Name: Implementing Splunk 7（Third Edition）
Author: James D. Miller
ISBN: 9781788830508

微信读书书城Implementing Splunk 7（Third Edition）

首页我的书架登录

翻译完成

切换

Implementing Splunk 7（Third Edition）

James D. Miller

扉页
Title Page
+书签
Copyright and Credits
Implementing Splunk 7 Third Edition
Packt Upsell
Why subscribe?
PacktPub.com
Contributors
About the author
About the reviewer
Packt is searching for authors like you
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the example code files
Conventions used
Get in touch
Reviews
The Splunk Interface
Logging in to Splunk
The home app
The top bar
The Search & Reporting app
Data generator
The Summary view
Search
Actions
Timeline
The field picker
Fields
Search results
Options
Events viewer
Using the time picker
Using the field picker
The settings section
Splunk Cloud
Try before you buy
A quick cloud tour
The top bar in Splunk Cloud
Splunk reference app – PAS
Universal forwarder
eventgen
Next steps
Summary
Understanding Search
Using search terms effectively
Boolean and grouping operators
Clicking to modify your search
Event segmentation
Field widgets
Time
Using fields to search
Using the field picker
Using wildcards efficiently
Supplementing wildcards in fields
All about time
How Splunk parses time
How Splunk stores time
How Splunk displays time
How time zones are determined and why it matters
Different ways to search against time
Presets
Relative
Real-time
Windowed real-time versus all-time real-time searches
Date range
Date and time range
Advanced
Specifying time in-line in your search
_indextime versus _time
Making searches faster
Sharing results with others
The URL
Save As Report
Save As Dashboard Panel
Save As Alert
Save As Event Type
Searching job settings
Saving searches for reuse
Creating alerts from searches
Enable Actions
Action Options
Sharing
Event annotations
An illustration
Summary
Tables, Charts, and Fields
About the pipe symbol
Using top to show common field values
Controlling the output of top
Using stats to aggregate values
Using chart to turn data
Using timechart to show values over time
The timechart options
Working with fields
A regular expression primer
Commands that create fields
eval
rex
Extracting loglevel
Using the extract fields interface
Using rex to prototype a field
Using the admin interface to build a field
Indexed fields versus extracted fields
Indexed field case 1 - rare instances of a common term
Indexed field case 2 - splitting words
Indexed field case 3 - application from source
Indexed field case 4 - slow requests
Indexed field case 5 - unneeded work
Chart enhancements in version 7.0
charting.lineWidth
charting.data.fieldHideList
charting.legend.mode
charting.fieldDashStyles
charting.axis Y.abbreviation
Summary
Data Models and Pivots
What is a data model?
What does a data model search?
Data model objects
Object constraining
Attributes
Acceleration in version 7.0
Creating a data model
Filling in the new data model dialog
Editing fields (attributes)
Lookup attributes
Children
What is a pivot?
The Pivot Editor
Working with pivot elements
Filtering pivots
Split (row or column)
Column values
Pivot table formatting
A quick example
Sparklines
Summary
Simple XML Dashboards
The purpose of dashboards
Using wizards to build dashboards
Adding another panel
A cool trick
Converting the panel to a report
More options
Back to the dashboard
Add input
Editing source
Edit UI
Editing XML directly
UI examples app
Building forms
Creating a form from a dashboard
Driving multiple panels from one form
Post-processing search results
Post-processing limitations
Features replaced
Autorun dashboard
Scheduling the generation of dashboards
Summary
Advanced Search Examples
Using subsearches to find loosely related events
Subsearch
Subsearch caveats
Nested subsearches
Using transaction
Using transaction to determine session length
Calculating the aggregate of transaction statistics
Combining subsearches with transaction
Determining concurrency
Using transaction with concurrency
Using concurrency to estimate server load
Calculating concurrency with a by clause
Calculating events per slice of time
Using timechart
Calculating average requests per minute
Calculating average events per minute, per hour
Rebuilding top
Acceleration
Big data – summary strategy
Report acceleration
Report acceleration availability
Version 7.0 advancements in metrics
Definition of a Splunk metric
Using Splunk metrics
Creating a metrics index
Creating a UDP or TCP data input
Summary
Extending Search
Using tags to simplify search
Using event types to categorize results
Using lookups to enrich data
Defining a lookup table file
Defining a lookup definition
Defining an automatic lookup
Troubleshooting lookups
Using macros to reuse logic
Creating a simple macro
Creating a macro with arguments
Creating workflow actions
Running a new search using values from an event
Linking to an external site
Building a workflow action to show field context
Building the context workflow action
Building the context macro
Using external commands
Extracting values from XML
xmlkv
XPath
Using Google to generate results
Summary
Working with Apps
Defining an app
Included apps
Installing apps
Installing apps from Splunkbase
Using Geo Location Lookup Script
Using Google Maps
Installing apps from a file
Building your first app
Editing navigation
Customizing the appearance of your app
Customizing the launcher icon
Using custom CSS
Using custom HTML
Custom HTML in a simple dashboard
Using server-side include in a complex dashboard
Object permissions
How permissions affect navigation
How permissions affect other objects
Correcting permission problems
App directory structure
Adding your app to Splunkbase
Preparing your app
Confirming sharing settings
Cleaning up our directories
Packaging your app
Uploading your app
Self-service app management
