Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Technical WorkshopsGetting Started User TrainingNameTitleDate
Agenda      Getting Started with Splunk      Deployment and IntegrationCopyright © 2011, Splunk Inc.     2      Listen to ...
Getting Started With Splunk
Install Splunk www.splunk.com/download   • 32    or 64 bit?   • Indexer or         Universal Forwarder?   Start Splunk    ...
Splunk Licenses Free Download Limits Indexing to 500MB/day           Enterprise Trial License expires after 60 days       ...
Splunk Web BasicsBrowser Support          Firefox 2, 3.0.x, 3.5          Internet Explorer 6, 7, 8          Safari 3      ...
Splunk Web Basics cont.Splunk Apps          Splunk Home -> Find more apps          Apps create different contexts for your...
SearchingSearch > *Select Time Range• Historical, custom, or real-timeUsing the timeline• Click events and zoom in and out...
Searching cont.Search for any keywordSearch > errorUse Boolean expressionsSearch > error OR failed NOT applicationSpaces a...
Search AssistantContextual Help         advanced typeaheadHistory         search         commandsSearch Reference         ...
Job ManagementSearches can be managed as  asynchronous processesJobs can be   •   Scheduled   •   Moved to background task...
Tagging and Event Typing Eventtypes for more human-readable reports      categorize and make sense of mountains of data   ...
Search CommandsSearch > error | head 1Search results are “piped” to the commandCommands for:• Manipulating fields• Formatt...
Over 100 Commands!     http://www.splunk.com/base/Documentation/latest/SearchReference/SearchCheatsheetCopyright © 2011, S...
FieldsDefault fields• host, source, sourctype, linecount, etc.• View on left panel in search results or all in field picke...
Extract Fields Interactive Field Extractor                                                props.conf          generate PCR...
Saved Searches and Alerting                                Find Something Interesting?                                    ...
Alerting Cont.Searches run on a schedule and fire an alert• Example: Run a search for “Failed password” every 15 min  over...
Alerting Actions•    Send email•    RSS•    Execute a script•    Track in Alert Manager    Copyright © 2011, Splunk Inc.  ...
ReportingBuild reports from the results of any searchSelect type of report (Values over time, Top Values, Rare Values)and ...
Reporting Examples• Use wizard or reporting commands (timechart, top, etc)• Build real-time reports with real-time searche...
DashboardsCreate dashboards from search resultsCopyright © 2011, Splunk Inc.           22   Listen to your data.
Dashboard ExamplesCopyright © 2011, Splunk Inc.           23           Listen to your data.
Splunk Manager                        Now Manage All of that Cool Stuff You Just Created (and more!)•   Permissions•   Sav...
Deployment and Integration
Splunk Has Four Primary Functions                                Searching and Reporting (Search Head)                    ...
Getting Data Into Splunk                               Agent and Agent-less Approach for Flexibility                      ...
Understanding the Universal Forwarder      Forward data without negatively impacting production performance.              ...
Horizontal Scaling         Load balanced search and indexing for massive, linear scale out.   Distributed Search         F...
Multiple DatacentersIndex and store locally. Distribute searches to datacenters, networks & geographies.                  ...
Data Redundancy      Clone data to multiple index servers to eliminate a single point of failure.       Active            ...
High Availability           Combine auto load balancing and cloning for HA at every Splunk tier.                          ...
Send Data to Other Systems                Route raw data in real time or send alerts based on searches.                   ...
Integrate External Data                           Extend search with lookups to external data sources.                    ...
Integrate Users and Roles                     Integrate authentication with LDAP and Active Directory.           LDAP, AD ...
Centralized Licensing Management                       Groups, Stacks, and Pools for Enterprise Deployments               ...
Deployment Monitoring                          Keep Tabs On Your Splunk Enterprise Deployment                      License...
Support and Community
Support Through the Splunk Community      SplunkbaseCopyright © 2011, Splunk Inc.   39   Listen to your data.
Where to Go for Help   Documentation   – http://www.splunk.com/base/Documentation   Technical Support   – http://www.splun...
Technical WorkshopsGetting Started User TrainingThank youDate
Upcoming SlideShare
Loading in …5
×
Upcoming SlideShare
Exploring Splunk
Next
Download to read offline and view in fullscreen.

