Book Image

Implementing Splunk: Big Data Reporting and Development for Operational Intelligence

By : VINCENT BUMGARNER
Book Image

Implementing Splunk: Big Data Reporting and Development for Operational Intelligence

By: VINCENT BUMGARNER

Overview of this book

Splunk is a data collection, indexing, and visualization engine for operational intelligence. It's a powerful and versatile search and analysis engine that lets you investigate, troubleshoot, monitor, alert, and report on everything that's happening in your entire IT infrastructure from one location in real time. Splunk collects, indexes, and harnesses all the fast moving machine data generated by our applications, servers, and devices - physical, virtual, and in the cloud.Given a mountain of machine data, this book shows you exactly how to learn to use Splunk to make something useful from it. Depending on your needs, you can learn to search, transform, and display data, or learn to administer your Splunk installation, large or small. "Implementing Splunk: Big Data Reporting and Development for Operational Intelligence" will help you get your job done faster, whether you read from the beginning or jump to what you need to know today. New and experienced users alike will find nuggets of wisdom throughout.This book provides you with valuable examples and step-by-step instructions, showing you how to take advantage of everything Splunk has to offer you, to make the most out of your machine data."Implementing Splunk: Big Data Reporting and Development for Operational Intelligence" takes you on a journey right from inception to a fully functioning implementation of Splunk. Using a real-world data walkthrough, you'll be shown how to search effectively, create fields, build dashboards, reports, and package apps, manage your indexes, integrate into the enterprise, and extend Splunk. This practical implementation guide equips you with high-level knowledge for configuring, deploying, extending, and integrating Splunk. Depending on the goal and skills of the reader, enough topics are covered to get you on your way to dashboard guru, app developer, or enterprise administrator. This book uses examples curates reference, and sage advice to help you make the most of this incredibly powerful tool.
Table of Contents (19 chapters)
Implementing Splunk: Big Data Reporting and Development for Operational Intelligence
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
Index

The top bar


The bar across the top of the window contains information about where you are as well as quick links to preferences, other apps, and administration.

The current app is specified in the upper-left corner.

Clicking on the Splunk logo or the text takes you to the default page for that app. In most apps, the text next to the logo is simply changed, but the whole block can be customized with logos and alternate text by modifying the app's CSS. We will cover this in Chapter 7, Working with Apps.

The upper-right corner of the window contains action links that are almost always available:

  • The name of the user that is currently logged in appears first. In this case, the user is Administrator. Clicking on the username takes you to the Your account page.

  • The App menu provides quick links to installed apps and to app administration. Only apps with GUI components that the current user has permissions to see will be listed in this menu.

  • The Manager link is always available at the top of the window. The availability of options on the Manager page is controlled by the role of the user.

  • The Jobs link pops up the Jobs window. The Jobs window provides a listing of current and past search jobs that have been run on this Splunk instance. It is useful for retrieving past results as well as determining what searches are using resources. We will discuss this interface in detail in Chapter 2, Understanding Search.

  • Logout ends the session and forces the user to log in again.

The following screenshot shows what the Your account page looks like:

This form presents the global preferences that a user is allowed to change. Other settings that affect users are configured through permissions on objects and settings on roles.

  • Full name and Email address are stored for the administrator's convenience.

  • Time zone can be changed for each user. This is a new feature in Splunk 4.3.

    Note

    Setting the time zone only affects the time zone used to display the data. It is very important that the date is parsed properly when events are indexed. We will discuss this in detail in Chapter 2, Understanding Search.

  • Default app controls where you first land after login. Most users will want to change this to search.

  • Restart backgrounded jobs controls whether unfinished queries should run again if Splunk is restarted.

  • Set password allows you to change your password. This is only relevant if Splunk is configured to use internal authentication. For instance, if the system is configured to use Windows Active Directory via LDAP (a very common configuration), users must change their password in Windows.