Splunk Essentials - Second Edition

Table of contents

1. Splunk Essentials Second Edition
   1. Splunk Essentials Second Edition
   2. Credits
   3. About the Authors
   4. About the Reviewer
   5. www.PacktPub.com
      1. Why subscribe?
   6. Preface
      1. What this book covers
      2. What you need for this book
      3. Who this book is for
      4. Conventions
      5. Reader feedback
      6. Customer support
         1. Downloading the example code
         2. Downloading the color images of this book
         3. Errata
         4. Piracy
         5. Questions
   7. 1. Splunk in Action
      1. Your Splunk.com account
         1. Obtaining a Splunk.com account
      2. Installing Splunk on Windows
         1. Logging in the first time
         2. Run a simple search
      3. Creating a Splunk app
      4. Populating data with Eventgen
         1. Installing an add-on
      5. Controlling Splunk
      6. Configuring Eventgen
      7. Viewing the Destinations app
      8. Creating your first dashboard
      9. Summary
   8. 2. Bringing in Data
      1. Splunk and big data
         1. Streaming data
         2. Latency of data
         3. Sparseness of data
      2. Splunk data sources
         1. Machine data
         2. Web logs
         3. Data files
         4. Social media data
         5. Other data types
      3. Creating indexes
      4. Buckets
      5. Data inputs
      6. Splunk events and fields
      7. Extracting new fields
      8. Summary
   9. 3. Search Processing Language
      1. Anatomy of a search
         1. Search pipeline
      2. Time modifiers
      3. Filtering search results
      4. Search command - stats
      5. Search command - top/rare
      6. Search commands - chart and timechart
      7. Search command - eval
      8. Search command - rex
      9. Summary
   10. 4. Data Models and Pivot
       1. Creating a data model
          1. Adding attributes to objects
          2. Creating child objects
          3. Creating an attribute based on a regular expression
       2. Data model acceleration
          1. The Pivot Editor
          2. Creating a chart from a Pivot
          3. Creating an area chart
          4. Creating a pie chart showing destination details by airport code
          5. Single value with trending sparkline
       3. Rearranging your dashboard
       4. Summary
   11. 5. Data Optimization, Reports, Alerts, and Accelerating Searches
       1. Data classification with event types
       2. Data normalization with tags
       3. Data enrichment with lookups
       4. Creating reports
       5. Creating alerts
       6. Search and report acceleration
       7. Scheduling best practices
       8. Summary indexing
       9. Summary
   12. 6. Panes of Glass
       1. Creating effective dashboards
       2. Types of dashboard
          1. Gathering information and business requirements
          2. Dynamic form-based dashboard
             1. Creating a Status Distribution panel
             2. Creating the Status Types Over Time panel
             3. Creating the Hits vs Response Time panel
             4. Arranging the dashboard
          3. Panel options
             1. Pie chart - status distribution
             2. Stacked area chart - Status Types Over Time
          4. Column with line overlay combo chart - Hits vs Response Time
       3. Form inputs
       4. Creating a time range input
       5. Creating a radio input
       6. Creating a dropdown input
       7. Static Real-Time dashboard
          1. Single Value Panels with color ranges
          2. Creating panels by cloning
          3. Single Value Panels with trends
          4. Real-time column charts with line overlays
       8. Creating a map called a choropleth
       9. Summary
   13. 7. Splunk SDK for JavaScript and D3.js
       1. Introduction to Splunk SDKs
       2. Practical applications of Splunk's SDK
          1. Prerequisites
          2. Creating a CRON Job
          3. Creating a saved search
       3. Creating the final dashboard\jobs.js
          1. HTTP server
          2. Rendering the chart
       4. Summary
   14. 8. HTTP Event Collector
       1. What is the HEC?
       2. How does the HEC work?
       3. How data flows to the HEC?
          1. Logging in data
          2. Using a token with data
          3. Sending out the data request
          4. Verifying the token
          5. Indexing the data
             1. Enabling the HEC
             2. Generating an HEC authentication token
             3. How to test the HEC with cURL and PowerShell
                1. Using the HEC with dynamic UI events
             4. JavaScript logging with the HEC
       4. Summary
   15. 9. Best Practices and Advanced Queries
       1. Temporary indexes and oneshot indexing
       2. Searching within an index
       3. Search within a limited time frame
       4. Quick searches via fast mode
       5. Using event sampling
       6. Splunk Universal Forwarders
       7. Advanced queries
          1. Subsearch
          2. Using append
          3. Using join
          4. Using eval and if
          5. Using eval and match with a case function
       8. How to improve logs
          1. Including clear key-value pairs
          2. Creating events that are understandable to human readers
          3. Remember to use timestamps for all events
          4. Be sure your identifiers are unique
          5. Log using text format, not binary
          6. Use formats that developers can use easily
          7. Log what you think might be useful at some point
          8. Create use categories with meaning
          9. Include the source of the log event
          10. Minimize the number of multi-line events
       9. Summary