15

Share

Download to read offline

SplunkLive 2011 Beginners Session

Download to read offline

Related Books

Free with a 30 day trial from Scribd

See all

SplunkLive 2011 Beginners Session

  1. Technical WorkshopsGetting Started User TrainingNameTitleDate
  2. Agenda Getting Started with Splunk Deployment and IntegrationCopyright © 2011, Splunk Inc. 2 Listen to your data.
  3. Getting Started With Splunk
  4. Install Splunk www.splunk.com/download • 32 or 64 bit? • Indexer or Universal Forwarder? Start Splunk WIN: Program FilesSplunkbinsplunk.exe start Other: /opt/splunk/bin/splunk start Splunk Home WIN: Program FilesSplunk Other: /opt/splunk (Applications/splunk)Copyright © 2011, Splunk Inc. Listen to your data.
  5. Splunk Licenses Free Download Limits Indexing to 500MB/day Enterprise Trial License expires after 60 days Reverts to Free License Features Disabled in Free License Multiple user accounts and role-based access controls Distributed search Forwarding to non-Splunk Instances Deployment management Scheduled saved searches and alerting Summary indexing Other License Types Enterprise, Forwarder, TrialCopyright © 2011, Splunk Inc. Listen to your data.
  6. Splunk Web BasicsBrowser Support Firefox 2, 3.0.x, 3.5 Internet Explorer 6, 7, 8 Safari 3 Chrome 9Default on install is http://localhost:8000Index some data Add data Getting Started App Install an App (Splunk for Windows, *NIX)Copyright © 2011, Splunk Inc. 6 Listen to your data.
  7. Splunk Web Basics cont.Splunk Apps Splunk Home -> Find more apps Apps create different contexts for your data out of sets of views, dashboards, and configurations You can create your own!Search is an App Summary will show everything you have indexed Updated in real-time Click on any source, sourcetype, or host to look at eventsCopyright © 2011, Splunk Inc. 7 Listen to your data.
  8. SearchingSearch > *Select Time Range• Historical, custom, or real-timeUsing the timeline• Click events and zoom in and out• Click and drag over events for a specific rangeCopyright © 2011, Splunk Inc. 8 Listen to your data.
  9. Searching cont.Search for any keywordSearch > errorUse Boolean expressionsSearch > error OR failed NOT applicationSpaces are implied AND, Operators need to be in capsSearch > Audit Failure = Audit AND FailureUse quotes to search for a specific stringSearch > “Audit Failure”Use wildcardsSearch > 46* OR 49*Copyright © 2011, Splunk Inc. 9 Listen to your data.
  10. Search AssistantContextual Help advanced typeaheadHistory search commandsSearch Reference short/long description examplesCopyright © 2011, Splunk Inc. 10 Listen to your data.
  11. Job ManagementSearches can be managed as asynchronous processesJobs can be • Scheduled • Moved to background tasks • Paused, stopped, resumed, finalized • Managed • Archived Copyright © 2011, Splunk Inc. Listen to your data.
  12. Tagging and Event Typing Eventtypes for more human-readable reports categorize and make sense of mountains of data punctuation helps find events with similar patterns Search > eventtype=failed_login instead of Search > “failed login” OR “FAILED LOGIN” OR “Authentication failure” OR “Failed to authenticate user” Tags are labels apply adhoc knowledge create logical divisions or groups tag hosts, sources, fields, even eventtypes Search > tag=web_servers instead of Search > host=“apache1.splunk.com” OR host=“apache2.splunk.com” OR host=“apache3.splunk.com”Copyright © 2011, Splunk Inc. 12 Listen to your data.
  13. Search CommandsSearch > error | head 1Search results are “piped” to the commandCommands for:• Manipulating fields• Formatting• Handling results• ReportingCopyright © 2011, Splunk Inc. 13 Listen to your data.
