book

Implementing Splunk (Update)

Name: Implementing Splunk (Update)
ISBN: 9781784391607

by VINCENT BUMGARNER, James D. Miller

July 2015

Beginner to intermediate

506 pages

10h 22m

English

Packt Publishing

Read now

Unlock full access

Implementing Splunk Second Edition
Table of Contents
Implementing Splunk Second Edition
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Support files, eBooks, discount offers, and moreWhy subscribe?Free access for Packt account holdersInstant updates on new Packt books
Preface
What this book covers
What you need for this book
Who this book is for

Conventions
Reader feedback
Customer support
Downloading the example codeErrataPiracyQuestions
1. The Splunk Interface
Logging into Splunk
The home app
The top bar
The search & reporting app
The data generatorThe summary viewSearchActionsTimelineThe field pickerFieldsSearch resultsOptionsThe events viewer
Using the time picker
Using the field picker
The settings section
Summary
2. Understanding Search
Using search terms effectively
Boolean and grouping operators
Clicking to modify your search
Event segmentationField widgetsTime
Using fields to search
Using the field picker
Using wildcards efficiently
Supplementing wildcards in fields
All about time
How Splunk parses timeHow Splunk stores timeHow Splunk displays timeHow time zones are determined and why it mattersDifferent ways to search against timePresetsRelativeReal-timeWindowed real-time versus all-time real-time searchesDate rangeDate and time rangeAdvancedSpecifying time in-line in your search_indextime versus _time
Making searches faster
Sharing results with others
The URLSave as reportSave as dashboard panelSave as alertSave as event type
Search job settings
Saving searches for reuse
Creating alerts from searches
Enable actionsAction optionsSharing
Summary
3. Tables, Charts, and Fields
About the pipe symbol
Using top to show common field values
Controlling the output of top
Using stats to aggregate values
Using chart to turn data
Using timechart to show values over time
Timechart options
Working with fields
A regular expression primerCommands that create fieldsevalrexExtracting loglevelUsing the extract fields interfaceUsing rex to prototype a fieldUsing the admin interface to build a fieldIndexed fields versus extracted fieldsIndexed field case 1 – rare instances of a common termIndexed field case 2 – splitting wordsIndexed field case 3 – application from sourceIndexed field case 4 – slow requestsIndexed field case 5 – unneeded work
Summary
4. Data Models and Pivots
What is a data model?
What does a data model search?
Data model objectsObject constrainingAttributes
Creating a data model
Filling in the new data model dialogEditing attributes
Lookup attributes
Children
What is a pivot?
The pivot editorWorking with pivot elementsFiltering your pivotsSplit (row or column)Column valuesPivot table formatting
A quick example
Sparklines
Summary
5. Simple XML Dashboards
The purpose of dashboards
Using wizards to build dashboards
Adding another panelA cool trick
Converting the panel to a report
More options
Back to the dashboard
Add inputEdit source
Editing XML directly
UI examples app
Building forms
Creating a form from a dashboardDriving multiple panels from one formPost-processing search resultsPost-processing limitations
Features replaced
Autorun dashboard
Scheduling the generation of dashboards
Summary
6. Advanced Search Examples
Using subsearches to find loosely related eventsSubsearchSubsearch caveatsNested subsearches
Using transaction
Using transaction to determine the session's lengthCalculating the aggregate of transaction statisticsCombining subsearches with transaction
Determining concurrency
Using transaction with concurrencyUsing concurrency to estimate server loadCalculating concurrency with a by clause
Calculating events per slice of time
Using timechartCalculating average requests per minuteCalculating average events per minute, per hour
Rebuilding top
Acceleration
Big data - summary strategyReport accelerationReport acceleration availability
Summary
7. Extending Search
Using tags to simplify search
Using event types to categorize results
Using lookups to enrich data
Defining a lookup table fileDefining a lookup definitionDefining an automatic lookupTroubleshooting lookups
Using macros to reuse logic
Creating a simple macroCreating a macro with arguments
Creating workflow actions
Running a new search using values from an eventLinking to an external siteBuilding a workflow action to show field contextBuilding the context workflow actionBuilding the context macro
Using external commands
Extracting values from XMLxmlkvXPathUsing Google to generate results
Summary
8. Working with Apps
Defining an app
Included apps
Installing apps
Installing apps from SplunkbaseUsing Geo Location Lookup ScriptUsing Google MapsInstalling apps from a file
Building your first app
Editing navigation
Customizing the appearance of your app
Customizing the launcher iconUsing custom CSSUsing custom HTMLCustom HTML in a simple dashboardUsing server-side include in a complex dashboard
Object permissions
How permissions affect navigationHow permissions affect other objectsCorrecting permission problems
The app directory structure
Adding your app to SplunkbasePreparing your appConfirming sharing settingsCleaning up our directoriesPackaging your appUploading your app
Summary
9. Building Advanced Dashboards
Reasons for working with advanced XML
Reasons for not working with advanced XML
The development process
The advanced XML structure
Converting simple XML to advanced XML
Module logic flow
Understanding layoutPanel
Panel placement
Reusing a query
Using intentions
stringreplaceaddterm
Creating a custom drilldown
Building a drilldown to a custom queryBuilding a drilldown to another panelBuilding a drilldown to multiple panels using HiddenPostProcess
Third-party add-ons
