Book Image

Data Analytics Using Splunk 9.x

By : Dr. Nadine Shillingford
5 (1)
Book Image

Data Analytics Using Splunk 9.x

5 (1)
By: Dr. Nadine Shillingford

Overview of this book

Splunk 9 improves on the existing Splunk tool to include important features such as federated search, observability, performance improvements, and dashboarding. This book helps you to make the best use of the impressive and new features to prepare a Splunk installation that can be employed in the data analysis process. Starting with an introduction to the different Splunk components, such as indexers, search heads, and forwarders, this Splunk book takes you through the step-by-step installation and configuration instructions for basic Splunk components using Amazon Web Services (AWS) instances. You’ll import the BOTS v1 dataset into a search head and begin exploring data using the Splunk Search Processing Language (SPL), covering various types of Splunk commands, lookups, and macros. After that, you’ll create tables, charts, and dashboards using Splunk’s new Dashboard Studio, and then advance to work with clustering, container management, data models, federated search, bucket merging, and more. By the end of the book, you’ll not only have learned everything about the latest features of Splunk 9 but also have a solid understanding of the performance tuning techniques in the latest version.
Table of Contents (18 chapters)
1
Part 1: Getting Started with Splunk
5
Part 2: Visualizing Data with Splunk
10
Part 3: Advanced Topics in Splunk

Exploring container logs using Splunk

Since the focus of this book has been exploring data using Splunk, let’s briefly talk about monitoring containers. Containers can introduce increased complexity in monitoring. Although they have positive attributes such as scalability, flexibility, and lower cost, troubleshooting can be very tricky. We’ll focus on Docker in this section. By default, Docker logs are stored in /var/lib/docker/containers/<container_id> on the host where container_id is running. In a simple scenario, we can use the following Docker command to fetch logs from a container:

docker logs <container_id>

We can determine the container_id property by using the docker ps command to list all the running containers. The docker logs command retrieves batches of container logs that are available at the time of execution. This method works for troubleshooting or monitoring small deployments. However, it will not work for situations where containers...