Getting to Know Splunk: The Hands-On Administration Guide

Explore Splunk terminology with the Splexicon, focusing on the UI and searching basics, including events, searches, reports, dashboards, SPL, and data terms like sourcetype, index, field extractions, and lookups.

Define and manage events in Splunk, including how data is indexed into events, each with timestamp, host, source, and sourcetype, with support for multi-line events and timezone-aware searches.

Use search to navigate and analyze data in Splunk, generating alerts, tables, reports, and dashboards, while saving searches for reuse across Windows security event logs.

Learn how to save searches as reports in Splunk, schedule them to run or trigger alerts, and automate monitoring with visualizations like DNS messages.

Learn how an index serves as the container on disk where Splunk stores data, turning raw data into searchable events and enabling access control through segregating data into separate indexes.

Explore knowledge objects and fields in Splunk, including saved searches, reports, dashboards, and field extractions, and learn how selected and interesting fields enable deeper data analysis.

Wrap up terminology by applying learned concepts to data onboarding in your Splunk instance, building on what you covered in the previous section.

Learn to onboard data into a Splunk instance by starting with existing logs, researching data sources, and using test environments to validate indexing, retention, and access before production.

When there isn’t an app, work in Splunk with data that conforms to Splunk and existing apps. If data doesn’t conform, expect custom work for client environments and custom apps.

Explore how Splunk config files, like inputs.conf and indexes.conf, define monitoring and indexing, and learn to locate and troubleshoot settings using btool and grep.

Get acquainted with Splunk infrastructure terms: indexers, search heads, forwarders, universal forwarders, syslog receivers, deployment servers, license masters, and clustering, and learn how data is indexed and searched.

Understand how forwarders support the Splunk infrastructure by forwarding data to another Splunk instance. Focus on universal forwarder and heavy forwarder, their roles, and UF limitations.

Deploy syslog-ng as a dedicated syslog receiver, have Splunk read structured files by source and host, and avoid direct UDP/TCP inputs on indexers to prevent data loss.

Explore how the deployment server centrally manages deployment clients and deployment apps, groups them into server classes, and pushes configuration to universal forwarders and Splunk instances.

Learn how Splunk licensing is based on daily data ingestion and how perpetual licenses stack into a single license pool, and use the license master view to monitor usage.

Learn to normalize firewall data using Splunk's common information model to achieve consistent field names like DEST and SRC across products, enabling reliable searches.

Master the Splunk UI by learning searchable data, wildcard and phrase searches, and case sensitivity rules; explore time ranges, real-time searches, and filtering results. Refine results with the timeline.

Discover Splunk fields: selected, interesting (20% of events), and all fields, default index, source type, and host guiding searches. Use CIDR notation, wildcards, and case-sensitive field names to filter events.

Learn how smart mode, fast mode, and verbose mode shape field discovery, event visibility, and performance in Splunk searches. Choose the appropriate mode for statistics, dashboards, or reports.

Explore the Splunk search pipeline and learn to pipe search results through commands to build tables, charts, and dashboards using top values and visualizations.

Turn raw Splunk results into charts and tables for reporting, using a table to display action, user, source IP, and ssh authentication events from linux secure logs.

Explore advanced Splunk search concepts using SPL, focusing on the chart command to count by destination port, compare charts and tables, and visualize Linux netfilter port activity over 24 hours.

Explore how the eval command in Splunk enables data manipulation through numerical operations and string replacements, such as renaming United States to The United of America.

Explore how the rename command in Splunk improves readability by renaming fields, using quotes for spaces, and chaining renames, illustrated with ssh deauthentication and linux secure authentication logs.

Master relative time syntax in Splunk to define dynamic search ranges with offset and snap-to units. Use earliest and latest, last hour, and last 15 minutes for recurring, repeatable queries.

Learn to build Splunk dashboards that visualize logs with panels from reports and saved searches, add charts and maps, and troubleshoot via underlying searches.

Master hands-on Splunk administration by learning to work with Splunk, admin Splunk, and bring on data, while exploring additional Splunk classes that go into more detail on these topics.