Splunk 7 Essentials - Third Edition

J-P Contreras, Erickson Delgado, Betsy Page Sigman

• Publisher: Packt Publishing
• Year: 2018
• eBook ISBN: 9781788830126
• Edition: 3
• Topic: Negocios y empresa
• Subtopic: Inteligencia empresarial

Transform machine data into powerful analytical intelligence using SplunkAbout This Book• Analyze and visualize machine data to step into the world of Splunk!• Leverage the exceptional analysis and visualization capabilities to make informed decisions for your business• This easy-to-follow, practical book can be used by anyone - even if you have never managed data beforeWho This Book Is ForThis book is for the beginners who want to get well versed in the services offered by Splunk 7. If you want to be a data/business analyst or want to be a system administrator, this book is what you want. No prior knowledge of Splunk is required.What You Will Learn• Install and configure Splunk for personal use• Store event data in Splunk indexes, classify events into sources, and add data fields• Learn essential Splunk Search Processing Language commands and best practices• Create powerful real-time or user-input dashboards• Be proactive by implementing alerts and scheduled reports• Tips from the Fez: best practices using Splunk features and add-ons• Understand security and deployment considerations for taking Splunk to an organizational levelIn DetailSplunk is a search, reporting, and analytics software platform for machine data, which has an ever-growing market adoption rate. More organizations than ever are adopting Splunk to make informed decisions in areas such as IT operations, information security, and the Internet of Things.The first two chapters of the book will get you started with a simple Splunk installation and set up of a sample machine data generator, called Eventgen.After this, you will learn to create various reports, dashboards, and alerts. You will also explore Splunk's Pivot functionality to model data for business users. You will then have the opportunity to test-drive Splunk's powerful HTTP Event Collector. After covering the core Splunk functionality, you'll be provided with some real-world best practices for using Splunk, and information on how to build upon what you've learned in this book.Throughout the book, there will be additional comments and best practice recommendations from a member of the SplunkTrust Community, called "Tips from the Fez". Style and approachThis fast-paced, example-rich guide will help you analyze and visualize machine data with Splunk through simple, practical instructions and recommendations.

Dynamic Dashboarding

Splunk makes it easy to visualize many different KPIs or reports in a single view using its dashboard functionality. For users to adopt the dashboard, it must be fast, easy to use, and carefully laid out to answer a variety of common queries. Splunk comes with a wide variety of chart types to visually represent your data, as you've seen in prior exercises in this book. Charts and reports can be organized into a dashboard layout with minimal effort. With practice, you can spin off a dashboard in a fraction of the time it would take if you were writing custom software to accomplish the same task.

In this chapter, we will cover the following topics:

• Identifying different types of dashboards
• Gathering business requirements for your dashboard
• Modifying dashboard panels
• Building multi-panel, dynamic dashboards showing relevant key performance indicators

Creating effective dashboards

Splunk is easy to use for developing a powerful analytical dashboard with multiple panels. A dashboard with too many panels, however, will require scrolling down the page and can cause the viewer to miss crucial information. An effective dashboard should generally meet the following conditions:

• Single screen view: The dashboard fits in a single window or page, with no scrolling
• Multiple data points: Charts and visualizations should display a number of data points
• Crucial information highlighted: The dashboard points out the most important information, using appropriate titles, labels, legends, markers, and conditional formatting as required
• Created with the user in mind: Data is presented in a way that is meaningful to the user
• Loads quickly: The dashboard returns results in 10 seconds or less
• Avoid redundancy: The display does not repeat information in multiple places

Types of dashboards

There are three kinds of dashboards typically created with Splunk:

• Dynamic form-based dashboards
• Real-time dashboards
• Dashboards as scheduled reports

Dynamic form-based dashboards allow Splunk users to modify the dashboard data without leaving the page. This is accomplished by adding data-driven input fields (such as time, radio button, textbox, checkbox, dropdown, and so on) to the dashboard. Updating these inputs changes the data based on the selections. Dynamic form-based dashboards have existed in traditional business intelligence tools for decades now, so users who frequently use them will be familiar with changing prompt values on the fly to update the dashboard data.

Real-time dashboards are often kept on a big panel screen for constant viewing, simply because they are so useful. You see these dashboards in data centers, network operations centers (NOCs), or security operations centers (SOCs) with constant format and data changing in real time. The dashboard will also have indicators and alerts for operators to easily identify and act on a problem. Dashboards like this typically show the current state of security, network, or business systems, using indicators for web performance and traffic, revenue flow, login failures, and other important measures.

Dashboards as scheduled reports may not be exposed for viewing; however, the dashboard view will generally be saved as a PDF file and sent to email recipients at scheduled times. This format is ideal when you need to send information updates to multiple recipients at regular intervals, and don't want to force them to log in to Splunk to capture the information themselves.

In this chapter, we will create the first two types of dashboards, and you will learn how to use the Splunk dashboard editor to develop advanced visualizations along the way.

Gathering business requirements

As a Splunk administrator, one of the most important responsibilities is to be responsible for the data. As a custodian of data, a Splunk admin has significant influence over how to interpret and present information to users. It is common for the administrator to create the first few dashboards. ...

Table of contents

• Title Page
• Copyright and Credits
• Packt Upsell
• Contributors
• Preface
• Splunk – Getting Started
• Bringing in Data
• Search Processing Language
• Reporting, Alerts, and Search Optimization
• Dynamic Dashboarding
• Data Models and Pivot
• HTTP Event Collector
• Best Practices and Advanced Queries
• Taking Splunk to the Organization