Summary
Building Advanced Dashboards
Reasons for working with advanced XML
Reasons for not working with advanced XML
Development process
Advanced XML structure
Converting simple XML to advanced XML
Module logic flow
Understanding layoutPanel
Panel placement
Reusing a query
Using intentions
stringreplace
addterm
Creating a custom drilldown
Building a drilldown to a custom query
Building a drilldown to another panel
Building a drilldown to multiple panels using HiddenPostProcess
Third-party add-ons
Google Maps
Sideview Utils
The Sideview search module
Linking views with Sideview
Sideview URLLoader
Sideview forms
Summary
Summary Indexes and CSV Files
Understanding summary indexes
Creating a summary index
When to use a summary index
When to not use a summary index
Populating summary indexes with saved searches
Using summary index events in a query
Using sistats, sitop, and sitimechart
How latency affects summary queries
How and when to backfill summary data
Using fill_summary_index.py to backfill
Using collect to produce custom summary indexes
Reducing summary index size
Using eval and rex to define grouping fields
Using a lookup with wildcards
Using event types to group results
Calculating top for a large time frame
Summary index searches
Using CSV files to store transient data
Pre-populating a dropdown
Creating a running calculation for a day
Summary
Configuring Splunk
Locating Splunk configuration files
The structure of a Splunk configuration file
The configuration merging logic
The merging order
The merging order outside of search
The merging order when searching
The configuration merging logic
Configuration merging – example 1
Configuration merging – example 2
Configuration merging – example 3
Configuration merging – example 4, search
Using btool
An overview of Splunk.conf files
props.conf
Common attributes
Search-time attributes
Index-time attributes
Parse-time attributes
Input-time attributes
Stanza types
Priorities inside a type
Attributes with class
inputs.conf
Common input attributes
Files as inputs
Using patterns to select rolled logs
Using blacklist and whitelist
Selecting files recursively
Following symbolic links
Setting the value of the host from the source
Ignoring old data at installation
When to use crcSalt
Destructively indexing files
Network inputs
Native Windows inputs
Scripts as inputs
transforms.conf
Creating indexed fields
Creating a loglevel field
Creating a session field from the source
Creating a tag field
Creating host categorization fields
Modifying metadata fields
Overriding the host
Overriding the source
Overriding sourcetype
Routing events to a different index
Lookup definitions
Wildcard lookups
CIDR wildcard lookups
Using time in lookups
Using REPORT
Creating multivalue fields
Creating dynamic fields
Chaining transforms
Dropping events
fields.conf
outputs.conf
indexes.conf
authorize.conf
savedsearches.conf
times.conf
commands.conf
web.conf
User interface resources
Views and navigation
Appserver resources
Metadata
Summary
Advanced Deployments
Planning your installation
Splunk instance types
Splunk forwarders
Splunk indexer
Splunk search
Common data sources
Monitoring logs on servers
Monitoring logs on a shared drive
Consuming logs in batch
Receiving syslog events
Receiving events directly on the Splunk indexer
Using a native syslog receiver
Receiving syslog with a Splunk forwarder
Consuming logs from a database
Using scripts to gather data
Sizing indexers
Planning redundancy
The replication factor
Configuring your replication factors
Syntax
Indexer load balancing
Understanding typical outages
Working with multiple indexes
Directory structure of an index
When to create more indexes
Testing data
Differing longevity
Differing permissions
Using more indexes to increase performance
The life cycle of a bucket
Sizing an index
Using volumes to manage multiple indexes
Deploying the Splunk binary
Deploying from a tar file
Deploying using msiexec
Adding a base configuration
Configuring Splunk to launch at boot
Using apps to organize configuration
Separate configurations by purpose
Configuration distribution
Using your own deployment system
Using the Splunk deployment server
Step 1 – deciding where your deployment server will run
Step 2 - defining your deploymentclient.conf configuration
Step 3 - defining our machine types and locations
Step 4 - normalizing our configurations into apps appropriately
Step 5 - mapping these apps to deployment clients in serverclass.conf
Step 6 - restarting the deployment server
Step 7 - installing deploymentclient.conf
Using LDAP for authentication
Using single sign-on
Load balancers and Splunk
web
splunktcp
deployment server
Multiple search heads
Summary
Extending Splunk
Writing a scripted input to gather data
Capturing script output with no date
Capturing script output as a single event
Making a long-running scripted input
Using Splunk from the command line
Querying Splunk via REST
Writing commands
When not to write a command
When to write a command
Configuring commands
Adding fields
Manipulating data
Transforming data
Generating data
Writing a scripted lookup to enrich data
Writing an event renderer
Using specific fields
A table of fields based on field value
Pretty printing XML
Writing a scripted alert action to process results
Hunk
Summary
Machine Learning Toolkit
What is machine learning?
Content recommendation engines
Natural language processing
Operational intelligence
Defining the toolkit
Time well spent
Obtaining the Kit
Prerequisites and requirements
Installation
The toolkit workbench
Assistants
Extended SPL (search processing language)
ML-SPL performance app
Building a model
Time series forecasting
Using Splunk
Launching the toolkit
Validation
Deployment
Saving a report
Exporting data
Summary

简介

版权

Implementing Splunk 7（Third Edition）