Professional Documents
Culture Documents
Splunk Fundamentals
Splunk Fundamentals
Splunk Fundamentals
buttercup games - international with tons of machine data from web servers, sale
servers, badge readers, security appliances, voicemail
-splunk takes a bunch of data, adds structure to unstructured data
-not jsut app issues: security, user behavior, sales, hardware monitor
-translates a huge amount of info
-machine data makes up for than 90% of data accumulated by organizations
index data, search & investigate, add knowledge, monitor and alert, report &
analyze
-indexer: factory takes raw materials (data), determines how to process it, labels
with sourcetype
events are stored in the index
-searcH: values across multiple data sources, run statistics using splunk search
-knowledge objects: classify, enrich, normalize
-monitor: can identify issues before impact, create alerts for specific conditions,
automatically respond
-reports: dashboards, visualizations
indexers: store results in indexes as events, organizes for search, only needs to
open efficiently
search head: use splunk search language, handle search requests for indexes,
consolidate/enrich
-dashboards, reports, visualizations
forwarder: splunk enterprise instances, consume data, forward to indexes
-minimal resources, usually resides on machine (such as web server)
linux: get software from splunk.com > free splunk > free download > linux >
download deb/tgz/rpm
-can also use wget
-should not be done as root user
-sudo tar xvzf splunk-6etcetcetc -C /opt (untars it in /opt directory)
-cd /opt/splunk/bin
./splunk start | stop | restart | help
./splunk start --accept-license
windows: gui or cmd > double click, accept license > customize|install
-change install location > local system|domain account
OSX: dev/testing usually > free splunk > Mac OS (tgz/dmg disc image)
-cd /Applications/Splunk/bin . sudo ./splunk start
splunk cloud: created by splunk, removes infrastructure requirements, 5GB per day
15 days
-30 day free trial, view my instance, accept license
two apps: Home app (to launch/manage splunk apps), admins can add apps
Search & Reporting: done by power user, splunkbase contains hundreds more
admin vet0pr00f
admin: admin users get data in there, users typically dont but its good to know how
-add data: upload (gets indexed once), monitor (monitor files/directories, scripts,
windows specific data (event logs), forward (receive data from external forwarders,
installed on remote machines, forwarded to indexers)
-used as main source of data input
forwarder: not in scope, but minimal resources installed on many host machines
quiz chap 4:
splunk uses sourcetypes to categorize data
uploaded files get indexed ONCE
in production, FORWARDER data is the source of data input
limit by time is best practice, search becomes a job, contains Save as, search
results, timeline
-save search to Knowledge Objects
pause stop share export print, jobs remain active for 10 minutes
-shared search jobs last 7 days, readable to all (who are shared with)
-export: in Raw, csv, xml, json
timeline: click+drag = select a time range, zoom+in-out uses original search job
for zoom in
-zoom out requires job to be re-run
chap 5 quiz:
sourcetype=linux_secure
host!=mail*
chap 6 quiz:
1301 events
if you add a search from search history, the default time of 24 hours is specified,
not time of original search
-nor is search executed
so basically the difference is, the results are not sensitive to case, but the
search for those results is
space in the +/- makes it affect ALL fields, but if you remove the space, only
affects that field
sort -sale_price +Vendor
chap 8 quiz:
excluding fields does NOT benefit performance, because they must be searched then
discluded
for table User IP, quotation marks is missing -> must be table "User IP"
| fields - status is the way to remove the status field, not using NOT status..
this is a field type not a search term
chap 9 quiz:
sourcetype=vendor* | stats count _AS_ "Units Sold" (this renames count of vendors
to "Units Sold"
most common values = top
avg = average
Addtotals = NOT a stats function
top/rare have TEN results by default
chap 10: reports & dashboards - can save/share searches w/ reports: save as: Report
w/ title
-yes/no on time range picker
-report shows a 'fresh' set of results, can change range if yes
-reports tab of application menu > open in search
-edit menu: description/permission/schedule/clone/embed/delete
-poweruser: can allow read/write
-run as: owner or user (user = only data user has access to)
-accelerated: smaller searches
-save as: visualization, text, both
create a time range picker, but then tie each panel to the time range picker, it
will update all panels tied to
-dashboards menu is a location of where you can access
chap 10 quiz:
chap 11: pivots and datasets > pivot allows users to design reports w/out searches
-data models: KOs that drive pivots, created by admins/power users
-basically an easy way to modify reports
-settings > data models > pivot
-count, tools to filter, visualizations, all time
-can create filters based on field, can use IS/ISNOT/CONTAINS
-can use sidebar to visualize, can save to add to report/dashboard
-no data model? instant pivot
instant pivot: all fields, selected fields, or fields with a selected coverage%
chap 11 quiz:
pivots can be saved as reports/dashboards
data models are KOs that provide data structure for a pivot
data models are made up of datasets
instant pivot is displayed when using a NON-TRANSFORMING search (basically helps
you get there)
sourcetype=access_combined status=xxx
csv with code,description
100,Continue
200,OK
300,etc
create a lookup table > settings > lookups > add new > choose a dest app (only
avail to that app) > find file > give name for file on server
-can move to another app, delete
-verify it is working using | inputlookup filename.csv
now define lookup > settings > lookups > add new > dest app > name > file uploaded
to server
-time-based: if this field involves time, case sensitivity
-batch index query imrpoves perf
automatic lookup: settings > lookups > automatic lookups > dest app > choose name >
choose lookup > sourcetype
-code = status
-lookup output: code=Code, description=Description
-now searches can automatically use those values rather than having to use OUTPUT
create a search > save as report > time range picker > schedule > enable >
frequency
-time range is relative to the schedule
-schedule priority: default > higher > highest
-window: report will be delayed as long as it falls within window, only if you're
okay w/ delay
-send email/run script/write to csv lookup
search and reporting options: owner/app/all apps, can also set read/write for the
report
-run as: owner or user, access of user
-embedded must be SCHEDULED before it will work
log event: sent to indexer, run a script: shell or bash, send email: very powerful,
webhook (create ticket, POST API)
chap13 quiz: