- 344 pages
- English
- ePUB (mobile friendly)
- Available on iOS & Android
eBook - ePub
Mastering Splunk
About this book
Splunk is the definitive technology solution used to manage the ever-growing volumes of machine-generated data. This technology is indispensable for industries involved in big data analysis, online services, education, finance, healthcare, retail, and telecommunications. So, having Splunk experience will be relevant for a long time to come!
This book will first take you through the evolution of Splunk and how it fits into an organization's architectural roadmap. Master advanced search topics and explore in-depth methods to leverage Splunk tables, charts, fields, and other cases. As we advance through the chapters, you will master the best practices of values and lookups, indexes, business effective dashboards, and discover the cornerstones of how to evolve your current Splunk application and its monitoring capabilities. Finally, we round things off with the discussion of transactions from an enterprise perspective.
You'll now be able to apply and integrate advanced techniques of Splunk to optimize your data and meet your strategic organizational demands.
Trusted by 375,005 students
Access to over 1 million titles for a fair monthly price.
Study more efficiently using our study tools.
Information
Mastering Splunk
Table of Contents
Mastering Splunk
Credits
About the Author
About the Reviewers
www.PacktPub.com
Support files, eBooks, discount offers, and more
Why subscribe?
Free access for Packt account holders
Instant updates on new Packt books
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Downloading the color images of this book
Errata
Piracy
Questions
1. The Application of Splunk
The definition of Splunk
Keeping it simple
Universal file handling
Confidentiality and security
The evolution of Splunk
The Splunk approach
The correlation of information
Conventional use cases
Investigational searching
Searching with pivot
The event timeline
Monitoring
Alerting
Reporting
Visibility in the operational world
Operational intelligence
A technology-agnostic approach
Decision support – analysis in real time
ETL analytics and preconceptions
The complements of Splunk
ODBC
Splunk – outside the box
Customer Relationship Management
Emerging technologies
Knowledge discovery and data mining
Disaster recovery
Virus protection
The enhancement of structured data
Project management
Firewall applications
Enterprise wireless solutions
Hadoop technologies
Media measurement
Social media
Geographical Information Systems
Mobile Device Management
Splunk in action
Summary
2. Advanced Searching
Searching in Splunk
The search dashboard
The new search dashboard
The Splunk search mechanism
The Splunk quick reference guide
Please assist me, let me go
Basic optimization
Fast, verbose, or smart?
The breakdown of commands
Understanding the difference between sparse and dense
Searching for operators, command formats, and tags
The process flow
Boolean expressions
You can quote me, I'm escaping
Tag me Splunk!
Assigning a search tag
Tagging field-value pairs
Wild tags!
Wildcards – generally speaking
Disabling and deleting tags
Transactional searching
Knowledge management
Some working examples
Subsearching
Output settings for subsearches
Search Job Inspector
Searching with parameters
The eval statement
A simple example
Splunk macros
Creating your own macro
Using your macros
The limitations of Splunk
Search results
Some basic Splunk search examples
Additional formatting
Summary
3. Mastering Tables, Charts, and Fields
Tables, charts, and fields
Splunking into tables
The table command
The Splunk rename command
Limits
Fields
An example of the fields command
Returning search results as charts
The chart command
The split-by fields
The where clause
More visualization examples
Some additional functions
Splunk bucketing
Reporting using the timechart command
Arguments required by the timechart command
Bucket time spans versus per_* functions
Drilldowns
The drilldown options
The basic drilldown functionality
Row drilldowns
Cell drilldowns
Chart drilldowns
Legends
Pivot
The pivot editor
Working with pivot elements
Filtering your pivots
Split
Column values
Pivot table formatting
A quick example
Sparklines
Summary
4. Lookups
Introduction
Configuring a simple field lookup
Defining lookups in Splunk Web
Automatic lookups
The Add new page
Configuration files
Implementing a lookup using configuration files – an example
Populating lookup tables
Handling duplicates with dedup
Dynamic lookups
Using Splunk Web
Using configuration files instead of Splunk Web
External lookups
Explanation
Time-based lookups
An easier way to create a time-based lookup
Seeing double?
Command roundup
The lookup command
The inputlookup and outputlookup commands
The inputcsv and outputcsv commands
Summary
5. Progressive Dashboards
Creating effective dashboards
Views
Panels
Modules
Form searching
An example of a search form
Dashboards versus forms
Going back to dashboards
The Panel Editor
The Visualization Editor
XML
Let's walk through the Dashboard Editor
Constructing a dashboard
Constructing the framework
Adding panels and panel content
Adding a panel
Specifying visualizations for the dashboard panel
The time range picker
Adding panels to your dashboard
Controlling access to your dashboard
Cloning and deleting
Keeping in context
Some further customization
Using panels
Adding and editing dashboard panels
Visualize this!
The visualization type
The visualization format
Dashboards and XML
Editing the dashboard XML code
Dashboards and the navigation bar
Color my world
More on searching
Inline searches
A saved search report
The inline pivot
The saved pivot report
Dynamic drilldowns
The essentials
Examples
No drilldowns
Real-world, real-time solutions
Summary
6. Indexes and Indexing
The...
Table of contents
- Mastering Splunk
Frequently asked questions
Yes, you can cancel anytime from the Subscription tab in your account settings on the Perlego website. Your subscription will stay active until the end of your current billing period. Learn how to cancel your subscription
No, books cannot be downloaded as external files, such as PDFs, for use outside of Perlego. However, you can download books within the Perlego app for offline reading on mobile or tablet. Learn how to download books offline
Perlego offers two plans: Essential and Complete
- Essential is ideal for learners and professionals who enjoy exploring a wide range of subjects. Access the Essential Library with 800,000+ trusted titles and best-sellers across business, personal growth, and the humanities. Includes unlimited reading time and Standard Read Aloud voice.
- Complete: Perfect for advanced learners and researchers needing full, unrestricted access. Unlock 1.4M+ books across hundreds of subjects, including academic and specialized titles. The Complete Plan also includes advanced features like Premium Read Aloud and Research Assistant.
We are an online textbook subscription service, where you can get access to an entire online library for less than the price of a single book per month. With over 1 million books across 990+ topics, we’ve got you covered! Learn about our mission
Look out for the read-aloud symbol on your next book to see if you can listen to it. The read-aloud tool reads text aloud for you, highlighting the text as it is being read. You can pause it, speed it up and slow it down. Learn more about Read Aloud
Yes! You can use the Perlego app on both iOS and Android devices to read anytime, anywhere — even offline. Perfect for commutes or when you’re on the go.
Please note we cannot support devices running on iOS 13 and Android 7 or earlier. Learn more about using the app
Please note we cannot support devices running on iOS 13 and Android 7 or earlier. Learn more about using the app
Yes, you can access Mastering Splunk by James Miller in PDF and/or ePUB format, as well as other popular books in Computer Science & Business Intelligence. We have over one million books available in our catalogue for you to explore.