Improving Your Splunk Skills

Leverage the operational intelligence capabilities of Splunk to unlock new hidden business insights

James Miller, Paul R. Johnson, Josh Diakun, Derek Mock

• Publisher: Packt Publishing
• Year: 2019
• Print ISBN:
  9781838981747
• Edition: 1
• eBook ISBN:
  9781838981020
• Topic: Computer Science
• Subtopic: Business Intelligence
• Index: Computer Science

Transform machine-generated data into valuable business insights using the powers of Splunk

Key Features

• Explore the all-new machine learning toolkit in Splunk 7.x
• Tackle any problems related to searching and analyzing your data with Splunk
• Get the latest information and business insights on Splunk 7.x

Book Description

Splunk makes it easy for you to take control of your data and drive your business with the cutting edge of operational intelligence and business analytics. Through this Learning Path, you'll implement new services and utilize them to quickly and efficiently process machine-generated big data.

You'll begin with an introduction to the new features, improvements, and offerings of Splunk 7. You'll learn to efficiently use wildcards and modify your search to make it faster. You'll learn how to enhance your applications by using XML dashboards and configuring and extending Splunk. You'll also find step-by-step demonstrations that'll walk you through building an operational intelligence application. As you progress, you'll explore data models and pivots to extend your intelligence capabilities.

By the end of this Learning Path, you'll have the skills and confidence to implement various Splunk services in your projects.

This Learning Path includes content from the following Packt products:

• Implementing Splunk 7 - Third Edition by James Miller
• Splunk Operational Intelligence Cookbook - Third Edition by Paul R Johnson, Josh Diakun, et al

What you will learn

• Master the new offerings in Splunk: Splunk Cloud and the Machine Learning Toolkit
• Create efficient and effective searches
• Master the use of Splunk tables, charts, and graph enhancements
• Use Splunk data models and pivots with faster data model acceleration
• Master all aspects of Splunk XML dashboards with hands-on applications
• Apply ML algorithms for forecasting and anomaly detection
• Integrate advanced JavaScript charts and leverage Splunk's API

Who this book is for

This Learning Path is for data analysts, business analysts, and IT administrators who want to leverage the Splunk enterprise platform as a valuable operational intelligence tool. Existing Splunk users who want to upgrade and get up and running with Splunk 7.x will also find this book useful. Some knowledge of Splunk services will help you get the most out of this Learning Path.

Diving Deeper – Advanced Searching, Machine Learning and Predictive Analytics

In this chapter, we will cover some of the more advanced search commands available in Splunk. We will cover the following recipes:

• Calculating the average session time on a website
• Calculating the average execution time for multi-tier web requests
• Displaying the maximum concurrent checkouts
• Analyzing the relationship of web requests
• Predicting website traffic volumes
• Finding abnormally sized web requests
• Identifying potential session spoofing
• Detecting outliers in server response times
• Forecasting weekly sales

Introduction

In the previous chapter, we learned about Splunk's new data model and Pivot functionality, and how they can be used to further intelligence reporting. In this chapter, we will return to Splunk's SPL, diving deeper and making use of some very powerful search commands to facilitate a better understanding and correlation of event data. You will learn how to create transactions, build subsearches and understand concurrency, leverage field associations, leverage the Splunk Machine Learning Toolkit, and much more.

Looking at event counts, applying statistics to calculate averages, or finding the top values over time only provide a view of the data limited to one angle. Splunk's SPL contains some very powerful search commands that provide the ability to correlate data from different sources and understand or build relationships between the events. Through the building of relationships between data sets and looking at different angles of the data, you can better understand the impact one event might have over another. Additionally, correlating related values can provide a much more contextual value to teams when reviewing or analyzing a series of data.

Identifying and grouping transactions

Single events can be easily interpreted and understood, but these single events are often part of a series of events, where the event might be influenced by preceding events or might affect other events to come. By leveraging Splunk's ability to group associated events into transactions based on field values, the data can be presented in a way that allows the reader to understand the full context of an event and what led up to this point. Building transactions can also be useful when needing to understand the time duration between the start and finish of specific events, or calculating values within a given transaction and comparing them to the values of others.

Converging data sources

Context is everything when it comes to building successful Operational Intelligence, and when you are stuck analyzing events from a single data source at a time, you might be missing out on rich contextual information that other data sources can provide. With Splunk's ability to converge multiple data sources using the join or append search commands and search across them as if they are a single source, you can easily enrich the single data source and understand events from other sources that occurred at, or around, the same time.

For example, you might notice there are more timeouts than usual on your website, but when you analyze the website access log, everything appears normal. However, when you look at the application log, you notice that there are numerous failed connections to the database. Even so, by looking at each data source individually, it is hard to understand where the actual issue lies. Using Splunk's SPL to converge the data sources will allow for both the web access and application logs to be brought together into one view, to better understand and troubleshoot the sequence of events that might lead to website timeouts.

Identifying relationships between fields

In the Operational Intelligence world, the ability to identify relationships between fields can be a powerful asset. Understanding the values of a field, and how these values might have a relationship with other field values within the same event, allows you to calculate the degree of certainty the values will provide in future events. By continually sampling events as they come in over time, you can become more accurate at predicting values in events as they occur. When used correctly, this can provide tremendous value in being able to actively predict the values of fields within events, leading to more proactive incident or issue identification.

Predicting future values

Understanding system, application, and user behavior will always prove to be extremely valuable when building out any intelligence program; however, the ability to predict future values can provide values more immense than simple modeling actions. The addition of predictive capabilities to an Operational Intelligence program enables the ability to become more proactive with issue identification, forecast system behavior, and plan and optimize thresholds more effectively.

Imagine being able to predict the number of sessions on your website, number of purchases of a specific product, response times during peak periods, or general tuning alerting thresholds to values that are substantiated rather than taking an educated guess. All of this is possible with predictive analytics; by looking back over past events, you can better understand what the future will hold.

Discovering anomalous values

With the volume of data ever increasing, looking...

Table of contents

• Title Page
• Copyright and Credits
• About Packt
• Contributors
• Preface
• The Splunk Interface
• Understanding Search
• Tables, Charts, and Fields
• Data Models and Pivots
• Simple XML Dashboards
• Extending Search
• Working with Apps
• Building Advanced Dashboards
• Summary Indexes and CSV Files
• Configuring Splunk
• Play Time – Getting Data In
• Building an Operational Intelligence Application
• Diving Deeper – Advanced Searching, Machine Learning and Predictive Analytics
• Speeding Up Intelligence – Data Summarization
• Above and Beyond – Customization, Web Framework, HTTP Event Collector, REST API, and SDKs
• Other Books You May Enjoy