Book Image

Splunk Operational Intelligence Cookbook - Third Edition

By : Josh Diakun, Paul R. Johnson, Derek Mock
Book Image

Splunk Operational Intelligence Cookbook - Third Edition

By: Josh Diakun, Paul R. Johnson, Derek Mock

Overview of this book

Splunk makes it easy for you to take control of your data, and with Splunk Operational Cookbook, you can be confident that you are taking advantage of the Big Data revolution and driving your business with the cutting edge of operational intelligence and business analytics. With more than 80 recipes that demonstrate all of Splunk’s features, not only will you find quick solutions to common problems, but you’ll also learn a wide range of strategies and uncover new ideas that will make you rethink what operational intelligence means to you and your organization. You’ll discover recipes on data processing, searching and reporting, dashboards, and visualizations to make data shareable, communicable, and most importantly meaningful. You’ll also find step-by-step demonstrations that walk you through building an operational intelligence application containing vital features essential to understanding data and to help you successfully integrate a data-driven way of thinking in your organization. Throughout the book, you’ll dive deeper into Splunk, explore data models and pivots to extend your intelligence capabilities, and perform advanced searching with machine learning to explore your data in even more sophisticated ways. Splunk is changing the business landscape, so make sure you’re taking advantage of it.

Related Content you might be interested in

Current Title:

Small book image
Splunk Operational Intelligence Cookbook - Third Edition
Josh Diakun | Paul R. Johnson | Derek Mock
May, 2018 | 541 pages
Small book image
Splunk 7 Essentials, Third Edition
Steven Koelpin | Erickson Delgado | Betsy Page Sigman | JP Contreras
Mar, 2018 | 220 pages
Small book image
Splunk 7.x Quick Start Guide
James H Baxter
Nov, 2018 | 298 pages
Small book image
Mastering Splunk 8
James D Miller
Dec, 2020 | 456 pages
Table of Contents (12 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Sections
Get in touch
Free Chapter
1
Play Time – Getting Data In
Play Time – Getting Data In
Introduction
Indexing files and directories
Getting data through network ports
Using scripted inputs
Using modular inputs
Using the Universal Forwarder to gather data
Receiving data using the HTTP Event Collector
Getting data from databases using DB Connect
Loading the sample data for this book
Data onboarding – defining field extractions
Data onboarding - defining event types and tags
Installing the Machine Learning Toolkit
2
Diving into Data – Search and Report
Diving into Data – Search and Report
Introduction
Making raw event data readable
Finding the most accessed web pages
Finding the most used web browsers
Identifying the top-referring websites
Charting web page response codes
Displaying web page response time statistics
Listing the top-viewed products
Charting the application's functional performance
Charting the application's memory usage
Counting the total number of database connections
3
Dashboards and Visualizations - Make Data Shine
Dashboards and Visualizations - Make Data Shine
Introduction
Creating an Operational Intelligence dashboard
Using a pie chart to show the most accessed web pages
Displaying the unique number of visitors
Using a gauge to display the number of errors
Charting the number of method requests by type and host
Creating a timechart of method requests, views, and response times
Using a scatter chart to identify discrete requests by size and response time
Creating an area chart of the application's functional statistics
Using metrics data and a trellis layout to monitor physical environment operating conditions
Using a bar chart to show the average amount spent by category
Creating a line chart of item views and purchases over time
4
Building an Operational Intelligence Application
Building an Operational Intelligence Application
Introduction
Creating an Operational Intelligence application
Adding dashboards and reports
Organizing the dashboards more efficiently
Dynamically drilling down on activity reports
Creating a form for searching web activity
Linking web page activity reports to the form
Displaying a geographical map of visitors
Highlighting average product price
Scheduling the PDF delivery of a dashboard
5
Extending Intelligence – Datasets, Modeling and Pivoting
Extending Intelligence – Datasets, Modeling and Pivoting
Introduction
Creating a data model for web access logs
Creating a data model for application logs
Accelerating data models
Pivoting total sales transactions
Pivoting purchases by geographic location
Pivoting slowest responding web pages
Pivot charting top error codes
6
Diving Deeper – Advanced Searching, Machine Learning and Predictive Analytics
Diving Deeper – Advanced Searching, Machine Learning and Predictive Analytics
Introduction
Calculating the average session time on a website
Calculating the average execution time for multi-tier web requests
Displaying the maximum concurrent checkouts
Analyzing the relationship of web requests
Predicting website traffic volumes
Finding abnormally-sized web requests
Identifying potential session spoofing
Detecting outliers in server response times
Forecasting weekly sales
Summary
7
Enriching Data – Lookups and Workflows
Enriching Data – Lookups and Workflows
Introduction
Looking up product code descriptions
Flagging suspect IP addresses
Creating a session state table
Adding hostnames to IP addresses
Searching ARIN for a given IP address
Triggering a Google search for a given error
Generating a chat notification for application errors
Looking up inventory from an external database
8
Being Proactive – Creating Alerts
Being Proactive – Creating Alerts
Introduction
Alerting on abnormal web page response times
Alerting on errors during checkout in real time
Alerting on abnormal user behavior
Alerting on failure and triggering a chat notification
Alerting when predicted sales exceed inventory
Generating alert events for high sensor readings
9
Speeding Up Intelligence – Data Summarization
Speeding Up Intelligence – Data Summarization
Introduction
Calculating an hourly count of sessions versus completed transactions
Backfilling the number of purchases by city
Displaying the maximum number of concurrent sessions over time
10
Above and Beyond – Customization, Web Framework, HTTP Event Collector, REST API, and SDKs
Above and Beyond – Customization, Web Framework, HTTP Event Collector, REST API, and SDKs
Introduction
Customizing the application navigation
Adding a Sankey diagram of web hits
Developing a tag cloud of purchases by country
Adding Cell Icons to Highlight Average Product Price
Remotely querying Splunk's REST API for unique page views
Creating a Python application to return unique IP addresses
Creating a custom search command to format product names
Collecting data from remote scanning devices
11
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

Introduction

In the previous chapter, we were introduced to Splunk's awesome dashboarding and visualization capabilities. We created several basic dashboards and populated them with various operational intelligence-driven visualizations. In this chapter, we will continue to build on what we have learned in the previous chapters and further advance our Splunk dashboarding knowledge. You will learn how to create a Splunk application and populate it with several dashboards. You will also learn to use some of Splunk's more advanced dashboarding capabilities such as forms, drill downs, maps, and column highlighting.

Splunk applications (or apps) are best thought of as workspaces designed specifically around certain use cases. In this chapter, we will be building a new application that focuses specifically on Operational Intelligence. Splunk apps can vary in complexity from...

Previous Section
End of Section 2
Next Section