Book Image

Splunk Operational Intelligence Cookbook

Book Image

Splunk Operational Intelligence Cookbook

Overview of this book

Related Content you might be interested in

Current Title:

Small book image
Splunk Operational Intelligence Cookbook
Oct, 2014 | 414 pages
No titles found
Table of Contents (17 chapters)
Splunk Operational Intelligence Cookbook
Splunk Operational Intelligence Cookbook
Credits
Credits
About the Authors
About the Authors
About the Reviewers
About the Reviewers
www.PacktPub.com
www.PacktPub.com
Preface
Preface
Free Chapter
1
Play Time – Getting Data In
Play Time – Getting Data In
Introduction
Indexing files and directories
Getting data through network ports
Using scripted inputs
Using modular inputs
Using the Universal Forwarder to gather data
Loading the sample data for this book
Defining field extractions
Defining event types and tags
Summary
2
Diving into Data – Search and Report
Diving into Data – Search and Report
Introduction
Making raw event data readable
Finding the most accessed web pages
Finding the most used web browsers
Identifying the top-referring websites
Charting web page response codes
Displaying web page response time statistics
Listing the top viewed products
Charting the application's functional performance
Charting the application's memory usage
Counting the total number of database connections
Summary
3
Dashboards and Visualizations – Make Data Shine
Dashboards and Visualizations – Make Data Shine
Introduction
Creating an Operational Intelligence dashboard
Using a pie chart to show the most accessed web pages
Displaying the unique number of visitors
Using a gauge to display the number of errors
Charting the number of method requests by type and host
Creating a timechart of method requests, views, and response times
Using a scatter chart to identify discrete requests by size and response time
Creating an area chart of the application's functional statistics
Using a bar chart to show the average amount spent by category
Creating a line chart of item views and purchases over time
Summary
4
Building an Operational Intelligence Application
Building an Operational Intelligence Application
Introduction
Creating an Operational Intelligence application
Adding dashboards and reports
Organizing the dashboards more efficiently
Dynamically drilling down on activity reports
Creating a form to search web activities
Linking web page activity reports to the form
Displaying a geographical map of visitors
Scheduling the PDF delivery of a dashboard
Summary
5
Extending Intelligence – Data Models and Pivoting
Extending Intelligence – Data Models and Pivoting
Introduction
Creating a data model for web access logs
Creating a data model for application logs
Accelerating data models
Pivoting total sales transactions
Pivoting purchases by geographical location
Pivoting slowest responding web pages
Pivot charting top error codes
Summary
6
Diving Deeper – Advanced Searching
Diving Deeper – Advanced Searching
Introduction
Calculating the average session time on a website
Calculating the average execution time for multi-tier web requests
Displaying the maximum concurrent checkouts
Analyzing the relationship of web requests
Predicting website-traffic volumes
Finding abnormally sized web requests
Identifying potential session spoofing
Summary
7
Enriching Data – Lookups and Workflows
Enriching Data – Lookups and Workflows
Introduction
Looking up product code descriptions
Flagging suspicious IP addresses
Creating a session state table
Adding hostnames to IP addresses
Searching ARIN for a given IP address
Triggering a Google search for a given error
Creating a ticket for application errors
Looking up inventory from an external database
Summary
8
Being Proactive – Creating Alerts
Being Proactive – Creating Alerts
Introduction
Alerting on abnormal web page response times
Alerting on errors during checkout in real time
Alerting on abnormal user behavior
Alerting on failure and triggering a scripted response
Alerting when predicted sales exceed inventory
Summary
9
Speed Up Intelligence – Data Summarization
Speed Up Intelligence – Data Summarization
Introduction
Calculating an hourly count of sessions versus completed transactions
Backfilling the number of purchases by city
Displaying the maximum number of concurrent sessions over time
Summary
10
Above and Beyond – Customization, Web Framework, REST API, and SDKs
Above and Beyond – Customization, Web Framework, REST API, and SDKs
Introduction
Customizing the application's navigation
Adding a force-directed graph of web hits
Adding a calendar heatmap of product purchases
Remotely querying Splunk's REST API for unique page views
Creating a Python application to return unique IP addresses
Creating a custom search command to format product names
Summary
Index
Index

About the Reviewers

Mika Borner is a management consultant for data analytics at LC Systems based in Switzerland, Germany, and Austria.

Drawing on his years of experience, he provides Splunk consulting in the telecommunications/ISP, financial, retail, and other industries. During the course of his career, he has held numerous positions in systems engineering in IT, with service providers, telecommunications/ISP companies, and financial institutions.

Mika was one of the first Splunk users in Europe and was later running one of the largest Splunk environments worldwide. He is also a regular speaker at the Splunk User Conference.

Amit Mund has been working on Linux and other technologies on automation and infrastructure monitoring since 2004. He is currently associated with Akamai Technologies and has previously worked for the website-hosting teams at Amazon and Yahoo!.

I would like to thank my wife, Rajashree, for always supporting me and my colleagues for helping me in my learning and development throughout my professional career.

Jon Webster has been fascinated with computers since he met his first mainframe at Hewlett-Packard at the age of 11 and played chess and Qubic on it.

In his roles from an ERP Developer through APM Product Manager and Splunk Architect, Jon has always sought to apply the maximum leverage that technology offers for his customers' benefit.

I'd like to thank my parents for encouraging me to explore these strange things they didn't understand, David Kleber and Kennon Ward for helping me learn how to optimize my code and my career, PeopleSoft for the amazing playgrounds and opportunities, Alan Habib for dragging me into APM (just attend one meeting!), and finally, Splunk for the most amazing people, tools, and opportunities I've ever had the pleasure of working with. The "Aha!" moments keep coming!

Previous Section
Next Chapter