

By : Betsy Page Sigman, Somesh Soni, Erickson Delgado

3.5 (8)

Splunk Essentials

3.5 (8)

By: Betsy Page Sigman, Somesh Soni, Erickson Delgado

Overview of this book

Splunk is a search, analysis, and reporting platform for machine data, which has a high adoption on the market. More and more organizations want to adopt Splunk to use their data to make informed decisions. This book is for anyone who wants to manage data with Splunk. You’ll start with very basics of Splunk— installing Splunk—and then move on to searching machine data with Splunk. You will gather data from different sources, isolate them by indexes, classify them into source types, and tag them with the essential fields. After this, you will learn to create various reports, XML forms, and alerts. You will then continue using the Pivot Model to transform the data models into visualization. You will also explore visualization with D3 in Splunk. Finally you’ll be provided with some real-world best practices in using Splunk.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Splunk in Action

1. Splunk in Action

Your Splunk.com account

Installing Splunk on Windows

Creating a Splunk app

Populating data with Eventgen

Controlling Splunk

Configuring Eventgen

Viewing the Destinations app

Creating your first dashboard

Summary

2. Bringing in Data

2. Bringing in Data

Splunk and big data

Splunk data sources

Creating indexes

Buckets

Data inputs

Splunk events and fields

Extracting new fields

Summary

3. Search Processing Language

3. Search Processing Language

Anatomy of a search

Time modifiers

Filtering search results

Search command - stats

Search command - top/rare

Search commands - chart and timechart

Search command - eval

Search command - rex

Summary

4. Data Models and Pivot

4. Data Models and Pivot

Creating a data model

Data model acceleration

Rearranging your dashboard

Summary

5. Data Optimization, Reports, Alerts, and Accelerating Searches

5. Data Optimization, Reports, Alerts, and Accelerating Searches

Data classification with event types

Data normalization with tags

Data enrichment with lookups

Creating reports

Creating alerts

Search and report acceleration

Scheduling best practices

Summary indexing

Summary

6. Panes of Glass

6. Panes of Glass

Creating effective dashboards

Types of dashboard

Form inputs

Creating a time range input

Creating a radio input

Creating a dropdown input

Static Real-Time dashboard

Creating a map called a choropleth

Summary

7. Splunk SDK for JavaScript and D3.js

7. Splunk SDK for JavaScript and D3.js

Introduction to Splunk SDKs

Practical applications of Splunk's SDK

Creating the final dashboard\jobs.js

Summary

8. HTTP Event Collector

8. HTTP Event Collector

What is the HEC?

How does the HEC work?

How data flows to the HEC?

Summary

9. Best Practices and Advanced Queries

9. Best Practices and Advanced Queries

Temporary indexes and oneshot indexing

Searching within an index

Search within a limited time frame

Quick searches via fast mode

Using event sampling

Splunk Universal Forwarders

Advanced queries

How to improve logs

Summary

Splunk and big data

Splunk is useful for datasets of all types, and it allows you to use big data tools on datasets of all sizes. But with the recent focus on big data, its usefulness becomes even more apparent. Big data is a term used everywhere these days, but one that few people understand. In this part of the chapter, we will discuss aspects of big data and the terms that describe those aspects.

Streaming data

Much of the data that is large and comes quickly does not need to be kept. For instance, consider a mechanical plant; there can be many sensors that collect data on all parts of the assembly line. The significance of this data is primarily to be able to alert someone to a possible upcoming problem (through noticing a bad trend) or to a current problem (by drawing attention to a metric that has exceeded some designated level); and much of it does not need to be kept for a long period of time. Often this type of data loses its importance once its timeliness expires and its main usefulness...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Splunk Essentials

Search

Your notes and bookmarks