Google MapsSideview UtilsThe Sideview search moduleLinking views with SideviewSideview URLLoaderSideview formsSummary
10. Summary Indexes and CSV Files
Understanding summary indexesCreating a summary index
When to use a summary index
When not to use a summary index
Populating summary indexes with saved searches
Using summary index events in a query
Using sistats, sitop, and sitimechart
How latency affects summary queries
How and when to backfill summary data
Using fill_summary_index.py to backfillUsing collect to produce custom summary indexes
Reducing summary index size
Using eval and rex to define grouping fieldsUsing a lookup with wildcardsUsing event types to group results
Calculating top for a large time frame
Summary index searches
Using CSV files to store transient data
Pre-populating a dropdownCreating a running calculation for a day
Summary
11. Configuring Splunk
Locating Splunk configuration files
The structure of a Splunk configuration file
The configuration merging logic
The merging orderThe merging order outside of searchThe merging order when searchingThe configuration merging logicConfiguration merging – example 1Configuration merging – example 2Configuration merging – example 3Configuration merging – example 4Using btool
An overview of Splunk .conf files
props.confCommon attributesSearch-time attributesIndex-time attributesParse-time attributesInput-time attributesStanza typesPriorities inside a typeAttributes with classinputs.confCommon input attributesFiles as inputsUsing patterns to select rolled logsUsing blacklist and whitelistSelecting files recursivelyFollowing symbolic linksSetting the value of the host from the sourceIgnoring old data at installationWhen to use crcSaltDestructively indexing filesNetwork inputsNative Windows inputsScripts as inputstransforms.confCreating indexed fieldsCreating a loglevel fieldCreating a session field from the sourceCreating a tag fieldCreating host categorization fieldsModifying metadata fieldsOverriding the hostOverriding the sourceOverriding sourcetypeRouting events to a different indexLookup definitionsWildcard lookupsCIDR wildcard lookupsUsing time in lookupsUsing REPORTCreating multivalue fieldsCreating dynamic fieldsChaining transformsDropping eventsfields.confoutputs.confindexes.confauthorize.confsavedsearches.conftimes.confcommands.confweb.conf
User interface resources
Views and navigationAppserver resourcesMetadata
Summary
12. Advanced Deployments
Planning your installation
Splunk instance types
Splunk forwardersSplunk indexerSplunk search
Common data sources
Monitoring logs on serversMonitoring logs on a shared driveConsuming logs in batchReceiving syslog eventsReceiving events directly on the Splunk indexerUsing a native syslog receiverReceiving syslog with a Splunk forwarderConsuming logs from a databaseUsing scripts to gather data
Sizing indexers
Planning redundancy
The replication factorConfiguring your replication factorsSyntaxIndexer load balancingUnderstanding typical outages
Working with multiple indexes
The directory structure of an indexWhen to create more indexesTesting dataDiffering longevityDiffering permissionsUsing more indexes to increase performanceThe lifecycle of a bucketSizing an indexUsing volumes to manage multiple indexes
Deploying the Splunk binary
Deploying from a tar fileDeploying using msiexecAdding a base configurationConfiguring Splunk to launch at boot
Using apps to organize configuration
Separate configurations by purpose
Configuration distribution
Using your own deployment systemUsing the Splunk deployment serverStep 1 – deciding where your deployment server will run fromStep 2 – defining your deploymentclient.conf configurationStep 3 – defining our machine types and locationsStep 4 – normalizing our configurations into apps appropriatelyStep 5 – mapping these apps to deployment clients in serverclass.confStep 6 – restarting the deployment serverStep 7 – installing deploymentclient.conf
Using LDAP for authentication
Using Single Sign On
Load balancers and Splunk
websplunktcpThe deployment server
Multiple search heads
Summary
13. Extending Splunk
Writing a scripted input to gather dataCapturing script output with no dateCapturing script output as a single eventMaking a long-running scripted input
Using Splunk from the command line
Querying Splunk via REST
Writing commands
When not to write a commandWhen to write a commandConfiguring commandsAdding fieldsManipulating dataTransforming dataGenerating data
Writing a scripted lookup to enrich data
Writing an event renderer
Using specific fieldsA table of fields based on field valuePretty print XML
Writing a scripted alert action to process results
Hunk
Summary
Index

Content preview from Implementing Splunk (Update)

Sparklines

Growing in popularity as a data visualization option, Sparklines are inline charts that represent the general shape of a variation (typically over time) in some measurement (such as miles per gallon or home value), in a simple and highly condensed way. Splunk provides the ability for you to add Sparklines to stats and chart searches, improving their usefulness and overall information density.

A simple Splunk search example like

sourcetype=csv "0001" "USD" | chart AVG(Jan) by PERIOD

creates the following results table:

As you can see, the preceding example of a search, generates a table that shows average amounts by the field PERIOD—just two ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781784391607

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Implementing Splunk (Update)

by VINCENT BUMGARNER, James D. Miller

Sparklines

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

More than 5,000 organizations count on O’Reilly

Julian F.

Addison B.

Amir M.

Mark W.

You might also like

Learning Splunk Web Framework

Splunk Operational Intelligence Cookbook

Implementing Splunk 7, Third Edition - Third Edition

Splunk Operational Intelligence Cookbook - Second Edition

Publisher Resources