Book Image

Data Analytics Using Splunk 9.x

By : Dr. Nadine Shillingford
5 (1)
Book Image

Data Analytics Using Splunk 9.x

5 (1)
By: Dr. Nadine Shillingford

Overview of this book

Splunk 9 improves on the existing Splunk tool to include important features such as federated search, observability, performance improvements, and dashboarding. This book helps you to make the best use of the impressive and new features to prepare a Splunk installation that can be employed in the data analysis process. Starting with an introduction to the different Splunk components, such as indexers, search heads, and forwarders, this Splunk book takes you through the step-by-step installation and configuration instructions for basic Splunk components using Amazon Web Services (AWS) instances. You’ll import the BOTS v1 dataset into a search head and begin exploring data using the Splunk Search Processing Language (SPL), covering various types of Splunk commands, lookups, and macros. After that, you’ll create tables, charts, and dashboards using Splunk’s new Dashboard Studio, and then advance to work with clustering, container management, data models, federated search, bucket merging, and more. By the end of the book, you’ll not only have learned everything about the latest features of Splunk 9 but also have a solid understanding of the performance tuning techniques in the latest version.

Related Content you might be interested in

Current Title:

Small book image
Data Analytics Using Splunk 9.x
Dr. Nadine Shillingford
Jan, 2023 | 336 pages
Small book image
Splunk 7.x Quick Start Guide
James H Baxter
Nov, 2018 | 298 pages
Small book image
Splunk 9.x Enterprise Certified Admin Guide
Srikanth Yarlagadda
Aug, 2023 | 256 pages
Small book image
Mastering Splunk 8
James D Miller
Dec, 2020 | 456 pages
Table of Contents (18 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the example code files
Conventions used
Get in touch
Share Your Thoughts
Download a free PDF copy of this book
1
Part 1: Getting Started with Splunk
Part 1: Getting Started with Splunk
Free Chapter
2
Chapter 1: Introduction to Splunk and its Core Components
Chapter 1: Introduction to Splunk and its Core Components
Splunking big data
Exploring Splunk components
Introducing the case study – splunking the 
BOTS Dataset v1
Summary
3
Chapter 2: Setting Up the Splunk Environment
Chapter 2: Setting Up the Splunk Environment
Technical requirements
Installing Splunk Enterprise
Setting up Splunk forwarders
Setting up Splunk deployment servers
Setting up Splunk indexers
Setting up Splunk search heads
Installing additional Splunk add-ons and apps
Managing access to Splunk
Summary
4
Chapter 3: Onboarding and Normalizing Data
Chapter 3: Onboarding and Normalizing Data
Exploring inputs.conf using the Splunk Add-on for Microsoft Windows
Extracting fields using props.conf and transforms.conf
Creating event types and tagging
Summary
5
Part 2: Visualizing Data with Splunk
Part 2: Visualizing Data with Splunk
6
Chapter 4: Introduction to SPL
Chapter 4: Introduction to SPL
Understanding the Splunk search interface
Dissecting a Splunk query
Formatting and transforming data
Summary
7
Chapter 5: Reporting Commands, Lookups, and Macros
Chapter 5: Reporting Commands, Lookups, and Macros
Exploring more Splunk commands
Enhancing logs with lookups
Simplifying Splunk searches with macros
Summary
8
Chapter 6: Creating Tables and Charts Using SPL
Chapter 6: Creating Tables and Charts Using SPL
Creating and formatting tables
Creating and formatting charts
Creating advanced charts
Summary
9
Chapter 7: Creating Dynamic Dashboards
Chapter 7: Creating Dynamic Dashboards
Adding tables and charts to dashboards
Adding inputs, tokens, and drilldowns
Exploring the dashboard source
Adding reports and drilldowns to dashboards
Experimenting with the new Dashboard Studio
Summary
10
Part 3: Advanced Topics in Splunk
Part 3: Advanced Topics in Splunk
11
Chapter 8: Licensing, Indexing, and Buckets
Chapter 8: Licensing, Indexing, and Buckets
Understanding Splunk indexing and buckets
Exploring Splunk queues
Discussing Splunk licensing models
Summary
12
Chapter 9: Clustering and Advanced Administration
Chapter 9: Clustering and Advanced Administration
Introducing Splunk clusters
Understanding search head clusters
Understanding indexer clusters
Summary
13
Chapter 10: Data Models, Acceleration, and Other Ways to Improve Performance
Chapter 10: Data Models, Acceleration, and Other Ways to Improve Performance
Understanding data models
Accelerating data models
Improving performance
Summary
14
Chapter 11: Multisite Splunk Deployments and Federated Search
Chapter 11: Multisite Splunk Deployments and Federated Search
Exploring multisite Splunk deployments
Configuring federated search
Using federated search
Summary
15
Chapter 12: Container Management
Chapter 12: Container Management
Understanding container management
Deploying Splunk in Docker
Getting started with Splunk Operator for Kubernetes
Exploring container logs using Splunk
Summary
16
Index
Index
Why subscribe?
17
Other Books You May Enjoy
Other Books You May Enjoy
Packt is searching for authors like you
Share Your Thoughts
Download a free PDF copy of this book

Creating event types and tagging

An event type is a way of categorizing data to make it easier to search. For example, we might want to get all authentication-type events from multiple log sources or we may tag all error messages with an error tag. In this section, we will explore event types for our BOTS Dataset v1.

An event type is a Splunk query. It is similar to the queries that we have executed so far in this chapter. Let’s look at an example. Suppose we wanted to get all authentication logs from our BOTS Dataset v1. Where would we find those logs?

  1. We can search our dataset by using the tag keyword. Enter the following Splunk query in the search bar:
    index=botsv1 earliest=0 tag=authentication
  2. Click on the sourcetype field in Interesting fields on the left of the page. We will see that most of the authentication events come from the Windows logs (see Figure 3.27):
Figure 3.27 – Using tag=authentication in a search of the botsv1 data

Figure 3.27 – Using tag=authentication in a search of the...

Previous Section
End of Section 4
Next Section