Name: Splunk：Enterprise Operational Intelligence Delivered
Author: Betsy Page Sigman Erickson Delgado Josh Diakun Paul R Johnson Derek Mock Ashish Kumar Tulsiram Yadav
ISBN: 9781787280915

微信读书书城Splunk：Enterprise Operational Intelligence Delivered

首页我的书架登录

翻译完成

切换

Splunk：Enterprise Operational Intelligence Delivered

Betsy Page Sigman Erickson Delgado Josh Diakun Paul R Johnson Derek Mock Ashish Kumar Tulsiram Yadav

扉页
版权信息
+书签
Credits
Preface
Part 1. Module 1
Chapter 1. Splunk in Action
Your Splunk.com account
Installing Splunk on Windows
Creating a Splunk app
Populating data with Eventgen
Controlling Splunk
Configuring Eventgen
Viewing the Destinations app
Creating your first dashboard
Summary
Chapter 2. Bringing in Data
Splunk and big data
Splunk data sources
Creating indexes
Buckets
Data inputs
Splunk events and fields
Extracting new fields
Summary
Chapter 3. Search Processing Language
Anatomy of a search
Time modifiers
Filtering search results
Search command - stats
Search command - top/rare
Search commands - chart and timechart
Search command - eval
Search command - rex
Summary
Chapter 4. Data Models and Pivot
Creating a data model
Data model acceleration
Rearranging your dashboard
Summary
Chapter 5. Data Optimization, Reports, Alerts, and Accelerating Searches
Data classification with event types
Data normalization with tags
Data enrichment with lookups
Creating reports
Creating alerts
Search and report acceleration
Scheduling best practices
Summary indexing
Summary
Chapter 6. Panes of Glass
Creating effective dashboards
Types of dashboard
Form inputs
Creating a time range input
Creating a radio input
Creating a dropdown input
Static Real-Time dashboard
Creating a map called a choropleth
Summary
Chapter 7. Splunk SDK for JavaScript and D3.js
Introduction to Splunk SDKs
Practical applications of Splunk s SDK
Creating the final dashboard jobs.js
Summary
Chapter 8. HTTP Event Collector
What is the HEC?
How does the HEC work?
How data flows to the HEC?
Summary
Chapter 9. Best Practices and Advanced Queries
Temporary indexes and oneshot indexing
Searching within an index
Search within a limited time frame
Quick searches via fast mode
Using event sampling
Splunk Universal Forwarders
Advanced queries
How to improve logs
Summary
Part 2. Module 2
Chapter 1. Play Time – Getting Data In
Introduction
Indexing files and directories
Getting data through network ports
Using scripted inputs
Using modular inputs
Using the Universal Forwarder to gather data
Loading the sample data for this book
Defining field extractions
Defining event types and tags
Chapter 2. Diving into Data – Search and Report
Introduction
Making raw event data readable
Finding the most accessed web pages
Finding the most used web browsers
Identifying the top-referring websites
Charting web page response codes
Displaying web page response time statistics
Listing the top viewed products
Charting the application s functional performance
Charting the application s memory usage
Counting the total number of database connections
Chapter 3. Dashboards and Visualizations – Making Data Shine
Introduction
Creating an Operational Intelligence dashboard
Using a pie chart to show the most accessed web pages
Displaying the unique number of visitors
Using a gauge to display the number of errors
Charting the number of method requests by type and host
Creating a timechart of method requests, views, and response times
Using a scatter chart to identify discrete requests by size and response time
Creating an area chart of the application s functional statistics
Using a bar chart to show the average amount spent by category
Creating a line chart of item views and purchases over time
Chapter 4. Building an Operational Intelligence Application
Introduction
Creating an Operational Intelligence application
Adding dashboards and reports
Organizing the dashboards more efficiently
Dynamically drilling down on activity reports
Creating a form for searching web activity
Linking web page activity reports to the form
Displaying a geographical map of visitors
Scheduling PDF delivery of a dashboard
Chapter 5. Extending Intelligence – Data Models and Pivoting
Introduction
