Book Image

Data Analytics Using Splunk 9.x

By : Dr. Nadine Shillingford
5 (1)
Book Image

Data Analytics Using Splunk 9.x

5 (1)
By: Dr. Nadine Shillingford

Overview of this book

Splunk 9 improves on the existing Splunk tool to include important features such as federated search, observability, performance improvements, and dashboarding. This book helps you to make the best use of the impressive and new features to prepare a Splunk installation that can be employed in the data analysis process. Starting with an introduction to the different Splunk components, such as indexers, search heads, and forwarders, this Splunk book takes you through the step-by-step installation and configuration instructions for basic Splunk components using Amazon Web Services (AWS) instances. You’ll import the BOTS v1 dataset into a search head and begin exploring data using the Splunk Search Processing Language (SPL), covering various types of Splunk commands, lookups, and macros. After that, you’ll create tables, charts, and dashboards using Splunk’s new Dashboard Studio, and then advance to work with clustering, container management, data models, federated search, bucket merging, and more. By the end of the book, you’ll not only have learned everything about the latest features of Splunk 9 but also have a solid understanding of the performance tuning techniques in the latest version.
Table of Contents (18 chapters)
1
Part 1: Getting Started with Splunk
5
Part 2: Visualizing Data with Splunk
10
Part 3: Advanced Topics in Splunk

Container Management

We discussed different configurations available for extending Splunk deployments across multiple clusters geographically and otherwise in Chapter 11, Multisite Splunk Deployments and Federated Search. These types of deployments are becoming more prevalent as the rise in globalization and data production increase. Organizations want to ensure that data is available to consumers. In this chapter, we will look at one last technology that organizations can use to deploy Splunk efficiently. Containerization is the term used to refer to hosting multiple isolated software units that share the same Operating System (OS) kernel. We have already seen one cloud-based container environment when we installed Splunk Enterprise on AWS instances in Chapter 2, Setting Up the Splunk Environment. We will look at some basic information about containers in this chapter. We will also look at spinning up Splunk in Docker containers. There, we will learn about the Splunk Operator for...