Book Image

Data Analytics Using Splunk 9.x

By : Dr. Nadine Shillingford
5 (1)
Book Image

Data Analytics Using Splunk 9.x

5 (1)
By: Dr. Nadine Shillingford

Overview of this book

Splunk 9 improves on the existing Splunk tool to include important features such as federated search, observability, performance improvements, and dashboarding. This book helps you to make the best use of the impressive and new features to prepare a Splunk installation that can be employed in the data analysis process. Starting with an introduction to the different Splunk components, such as indexers, search heads, and forwarders, this Splunk book takes you through the step-by-step installation and configuration instructions for basic Splunk components using Amazon Web Services (AWS) instances. You’ll import the BOTS v1 dataset into a search head and begin exploring data using the Splunk Search Processing Language (SPL), covering various types of Splunk commands, lookups, and macros. After that, you’ll create tables, charts, and dashboards using Splunk’s new Dashboard Studio, and then advance to work with clustering, container management, data models, federated search, bucket merging, and more. By the end of the book, you’ll not only have learned everything about the latest features of Splunk 9 but also have a solid understanding of the performance tuning techniques in the latest version.

Related Content you might be interested in

Current Title:

Small book image
Data Analytics Using Splunk 9.x
Dr. Nadine Shillingford
Jan, 2023 | 336 pages
Small book image
Splunk 7.x Quick Start Guide
James H Baxter
Nov, 2018 | 298 pages
Small book image
Splunk 9.x Enterprise Certified Admin Guide
Srikanth Yarlagadda
Aug, 2023 | 256 pages
Small book image
Mastering Splunk 8
James D Miller
Dec, 2020 | 456 pages
Table of Contents (18 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the example code files
Conventions used
Get in touch
Share Your Thoughts
Download a free PDF copy of this book
1
Part 1: Getting Started with Splunk
Part 1: Getting Started with Splunk
Free Chapter
2
Chapter 1: Introduction to Splunk and its Core Components
Chapter 1: Introduction to Splunk and its Core Components
Splunking big data
Exploring Splunk components
Introducing the case study – splunking the 
BOTS Dataset v1
Summary
3
Chapter 2: Setting Up the Splunk Environment
Chapter 2: Setting Up the Splunk Environment
Technical requirements
Installing Splunk Enterprise
Setting up Splunk forwarders
Setting up Splunk deployment servers
Setting up Splunk indexers
Setting up Splunk search heads
Installing additional Splunk add-ons and apps
Managing access to Splunk
Summary
4
Chapter 3: Onboarding and Normalizing Data
Chapter 3: Onboarding and Normalizing Data
Exploring inputs.conf using the Splunk Add-on for Microsoft Windows
Extracting fields using props.conf and transforms.conf
Creating event types and tagging
Summary
5
Part 2: Visualizing Data with Splunk
Part 2: Visualizing Data with Splunk
6
Chapter 4: Introduction to SPL
Chapter 4: Introduction to SPL
Understanding the Splunk search interface
Dissecting a Splunk query
Formatting and transforming data
Summary
7
Chapter 5: Reporting Commands, Lookups, and Macros
Chapter 5: Reporting Commands, Lookups, and Macros
Exploring more Splunk commands
Enhancing logs with lookups
Simplifying Splunk searches with macros
Summary
8
Chapter 6: Creating Tables and Charts Using SPL
Chapter 6: Creating Tables and Charts Using SPL
Creating and formatting tables
Creating and formatting charts
Creating advanced charts
Summary
9
Chapter 7: Creating Dynamic Dashboards
Chapter 7: Creating Dynamic Dashboards
Adding tables and charts to dashboards
Adding inputs, tokens, and drilldowns
Exploring the dashboard source
Adding reports and drilldowns to dashboards
Experimenting with the new Dashboard Studio
Summary
10
Part 3: Advanced Topics in Splunk
Part 3: Advanced Topics in Splunk
11
Chapter 8: Licensing, Indexing, and Buckets
Chapter 8: Licensing, Indexing, and Buckets
Understanding Splunk indexing and buckets
Exploring Splunk queues
Discussing Splunk licensing models
Summary
12
Chapter 9: Clustering and Advanced Administration
Chapter 9: Clustering and Advanced Administration
Introducing Splunk clusters
Understanding search head clusters
Understanding indexer clusters
Summary
13
Chapter 10: Data Models, Acceleration, and Other Ways to Improve Performance
Chapter 10: Data Models, Acceleration, and Other Ways to Improve Performance
Understanding data models
Accelerating data models
Improving performance
Summary
14
Chapter 11: Multisite Splunk Deployments and Federated Search
Chapter 11: Multisite Splunk Deployments and Federated Search
Exploring multisite Splunk deployments
Configuring federated search
Using federated search
Summary
15
Chapter 12: Container Management
Chapter 12: Container Management
Understanding container management
Deploying Splunk in Docker
Getting started with Splunk Operator for Kubernetes
Exploring container logs using Splunk
Summary
16
Index
Index
Why subscribe?
17
Other Books You May Enjoy
Other Books You May Enjoy
Packt is searching for authors like you
Share Your Thoughts
Download a free PDF copy of this book

Setting up Splunk deployment servers

In this section, we will set up the deployment server. We already have the three forwarders listening for configurations from the deployment server. We will need to configure the deployment server so that we can manage the forwarders, indexer, and search head from Splunk Web. But first, we must figure out how to log in to the server. We need the key pair—more specifically, the .pem file that we downloaded when we set up the key pair in step 5 of Deploying AWS EC2 instances with the Splunk Enterprise AMI. Let’s take the following steps:

  1. Using the Terminal application in MacOS, navigate to the folder where you downloaded your .pem file. Remember that we used MacOS for these instructions but you can use a SSH client such as PuTTY on Microsoft Windows as well. Refer to https://tinyurl.com/k8d84p8w for setup instructions if necessary. Log into your deploymentserver instance using a SSH client and enter yes to the authenticity prompt...
Previous Section
End of Section 5
Next Section