All About Splunk Basics - 2024

Learn how to install Splunk by downloading the Splunk Enterprise package from the official site, with base packages for Windows and Mac.

Demonstrates installing Splunk on Windows from the official site, choosing the free 60-day package, customizing the install, accepting the license, creating an administrator account, and launching Splunk.

Compare Splunk enterprise licensing options, from standalone to distributed deployments, and learn how license masters and reports manage external data indexing and license limits across standard, free, and based licenses.

Learn how Splunk license is calculated from ingested event and metrics data, with volume tracking, replication in indexer clustering, and the role of designated Splunk index for fast scripted reporting.

Install a Splunk license by uploading the license file under settings licensing, then restart the Splunk service; the 60-day trial defines indexing volume and issues warnings if exceeded.

Tackle a deliberate task by researching a question with Google, then validate your answer at the end of the video and stay tuned for more information.

Explore how Splunk assigns access through roles, defining admins, power users, and other permissions, capabilities, and restrictions, with encrypted passwords and role-based access control.

Create a Splunk user in settings by naming the user, setting a strong password, optionally choosing a time zone, and assigning one or more roles.

Learn to reset a Splunk admin password by stopping the service, creating a seed file with admin credentials, then restarting Splunk and logging in to update the password.

Learn to add data to Splunk via the gui by uploading a file, configuring index and host, naming the source, then reviewing and submitting to start searching.

Configure a network input in Splunk Enterprise to receive data over UDP or the preferred DCP port, specify the port, host filters, and index, and review before submission.

Learn to navigate Splunk via the command line, start, stop, and restart the service, check status and port, and adjust server settings and instance name.

Learn to navigate splunk's search and reporting app, using the app bar, search bar, and time range to run searches, view history, and explore reports, alerts, and dashboards.

Learn how Splunk uses alerts and reports to monitor data, including scheduled alerts and real-time alerts, throttling, trigger conditions, and actions like emails or scripts.

Explore Splunk apps and add-ons to enable pre-built dashboards, reports, alerts, and workflows with point-and-click analytics, enriching data from any source for actionable insights.

Watch a quick demo on installing Splunk apps and logging into your Splunk instance. Install the 19 reporting app via the apps page, with Kennedy and side view prerequisites.

Explore how Splunk uses a location-based priority to merge configuration files across system local, app local, app default, and system default directories.

Explore how Splunk uses source and sourcetype as default fields to identify, format, and index data, enabling correct timestamps, categorization, and efficient searching.

Explore how Splunk indexes serve as data repositories, with index and metrics index types, and how hot, warm, cold, and frozen buckets govern aging and search.

Watch a hands-on Splunk demo on creating a new index, uploading data by selecting a source, choosing the test index, and reviewing the results.

Forward data from various sources to Splunk using universal or heavy forwarders, with receivers (indexers) on the other end. Universal forwarders forward only data; heavy forwarders index and search.