Book Image

Splunk 7.x Quick Start Guide

By : James H. Baxter
Book Image

Splunk 7.x Quick Start Guide

By: James H. Baxter

Overview of this book

Splunk is a leading platform and solution for collecting, searching, and extracting value from ever increasing amounts of big data - and big data is eating the world! This book covers all the crucial Splunk topics and gives you the information and examples to get the immediate job done. You will find enough insights to support further research and use Splunk to suit any business environment or situation. Splunk 7.x Quick Start Guide gives you a thorough understanding of how Splunk works. You will learn about all the critical tasks for architecting, implementing, administering, and utilizing Splunk Enterprise to collect, store, retrieve, format, analyze, and visualize machine data. You will find step-by-step examples based on real-world experience and practical use cases that are applicable to all Splunk environments. There is a careful balance between adequate coverage of all the critical topics with short but relevant deep-dives into the configuration options and steps to carry out the day-to-day tasks that matter. By the end of the book, you will be a confident and proficient Splunk architect and administrator.

Related Content you might be interested in

Current Title:

Small book image
Splunk 7.x Quick Start Guide
James H. Baxter
Nov, 2018 | 298 pages
Small book image
Splunk 9.x Enterprise Certified Admin Guide
Srikanth Yarlagadda
Aug, 2023 | 256 pages
Small book image
Data Analytics Using Splunk 9.x
Nadine Shillingford
Jan, 2023 | 336 pages
Small book image
Splunk 7 Essentials
Steven Koelpin | Erickson Delgado | JP Contreras | Betsy Page Sigman
Mar, 2018 | 220 pages
Table of Contents (12 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
Free Chapter
1
Introduction to Splunk
Introduction to Splunk
What is Splunk?
Installing Splunk for free
Splunk components
Splunk processing tiers
Splunk events
Splunk information resources
Summary
2
Architecting Splunk
Architecting Splunk
Selecting a Splunk configuration
Selecting Splunk hardware options
Summary
3
Installing and Configuring Splunk
Installing and Configuring Splunk
Installing Splunk Enterprise
Configuring Splunk components
Documenting your Splunk deployment
Summary
4
Getting Data into Splunk
Getting Data into Splunk
Installing Splunk universal forwarder
Setting up a heavy forwarder
Configuring other data source inputs
Configuring an HTTP Event Collector
Introduction to apps
Using the deployment server
Managing Splunk Indexes
Splunk sourcetypes
Using the cluster master
Summary
5
Administering Splunk Apps and Users
Administering Splunk Apps and Users
Using the deployer
Configuring users and roles
Best practices for administering Splunk
Supporting your Splunk Deployment
Summary
6
Searching with Splunk
Searching with Splunk
The Splunk Web interface
Creating Splunk searches
Visualizing search results
Advanced search commands
Summary
7
Splunk Knowledge Objects
Splunk Knowledge Objects
Field extractions
Other knowledge objects
Summary
8
Splunk Reports, Dashboards, and Alerts
Splunk Reports, Dashboards, and Alerts
Introduction
Creating reports
Creating a dashboard
Creating an alert
Summary
9
Splunk Applications
Splunk Applications
Splunk apps and add-ons
Creating a Splunk app
Using Splunkbase
Splunk DB Connect
Splunk Premium apps
Summary
10
Advanced Splunk
Advanced Splunk
Troubleshooting Splunk
Performance and capacity
REST API endpoints
Splunk Monitoring Console
Splunk development
Additional study topics
Summary
11
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

Splunk sourcetypes

Splunk uses specific configuration files for telling the indexers how to parse incoming data to properly extract the timestamps and specific event fields, and how to identify when one event ends and the next one starts (linebreaks); this is done with a props.conf file. In some cases, you'll need to tell Splunk how to transform (modify or add) data from existing fields into new fields and/or modify or mask those fields–this is done with a transforms.conf file. The props.conf file contains stanzas that define a sourcetype and how it behaves; entries in the props.conf stanzas can also reference stanzas in a transforms.conf file to perform transformation operations.

A sourcetype is one of the default metadata fields that Splunk software assigns to all incoming data. It tells Splunk what kind of data is being ingested so that it can identify the...

Previous Section
End of Section 9
Next Section