Splunk is a leading platform that fosters an efficient methodology and delivers ways to search, monitor, and analyze growing amounts of big data. This book will allow you to implement new services and utilize them to quickly and efficiently process machine-generated big data.
We'll introduce you to all the new features, improvements, and offerings of Splunk 7. We cover the new modules of Splunk—Splunk Cloud and the Machine Learning Toolkit—to ease data usage. Furthermore, you will learn how to use search terms effectively with boolean and grouping operators. You will learn not only how to modify your search to make your searches fast, but also how to use wildcards efficiently. Later, you will learn how to use stats to aggregate values, a chart to turn data, and a time chart to show values over time; you'll also work with fields and chart enhancements and learn how to create a data model with faster data model acceleration. Once this is done, you will learn about XML dashboards, working with apps, building advanced dashboards, configuring and extending Splunk, advanced deployments, and more. Finally, we'll teach you how to use the Machine Learning Toolkit and some best practices and tips to help you implement Splunk services effectively and efficiently.
By the end of this book, you will have learned the Splunk software as a whole and implemented Splunk services in your tasks at projects.
This book is intended for data analysts, business analysts, and IT administrators who want to make the best use of big data, operational intelligence, log management, and monitoring within their organization. Some knowledge of Splunk services will help you get the most out of the book.
Chapter 1, The Splunk Interface, walks you through the most common elements in the Splunk interface.
Chapter 2, Understanding Search, dives into the nuts and bolts of how searching works so that you can make efficient searches to populate the cool reports.
Chapter 3, Tables, Charts, and Fields, starts using fields for more than searches; we'll build tables and graphs. Then we'll learn how to make our own fields.
Chapter 4, Data Models and Pivots, covers data models and pivots, the pivot editor, pivot elements and filters, and sparklines.
Chapter 5, Simple XML Dashboards, demonstrates simple XML dashboards; their purpose; using wizards to build, schedule the generation of, and edit XML directly; and building forms.
Chapter 6, Advanced Search Examples, dives into advanced search examples, which can be a lot of fun. We'll expose some really powerful features of the search language and go over a few tricks that I've learned over the years.
Chapter 7, Extending Search, uses more advanced features of Splunk to help extend the search language and enrich data at search time.
Chapter 8, Working with Apps, explores what makes up a Splunk app, as well as the latest self-service app management (originally introduced in version 6.6) updated in version 7.0.
Chapter 9, Building Advanced Dashboards, covers module nesting, layoutPanel, intentions, and an alternative to intentions with SideView Utils.
Chapter 10, Summary Indexes and CSV Files, explores the use of summary indexes and the commands surrounding them.
Chapter 11, Configuring Splunk, overviews how configurations work and gives a commentary on the most common aspects of Splunk configuration.
Chapter 12, Advanced Deployments, digs into distributed deployments and looks at how they are efficiently configured.
Chapter 13, Extending Splunk, shows a number of ways in which Splunk can be extended to input, manipulate, and output events.
Chapter 14, Machine Learning Toolkit, overviews the fundamentals of Splunk's Machine Learning Toolkit and shows how it can be used to create a machine learning model.
To start with the book, you will first need to download Splunk from https://www.splunk.com/en_us/download.html.
You can find the official installation manual at http://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements.
Note
The codes in this book use a data generator which can be used to test the queries given in the book. However, since the data is randomly generated, not all queries will work as expected and you may have to modify them accordingly.
You can download the example code files for this book from your account at www.packtpub.com. If you purchased this book elsewhere, you can visit www.packtpub.com/support and register to have the files emailed directly to you.
You can download the code files by following these steps:
- Log in or register at www.packtpub.com.
- Select the
SUPPORTtab. - Click on
Code Downloads & Errata. - Enter the name of the book in the
Searchbox and follow the onscreen instructions.
Once the file is downloaded, please make sure that you unzip or extract the folder using the latest version of:
- WinRAR/7-Zip for Windows
- Zipeg/iZip/UnRarX for Mac
- 7-Zip/PeaZip for Linux
The code bundle for the book is also hosted on GitHub at https://github.com/PacktPublishing/Implementing-Splunk-7-Third-Edition. In case there's an update to the code, it will be updated on the existing GitHub repository.
We also have other code bundles from our rich catalog of books and videos available at https://github.com/PacktPublishing/. Check them out!
There are a number of text conventions used throughout this book.
CodeInText: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: "The events must have a _time field."
A block of code is set as follows:
sourcetype="impl_splunk_gen" ip="*" | rex "ip=(?P<subnet>\d+\.\d+\.\d+)\.\d+" | table ip subnet
Bold: Indicates a new term, an important word, or words that you see onscreen. For example, words in menus or dialog boxes appear in the text like this. Here is an example: "There are several ways to define a field. Let's start by using the Extract Fields interface."
Feedback from our readers is always welcome.
General feedback: Email [email protected] and mention the book title in the subject of your message. If you have questions about any aspect of this book, please email us at [email protected].
Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you would report this to us. Please visit www.packtpub.com/submit-errata, selecting your book, clicking on the Errata Submission Form link, and entering the details.
Piracy: If you come across any illegal copies of our works in any form on the Internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [email protected] with a link to the material.
If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit authors.packtpub.com.
Please leave a review. Once you have read and used this book, why not leave a review on the site that you purchased it from? Potential readers can then see and use your unbiased opinion to make purchase decisions, we at Packt can understand what you think about our products, and our authors can see your feedback on their book. Thank you!
For more information about Packt, please visit packtpub.com.