Splunk 7 Essentials - Third Edition

Splunk 7 Essentials - Third Edition

by J-P Contreras, Erickson Delgado, Betsy Page Sigman
Released March 2018
Publisher(s): Packt Publishing
ISBN: 9781788839112

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Transform machine data into powerful analytical intelligence using Splunk

About This Book

  • Analyze and visualize machine data to step into the world of Splunk!
  • Leverage the exceptional analysis and visualization capabilities to make informed decisions for your business
  • This easy-to-follow, practical book can be used by anyone - even if you have never managed data before

Who This Book Is For

This book is for the beginners who want to get well versed in the services offered by Splunk 7. If you want to be a data/business analyst or want to be a system administrator, this book is what you want. No prior knowledge of Splunk is required.

What You Will Learn

  • Install and configure Splunk for personal use
  • Store event data in Splunk indexes, classify events into sources, and add data fields
  • Learn essential Splunk Search Processing Language commands and best practices
  • Create powerful real-time or user-input dashboards
  • Be proactive by implementing alerts and scheduled reports
  • Tips from the Fez: best practices using Splunk features and add-ons
  • Understand security and deployment considerations for taking Splunk to an organizational level

In Detail

Splunk is a search, reporting, and analytics software platform for machine data, which has an ever-growing market adoption rate. More organizations than ever are adopting Splunk to make informed decisions in areas such as IT operations, information security, and the Internet of Things.

The first two chapters of the book will get you started with a simple Splunk installation and set up of a sample machine data generator, called Eventgen.

After this, you will learn to create various reports, dashboards, and alerts. You will also explore Splunk's Pivot functionality to model data for business users. You will then have the opportunity to test-drive Splunk's powerful HTTP Event Collector. After covering the core Splunk functionality, you'll be provided with some real-world best practices for using Splunk, and information on how to build upon what you've learned in this book.

Throughout the book, there will be additional comments and best practice recommendations from a member of the SplunkTrust Community, called "Tips from the Fez".

Style and approach

This fast-paced, example-rich guide will help you analyze and visualize machine data with Splunk through simple, practical instructions and recommendations.

Table of contents

  1. Title Page
  2. Copyright and Credits
    1. Splunk 7 Essentials Third Edition
  3. Packt Upsell
    1. Why subscribe?
    2. PacktPub.com
  4. Contributors
    1. About the authors
    2. About the reviewers
    3. Packt is searching for authors like you
  5. Preface
    1. Who this book is for
    2. What this book covers
    3. To get the most out of this book
      1. Download the example code files
      2. Download the color images
      3. Conventions used
    4. Get in touch
      1. Reviews
  6. Splunk – Getting Started
    1. Your Splunk account
      1. Obtaining a Splunk account
    2. Installing Splunk on Windows
    3. Installing Splunk on Linux
      1. Logging in for the first time
      2. Running a simple search
    4. Creating a Splunk app
    5. Populating data with Eventgen
      1. Using the CLI to configure Eventgen
        1. Installing the Eventgen add-on (Windows and Linux)
    6. Controlling Splunk
    7. Configuring Eventgen
    8. Viewing the Destinations app
    9. Creating your first dashboard
    10. Summary
  7. Bringing in Data
    1. Splunk and big data
      1. Streaming data
      2. Analytical data latency
      3. Sparseness of data
    2. Splunk data sources
      1. Machine data
      2. Web logs
      3. Data files
      4. Social media data
      5. Relational database data
      6. Other data types
    3. Creating indexes
    4. Buckets
    5. Log files as data input
    6. Splunk events and fields
    7. Extracting new fields
    8. Summary
  8. Search Processing Language
    1. Anatomy of a search
      1. Search pipeline
    2. Time modifiers
    3. Filtering search results
    4. Search command – stats
    5. Search command – top/rare
    6. Search commands – chart and timechart
    7. Search command – eval
    8. Search command – rex
    9. Summary
  9. Reporting, Alerts, and Search Optimization
    1. Data classification with Event Types
    2. Data normalization with Tags
    3. Data enrichment with Lookups
    4. Creating and scheduling reports
    5. Creating alerts
    6. Search and Report acceleration
    7. Scheduling options
    8. Summary indexing
    9. Summary
  10. Dynamic Dashboarding
    1. Creating effective dashboards
    2. Types of dashboards
      1. Gathering business requirements
      2. Dynamic form-based dashboard
        1. Creating a Status Distribution panel
        2. Creating the Status Types Over Time panel
        3. Creating the Hits vs Response Time panel
        4. Arrange the dashboard
      3. Panel options
        1. Pie chart – Status Distribution
        2. Stacked area chart – Status Types Over Time
      4. Column with overlay combination chart – Hits vs Response Time
    3. Form inputs
    4. Creating a time range input
    5. Creating a radio input
    6. Creating a drop-down input
    7. Static real-time dashboard
      1. Single-value panels with color ranges
      2. Creating panels by cloning
      3. Single-value panels with trends
      4. Real-time column charts with line overlays
    8. Creating a choropleth map
    9. Summary
  11. Data Models and Pivot
    1. Creating a data model
      1. Adding attributes to objects
      2. Creating child objects
      3. Creating an attribute based on a regular expression
    2. Data model acceleration
      1. The Pivot editor
      2. Creating a Pivot and a chart
      3. Creating an area chart
      4. Creating a pie chart
      5. Single value with trending sparkline
    3. Rearranging your dashboard
    4. Summary
  12. HTTP Event Collector
    1. What is the HEC?
    2. How does the HEC work?
    3. How data flows to the HEC
      1. Logging data
      2. Using a token with data
      3. Sending out the data request
      4. Verifying the token
      5. Indexing the data
        1. Enabling the HEC
        2. Generating an HEC authentication token
        3. Seeing the HEC in action with cURL
        4. Indexer acknowledgement
    4. Summary
  13. Best Practices and Advanced Queries
    1. Indexes for testing
    2. Searching within an index
    3. Search within a limited time frame
    4. Quick searches via fast mode
    5. Using event sampling
    6. Use the fields command to improve search performance
    7. Advanced searches
      1. Subsearch
      2. Using append
      3. Using join
      4. Using eval and if
      5. Using eval and match with a case function
    8. Summary
  14. Taking Splunk to the Organization
    1. Common organizational use cases
      1. IT operations
      2. Cybersecurity
      3. Software development and support operations
      4. Internet of Things
    2. Splunk architecture considerations
      1. Splunk architecture for an organization
        1. Search capacity
        2. Indexing capacity and data replication
        3. High availability for critical environments
        4. Monitoring Console
      2. Forwarders
        1. Universal forwarder
        2. Heavy forwarder
      3. Splunk Cloud
      4. Splunk pricing model
    3. The Splunk community and online resources
    4. Summary

Product information

  • Title: Splunk 7 Essentials - Third Edition
  • Author(s): J-P Contreras, Erickson Delgado, Betsy Page Sigman
  • Release date: March 2018
  • Publisher(s): Packt Publishing
  • ISBN: 9781788839112