Getting Started with Splunk Hands-on
1 like666 views
This document provides an overview and demonstration of Splunk software. It discusses what machine data is, Splunk's mission to make machine data accessible and valuable, and what machine data looks like from different sources. The presentation then demonstrates how to install Splunk, onboard data, conduct searches, create dashboards and alerts. It also discusses Splunk deployment architectures for single and distributed environments and how to get help resources.
Ad
More Related Content
What's hot (20)
Viewers also liked (20)
Ad
Similar to Getting Started with Splunk Hands-on (20)
Ad
More from Splunk (20)
Recently uploaded (20)
Getting Started with Splunk Hands-on
- 2. 2 Agenda 1. Splunk Overview 2. Using Splunk (Live Demonstration/Walkthrough) 3. Splunk Deployment Architecture 4. Splunk Communities 5. Q&A
- 3. 3 What is machine data? Challenges: Volume | Velocity | Variety | Variability GPS, RFID, Hypervisor, Web Servers, Email, Messaging, Clickstreams, Mobile, Telephony, IVR, Databases, Sensors, Telematics, Storage, Servers, Security Devices, Desktops 3 Splunk’s Mission: Making machine data accessible, usable and valuable to everyone.
- 8. 8 The Splunk Portfolio Platform for Operational Intelligence Rich Ecosystem of Apps & Add-Ons Splunk Premium Solutions Mainframe Data Relational Databases MobileForwarders Syslog/TCP IoT Devices Network Wire Data Hadoop Packet Analysis (Wire Data) - App Response Time - Detect unauthorized access Mobile Application Performance Management (APM) - App Crashes - User Experience Place Splunk search & analytics on top of Hadoop/noSQL cluster Import & Correlate external DB data - 3rd party tools - Enrich data already in Splunk
- 11. 11 1. Download Splunk Enterprise https://www.splunk.com/en_us/download-21.html – Or Google “Splunk download” -> Download Splunk Enterprise 2. Download Splunk Tutorial Data – tutorialdata.zip http://docs.splunk.com/images/Tutorial/tutorialdata.zip – Or Google “Splunk tutorial data” -> Load the tutorial data Downloading Splunk Enterprise + Tutorial Data
- 12. 12 Start Splunk from bin directory Log into Splunk – http://127.0.0.1:8000 – username=admin password=changeme Add the tutorialdata.zip into to Splunk – Click Settings – Click Add Data – Click Upload files from my computer. – Drag and drop your sample data zip file. – Review and Finish. Getting Data into Splunk We will import sample web ecommerce store events
- 14. 14 Searches Used • index=buttercupgames status=4* • index=buttercupgames status!=200 | top limit=20 status • index=buttercupgames status !=200 | timechart count • index=buttercupgames status!=200 | stats count by status | where count > 700 • index=buttercupgames status!=200 | stats count sparkline by uri_path
- 15. 15 Searches Used Cont’d • index=buttercupgames status=200 | iplocation clientip | geostats count by City • index=buttercupgames action=purchase | stats count • index=buttercupgames action=purchase | timechart count | predict count as predictedCount Tip: Use the “| history” command to see previous searches used
- 21. 21 Time to start SPLUNKING!!! • Documentation – http://www.splunk.com/base/Documentation • Technical Support – http://www.splunk.com/support • Videos – http://www.splunk.com/videos • Education – http://education.splunk.com • Community – http://answers.splunk.com • Splunk Book – http://splunkbook.com Where do I go for help?
- 22. 2 Thank You!
- 23. Copyright © 2015 Splunk Inc. • 5,000+ IT and Business Professionals • 175+ Sessions • 80+ Customer Speakers PLUS Splunk University • Three days: Sept 23-25, 2017 • Get Splunk Certified for FREE! • Get CPE credits for CISSP, CAP, SSCP SEPT 25-28, 2017 Walter E. Washington Convention Center Washington, D.C. CONF.SPLUNK.COM The 8th Annual Splunk Worldwide Users’ Conference