Splunk 7 Essentials

This lesson covers more about using search and other commands to analyze your data.

Search processing language (SPL), a special-purpose processing language, was developed to enable fast searching on machine-generated data indexed by Splunk. The language was originally set up to be based on the Unix pipeline and Standard Query Language (SQL). SPL (as opposed to SQL) is a library of all search processing commands and their functions, arguments, and clauses. With a search command, you can group different events, filter data based on a constraint, extract fields using regular expressions, perform statistical calculations, and other tasks. Let's dissect a search query so that you can understand exactly how it works.

Every time you execute a search, always be aware that you are running a query against a set of data that is bound by date and time. Let’s look at it in detail.

A common use of the stats command is to count events. Let’s see how it works.

Let us summarize what we learned from this lesson.

This lesson shows how to classify your data using Event Types, enrich it using Lookups, and normalize it using Tags.

When working with Splunk daily, you will find many of the tasks and searches you run are repeated on a periodic basis. As shown earlier, storing field extraction logic in a single place allows it to be reused in the future. Another way to make things easier and also shorten searches is to create Event Types. Event Types are not the same as events; an event is just a single instance of data. An Event Type is a grouping or classification of events meeting the same search criteria.

Tags in Splunk are useful for grouping events with related field values. Unlike Event Types, which are based on specified search commands, Tags are created and mapped to specific field-value combinations. Multiple Tags can be assigned to the same field-value combination.

Occasionally you will require pieces of data to be rendered in a more readable manner. A common example to go through using our Eventgen data is with HTTP status. Computer engineers are often familiar with HTTP status codes as three-digit numbers. Business analysts or more casual users may not know the meaning of these codes and require a textbased description to comprehend the search results. In Splunk, you can enrich event data using Lookups, which can pair numbers or acronyms with more understandable text descriptions found in a separate file.

In this chapter, you have learned three very important things: classifying raw events using Event Types, classifying data using Tags, and enriching data using Lookups. These, in addition to good SPL, constitute essential elements you need to use Splunk in an efficient manner. Splunk reports are saved searches which can be shared to others or used as a dashboard panel. Reports can be scheduled periodically and perform an action upon completion, such as sending an email with the report results.

Alerts are crucial in IT and security operations. They provide proactive awareness of the state of the systems to those persons who monitor and control them. Alerts enable you to act fast when an issue has been detected, as opposed to waiting for a user to run a report and find the issue, which may or may not happen. In today's world, every minute someone has breached your network is costly and potentially devastating. However, alerts are only good if they are controlled and if they provide enough actionable information. They should not be created on low-priority items or triggered too often to the point they lose relevance.

In this section we will learn to accelerate a data model to speed up retrieval of data.

No matter how advanced and well-scaled your Splunk infrastructure is, if all scheduled reports and alerts are running at the same time, the system will start experiencing performance issues. Typically, you will receive a Splunk message saying that you have reached the limit of concurrent or historical searches. There are only a certain number of searches that can be run on fixed CPU capacity for each Splunk server or collection of servers. A common problem a Splunk administrator will inevitably face is how to limit the number of searches running at the same time. One way to fix this is to throw more servers into you Splunk environment, but that is not a cost-efficient way.

Let us summarize what we learned from this lesson.

In this lesson we will create a fully functional form-based dashboard that will allow you to change the inputs and affect the dashboard data by using tokens and assigning them to search panels.

Splunk is easy to use for developing a powerful analytical dashboard with multiple panels. A dashboard with too many panels, however, will require scrolling down the page and can cause the viewer to miss crucial information.

With the dashboard layout complete, it is time to make it dynamic and interactive. Before jumping into the exercises, however, we'll review the key concepts related to form inputs first.

In this section, we will create a real-time dashboard that will display crucial information based on the data we have.

A choropleth map, whose name comes from two Greek words meaning area/region and multitude, is a two-dimensional map where areas are designated by color shades or patterns to indicate the measured strength of a statistical indicator, such as sales per area or crime rates. We will not cover in detail the mathematical details of how a choropleth is created, but we are fortunate that we can use Splunk to provide this effective visualization tool for us. We will create two choropleth maps to denote bookings by region and traffic by region.

Let us summarize what we learned from this lesson.

In this lesson we will use a very intuitive Pivot editor to create three different visualizations: area chart, pie chart, and single value with a trend sparkline.

A data model is a hierarchical mapping of data based on search results. The output of the data model's underlying search queries can be visualized as a set of rows and columns in a spreadsheet, using the Pivot tool.

When you enable acceleration for a data model, Splunk internally pre-summarizes the data defined by the data model for a given time range. This gives a tremendous boost to the search speed for your data model when searches are executed within the given time range.

Let us summarize what we learned from this lesson.

This lesson discusses the HTTP event collector (HEC) and how it can be used to send data directly from an application to Splunk.

The Splunk HEC is a useful and commonly used part of Splunk. The HEC does the important function of collecting and sending HTTP and HTTPS events to other systems. One common example where the HEC adds tremendous value is by capturing/sending events from/to web and mobile-based client devices. Once Splunk captures the data via the HEC from the application, it can be used for a variety of analyses related to application use and errors.

Let us summarize what we learned from this lesson.

This lesson introduces a few extra skills that will help make you a powerful Splunker.

In this section, we will discuss searching within an index, search modes (fast, smart, verbose), and event sampling

There are various kinds of advanced searches you may need as you plan out how to create searches and dashboards for your data. Consider the ones that we present; they will help you design queries that are more efficient and cost effective. We will demo sub-searches, appending searches, joins, if statements, and case matching. 

Let us summarize what we learned from this lesson.

This lesson concludes our course with thoughts, concepts, and ideas to take this new knowledge ahead and apply to an organization.

Most organizations will start using Splunk in one of three areas: IT operations management, information security, or development operations (DevOps).

As an organization deploys Splunk, it will have specific requirements related to the architecture, its resiliency, and disaster recovery.

When considering software for organizational purposes, it is important in today's world to consider online presence and community. Is the community very closed with little community fanfare or is it more open with significant online resources, documentation, and other community-based assets. In addition to the great product, Splunk is also successful because it has a strong online community which is built, in large part, to help customers successfully implement the product for their needs.

Let us summarize what we learned from this lesson.