  14. Over 100 Commands! http://www.splunk.com/base/Documentation/latest/SearchReference/SearchCheatsheetCopyright © 2011, Splunk Inc. 14 Listen to your data.
  15. FieldsDefault fields• host, source, sourctype, linecount, etc.• View on left panel in search results or all in field pickerWhere do fields come from?• Pre-defined by sourcetypes• Automatically extracted key-value pairs• User definedCopyright © 2011, Splunk Inc. 15 Listen to your data.
  16. Extract Fields Interactive Field Extractor props.conf generate PCRE editable regex [mysourcetype] preview/save REPORT-myclass = myFields transforms.conf Configuration File manual field extraction [myFields] delim-based extractions REGEX = ^(w+)s FORMAT = myFieldLabel::$1 Rex Search Command ... | rex field=_raw "From: (?<from>.*) To: (?<to>.*)"Copyright © 2011, Splunk Inc. 16 Listen to your data.
  17. Saved Searches and Alerting Find Something Interesting? ORCopyright © 2011, Splunk Inc. 17 Listen to your data.
  18. Alerting Cont.Searches run on a schedule and fire an alert• Example: Run a search for “Failed password” every 15 min over the last 15 min and alert if the number of events is greater than 10Searches are running in real-time and fire an alert• Example: Run a search for “Failed password user=john.doe” in a 1 minute window and alert if an event is found Copyright © 2011, Splunk Inc. 18 Listen to your data.
  19. Alerting Actions• Send email• RSS• Execute a script• Track in Alert Manager Copyright © 2011, Splunk Inc. 19 Listen to your data.
  20. ReportingBuild reports from the results of any searchSelect type of report (Values over time, Top Values, Rare Values)and on which fields to report or perform statistics Choose the type of chart (line, area, column, etc) and other formatting optionsCopyright © 2011, Splunk Inc. 20 Listen to your data.
  21. Reporting Examples• Use wizard or reporting commands (timechart, top, etc)• Build real-time reports with real-time searches• Save reports for use on dashboards Copyright © 2011, Splunk Inc. 21 Listen to your data.
  22. DashboardsCreate dashboards from search resultsCopyright © 2011, Splunk Inc. 22 Listen to your data.
  23. Dashboard ExamplesCopyright © 2011, Splunk Inc. 23 Listen to your data.
  24. Splunk Manager Now Manage All of that Cool Stuff You Just Created (and more!)• Permissions• Saved Searches/Reports• Custom Views• Distributed Splunk• Deployment Server• License Usage….Copyright © 2011, Splunk Inc. 24 Listen to your data.
  25. Deployment and Integration
  26. Splunk Has Four Primary Functions Searching and Reporting (Search Head) Indexing and Search Services (Indexer) Local and Distributed Management (Deployment Server) Data Collection and Forwarding (Forwarder) A Splunk install can be one or all roles…Copyright © 2011, Splunk Inc. 26 Listen to your data.
  27. Getting Data Into Splunk Agent and Agent-less Approach for Flexibility syslog Local File Monitoring log files, config files TCP/UDP dumps and trace files syslog compatible hosts and network devices Windows Inputs Scripted Inputs Event Logs shell scripts custom performance counters Mounted File Systems WMI Active parsers batch loading registry monitoring hostnamemount Event Logs Performance Directory Active Directory monitoring code shell virtual host perf Unix, Linux and Windows hosts Windows hosts Custom apps and scripted API connections Windows hosts Agent-less Data Input Splunk ForwarderCopyright © 2011, Splunk Inc. 27 Listen to your data.