Creating a data model for web access logs
Creating a data model for application logs
Accelerating data models
Pivoting total sales transactions
Pivoting purchases by geographic location
Pivoting slowest responding web pages
Pivot charting top error codes
Chapter 6. Diving Deeper – Advanced Searching
Introduction
Calculating the average session time on a website
Calculating the average execution time for multi-tier web requests
Displaying the maximum concurrent checkouts
Analyzing the relationship of web requests
Predicting website traffic volumes
Finding abnormally-sized web requests
Identifying potential session spoofing
Chapter 7. Enriching Data – Lookups and Workflows
Introduction
Looking up product code descriptions
Flagging suspect IP addresses
Creating a session state table
Adding hostnames to IP addresses
Searching ARIN for a given IP address
Triggering a Google search for a given error
Creating a ticket for application errors
Looking up inventory from an external database
Chapter 8. Being Proactive – Creating Alerts
Introduction
Alerting on abnormal web page response times
Alerting on errors during checkout in real time
Alerting on abnormal user behavior
Alerting on failure and triggering a scripted response
Alerting when predicted sales exceed inventory
Chapter 9. Speeding Up Intelligence – Data Summarization
Introduction
Calculating an hourly count of sessions versus completed transactions
Backfilling the number of purchases by city
Displaying the maximum number of concurrent sessions over time
Chapter 10. Above and Beyond – Customization, Web Framework, REST API, HTTP Event Collector, and SDKs
Introduction
Customizing the application navigation
Adding a force-directed graph of web hits
Adding a calendar heatmap of product purchases
Adding cell highlighting of average product price
Remotely querying Splunk s REST API for unique page views
Creating a Python application to return unique IP addresses
Creating a custom search command to format product names
Collecting data from remote scanning devices
Part 3. Module 3
Chapter 1. What s New in Splunk 6.3?
Splunk s architecture
Search parallelization
Data integrity control
Intelligent job scheduling
The app key-value store
Splunk Enterprise Security
Authentication using SAML
Summary
Chapter 2. Developing an Application on Splunk
Splunk apps and technology add-ons
Developing a Splunk app
Developing a Splunk add-on
Managing Splunk apps and add-ons
Splunk apps from the app store
Summary
Chapter 3. On-boarding Data in Splunk
Deep ping into various input methods and sources
Adding data to Splunk – new interfaces
Data processing
Managing event segmentation
Improving the data input process
Summary
Chapter 4. Data Analytics
Data and indexes
Search
Subsearch
Time
Fields
Results
Summary
Chapter 5. Advanced Data Analytics
Reports
Geography and location
Anomalies
Predicting and trending
Correlation
Machine learning
Summary
Chapter 6. Visualization
Prerequisites – configuration settings
Tables
Single value
Charts
Drilldown
Summary
Chapter 7. Advanced Visualization
Sunburst sequence
Geospatial visualization
Punchcard visualization
Calendar heatmap visualization
The Sankey diagram
Parallel coordinates
The force directed graph
Custom chart overlay
Custom decorations
Summary
Chapter 8. Dashboard Customization
Dashboard controls
Multi-search management
Tokens
Null search swapper
Switcher
Summary
Chapter 9. Advanced Dashboard Customization
Layout customization
Custom look and feel
The custom alert action
Summary
Chapter 10. Tweaking Splunk
Index replication
Indexer auto-discovery
Sourcetype manager
Field extractor
Search history
Event pattern detection
Data acceleration
Splunk buckets
Search optimizations
Splunk health
Summary
Chapter 11. Enterprise Integration with Splunk
The Splunk SDK
Installing the Splunk SDK
The Splunk SDK for Python
Splunk with R for analytics
Splunk with Tableau for visualization
Summary
Chapter 12. What Next? Splunk 6.4
Storage optimization
Machine learning
Management and admin
Indexer and search head enhancement
Visualizations
Multi-search management
Enhanced alert actions
Summary
Biblography
Index

简介

版权

Splunk：Enterprise Operational Intelligence Delivered