Implementing Splunk: Big Data Reporting and Development for Operational Intelligence

Implementing Splunk: Big Data Reporting and Development for Operational Intelligence book PDF free download

Splunk is a powerful tool for collecting, storing, alerting, reporting, and studying machine data. This machine data usually comes from server logs, but it could also be collected from other sources. Splunk is by far the most flexible and scalable solution available to tackle the huge problem of making machine data useful. The goal of this book is to serve as an organized and curated guide to Splunk 4.3. As the documentation and community resources available for Splunk are vast, finding the important pieces of knowledge can be daunting at times. My goal is to present what is needed for an effective implementation of Splunk in as concise and useful a manner as possible. What this book covers Chapter 1, The Splunk Interface, walks the reader through the user interface elements. Chapter 2, Understanding Search, covers the basics of the search language, paying particular attention to writing efficient queries. Chapter 3, Tables, Charts, and Fields, shows how to use fields for reporting, then covers the process of building our own fields. Chapter 4, Simple XML Dashboards, first uses the Splunk web interface to build our first dashboards. It then examines how to build forms and more efficient dashboards. Chapter 5, Advanced Search Examples, walks the reader through examples of using Splunk's powerful search language in interesting ways. Chapter 6, Extending Search, exposes a number of features in Splunk to help you categorize events and act upon search results in powerful ways. Preface Chapter 7, Working with Apps, covers the concepts of an app, helps you install a couple of popular apps, and then helps you build your own app. Chapter 8, Building Advanced Dashboards, explains the concepts of advanced XML dashboards, and covers practical ways to transition from simple XML to advanced XML dashboards. Chapter 9, Summary Indexes and CSV Files, introduces the concept of summary indexes, and how they can be used to increase performance. It also discusses how CSV files can be used in interesting ways. Chapter 10, Configuring Splunk, explains the structure and meaning of common configurations in Splunk. It also explains the process of merging configurations in great detail. Chapter 11, Advanced Deployments, covers common questions about multimachine Splunk deployments, including data inputs, syslog, configuration management, and scaling up. Chapter 12, Extending Splunk, demonstrates ways in which code can be used to extend Splunk for data input, external querying, rendering, custom commands, and custom actions. What you need for this book To work through the examples in this book, you will need an installation of Splunk, preferably a non-production instance. If you are already working with Splunk, then the concepts introduced by the examples should be applicable to your own data. Splunk can be downloaded for free from http://www.splunk.com/download, for most popular platforms. The sample code was developed on a Unix system, so you will probably have better luck using an installation of Splunk that is running on a Unix operating system. Knowledge of Python is necessary to follow some of the examples in the later chapters. [2] This book should be useful for new users, seasoned users, dashboard designers, and system administrators alike. This book does not try to act as a replacement for the official Splunk documentation, but should serve as a shortcut for many concepts. For some sections, a good understanding of regular expressions would be helpful. For some sections, the ability to read Python would be helpful. Conventions In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles, and an explanation of their meaning. Code words in text are shown as follows: "If a field value looks like key=value in the text of an event, you will want to use one of the field widgets." A block of code is set as follows: index=myapplicationindex ( sourcetype=security AND ( (bob NOT error) OR (mary AND warn) ) ) When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold: timechart span=1h sum(count) as "Error count" by network Any command-line input or output is written as follows: ERROR LogoutClass error, ERROR, Error! [user=mary, ip=3.2.4.5] WARN AuthClass error, ERROR, Error! [user=mary, ip=1.2.3.3] [3] Preface Who this book is for www.allitebooks.com Preface New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "Quickly create a simple dashboard using the wizard interface that we used before, by selecting Create | Dashboard Panel." Warnings or important notes appear in a box like this. Tips and tricks appear like this. Reader feedback Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or may have disliked. Reader feedback is important for us to develop titles that you really get the most out of. To send us general feedback, simply send an e-mail to [email protected], and mention the book title via the subject of your message. If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide on www.packtpub.com/authors. Customer support Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.