  28. Understanding the Universal Forwarder Forward data without negatively impacting production performance. Universal Regular (Heavy) Universal Forwarder Deployment Forwarder ForwarderMonitor AllSupported ✔ ✔Inputs Logs Messages Configurations Metrics ScriptsRouting,Filtering, ✔ ✔CloningSplunk Web ✔PythonLibraries ✔ Central Deployment ManagementEvent BasedRouting ✔ScriptedInputs ✔ Monitor files, changes and the system registry; capture metrics and status. Copyright © 2011, Splunk Inc. 28 Listen to your data.
  29. Horizontal Scaling Load balanced search and indexing for massive, linear scale out. Distributed Search ForwarderAuto Load Balancing Copyright © 2011, Splunk Inc. 29 Listen to your data.
  30. Multiple DatacentersIndex and store locally. Distribute searches to datacenters, networks & geographies. Headquarters Distributed Search London Hong Kong Tokyo New York Copyright © 2011, Splunk Inc. 30 Listen to your data.
  31. Data Redundancy Clone data to multiple index servers to eliminate a single point of failure. Active Hot Standby Forwarding to DR site Data CloningCopyright © 2011, Splunk Inc. 31 Listen to your data.
  32. High Availability Combine auto load balancing and cloning for HA at every Splunk tier. Shared Storage Distributed Search Distributed SearchClone Group 1 : Complete Dataset Clone Group 2 : Complete Dataset Data Cloning &Auto Load Balancing Copyright © 2011, Splunk Inc. 32 Listen to your data.
  33. Send Data to Other Systems Route raw data in real time or send alerts based on searches. Service Desk Event Console SIEMCopyright © 2011, Splunk Inc. 33 Listen to your data.
  34. Integrate External Data Extend search with lookups to external data sources. LDAP, AD Watch Lists CMDB CRM/ERPCorrelate IP addresses with locations, accounts with regions Copyright © 2011, Splunk Inc. 34 Listen to your data.
  35. Integrate Users and Roles Integrate authentication with LDAP and Active Directory. LDAP, AD Splunk Flexible Roles Capabilities & Filters Users and Groups Manage Indexes Share Searches Save SearchesProblem Investigation Problem Investigation Problem Investigation Manage Users NOT tag=PCI App=ERP … Map LDAP & AD groups to flexible Splunk roles. Define any search as a filter. Copyright © 2011, Splunk Inc. 35 Listen to your data.
  36. Centralized Licensing Management Groups, Stacks, and Pools for Enterprise Deployments Problem InvestigationCopyright © 2011, Splunk Inc. 36 Listen to your data.
  37. Deployment Monitoring Keep Tabs On Your Splunk Enterprise Deployment Licenses Sourcetypes Indexers ForwardersCopyright © 2011, Splunk Inc. Listen to your data. 37
  38. Support and Community
  39. Support Through the Splunk Community SplunkbaseCopyright © 2011, Splunk Inc. 39 Listen to your data.
  40. Where to Go for Help Documentation – http://www.splunk.com/base/Documentation Technical Support – http://www.splunk.com/support Videos – http://www.splunk.com/videos Education – http://www.splunk.com/goto/education Professional ServicesCopyright © 2011, Splunk Inc. 40 Listen to your data.
  41. Technical WorkshopsGetting Started User TrainingThank youDate
  • nv1972

    Apr. 21, 2017
  • JustinFrappier2

    Jan. 14, 2017
  • CliffondraBuchanan

    Feb. 17, 2016
  • HarshPant

    Jan. 30, 2016
  • JunoSouChonLong

    Jan. 24, 2016
  • rvibin

    Jun. 15, 2015
  • killisss

    Jan. 7, 2014
  • AnthonyWatson3

    Apr. 20, 2013
  • wcpan

    Mar. 1, 2013
  • kkooman

    Jan. 21, 2013
  • gtin00b

    Nov. 24, 2012
  • psychosb

    Mar. 29, 2012
  • alexpopov

    Feb. 22, 2012
  • draggho

    Nov. 13, 2011
  • alessandrovozza

    Nov. 9, 2011

Views

Total views

11,060

On Slideshare

0

From embeds

0

Number of embeds

89

Actions

Downloads

511

Shares

0

Comments

0

Likes

15

×