33,59 €
Mehr erfahren.
- Herausgeber: Packt Publishing
- Kategorie: Wissenschaft und neue Technologien
- Sprache: Englisch
A fast-paced and practical guide to demystifying big data and transforming it into operational intelligence
About This Book
- Want to get started with Splunk to analyze and visualize machine data? Open this book and step into the world of Splunk.
- Leverage the exceptional analysis and visualization capabilities to make informed decisions for your business
- This easy-to-follow, practical book can be used by anyone, even if you have never managed any data before
Who This Book Is For
This book will be perfect for you if you are a Software engineer or developer or System administrators or Business analyst who seek to correlate machine data with business metrics and provide intuitive real-time and statistical visualizations. Some knowledge or experience of previous versions of Splunk will be helpful but not essential.
What You Will Learn
- Install and configure Splunk
- Gather data from different sources, isolate them by indexes, classify them into source types, and tag them with the essential fields
- Be comfortable with the Search Processing Language and get to know the best practices in writing search queries
- Create stunning and powerful dashboards
- Be proactive by implementing alerts and scheduled reports
- Use the Splunk SDK and integrate Splunk data into other applications
- Implement the best practices in using Splunk.
In Detail
Splunk is a search, analysis, and reporting platform for machine data, which has a high adoption on the market. More and more organizations want to adopt Splunk to use their data to make informed decisions.
This book is for anyone who wants to manage data with Splunk. You'll start with very basics of Splunk— installing Splunk—and then move on to searching machine data with Splunk. You will gather data from different sources, isolate them by indexes, classify them into source types, and tag them with the essential fields. After this, you will learn to create various reports, XML forms, and alerts. You will then continue using the Pivot Model to transform the data models into visualization. You will also explore visualization with D3 in Splunk. Finally you'll be provided with some real-world best practices in using Splunk.
Style and approach
This fast-paced, example-rich guide will help you analyze and visualize machine data with Splunk through simple, practical instructions.
Sie lesen das E-Book in den Legimi-Apps auf:
Seitenzahl: 192
Veröffentlichungsjahr: 2016
Ähnliche
Table of Contents
Splunk Essentials Second Edition
Splunk Essentials Second Edition
Copyright © 2016 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.
First published: February 2015
Second Edition: September 2016
Production reference: 1260916
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham B3 2PB, UK.
ISBN 978-1-78588-946-2
www.packtpub.com
Credits
Authors
Betsy Page Sigman
Erickson Delgado
Copy Editor
Safis Editing
Reviewer
Somesh Soni
Project Coordinator
Suzanne Coutinho
Commissioning Editor
Veena Pagare
Proofreader
Safis Editing
Acquisition Editor
Vinay Argekar
Indexer
Rekha Nair
Content Development Editor
Nikhil Borkar
Production Coordinator
Aparna Bhagat
Technical Editor
Madhunikita Sunil Chindarkar
About the Authors
Betsy Page Sigman is a distinguished professor at the McDonough School of Business at Georgetown University in Washington, D.C. She has taught courses in statistics, project management, databases, and electronic commerce for the last 17 years and has been recognized with awards for teaching and service. Before arriving at Georgetown, she worked at George Mason University, the U.S. Bureau of the Census, Decision/Making/Information, the American Enterprise Institute, and the Social Science Data Center (now Roper Center) at the University of Connecticut.
Her recent publications include a Harvard Business case study and a Harvard Business review article, articles in the Decision Sciences Journal of Innovative Education and Decision Line, and a case study in Educause Review Online. Additionally, she is a frequent media commentator on technological issues and big data.
A big thank you to Nikhil Borkar and Vinay Argekar and the other editors and staff at Packt Publishing for your help in every step along the way to finishing this book. Thanks also to my colleagues and students at the McDonough School of Business at Georgetown University. Thanks especially to Bill Garr, Rob Pongsajapan, Marie Selvanandin, and Kristin Bolling, and the Center for New Designs in Learning and Scholarship (CNDLS), for exploring the exciting world of big data and Splunk together. It has been a wonderful place to learn, grow, and serve for the last 16 years.
I need to thank my brothers, Tim and Rick Page, for being there to challenge and encourage me throughout my life. Most of all, I want to thank my brilliant and wonderful husband, Chuck, my astonishing daughter and son-in-law, Page and Daniel Thies, and my three sons. Johnny, thanks for always inspiring me technologically; Richard, thanks for your sense of humor that keeps us all laughing; and James, thanks for always being there for all of us. Edward and Peter, the grandsons who light up all our lives, are too young to read this now. They were born into an extraordinary world—one that I hope and pray technology will continue to improve.
Erickson Delgado is an enterprise architect who loves to mine and analyze data. He began using Splunk in version 4.0 and has pioneered the use of the application in his current work. In the earlier parts of his career, he worked with start-up companies in the Philippines to help build their open source infrastructure. He then worked in the cruise industry as a shipboard IT manager, and he loved it. From there, he was recruited to work at the company’s headquarters as a software engineer.
He has developed applications with Python and Node.js. He is interested in Go and is rediscovering programming with C/C++. He is crazy about visualization platforms and tools. In recent years, he has engaged himself with employing DevOps in his work.
Since Erickson’s routine revolves around technical practices, he blows off steam by saltwater fishing, mountain biking, crafting robots, and touring the country. He lives in Orlando.
To my wife, Emma, thank you for the never-ending support and patience.
About the Reviewer
Somesh Soni is a Splunk consultant with over 11 years of IT experience. He has a bachelor's degree (Hons.) in computer science and has been interested in exploring and learning new technologies throughout his life. He has extensive experience in consulting, architecture, administration, and development in Splunk. He’s proficient in various programming languages and tools, including C#.NET/VB.NET, SSIS, and SQL Server.
Somesh is currently working as a Splunk Master with Randstad Technologies. His activities are focused on consulting, implementation, admin, architecture, and support-related activities for Splunk. He started his career with the one of the top three Indian IT giants. He has executed projects for major Fortune 500 companies such as Coca Cola, Wells Fargo, Microsoft, and Capital Group. He has performed in various capacities, including Technical Architect, Technical Lead, Onsite Coordinator, and Technology Analyst.
Somesh has been a great contributor to the Splunk community and has consistently been at the top of the list. He is a member of Splunk Trust 2015-16 and overall one of the topmost contributors to the Splunk Answers community.
I would like to thank my family and colleagues, who have always encouraged and supported me to follow my dreams, and my friends, who put up with all my crazy antics while I went on a Splunk exploratory journey and listened with patience to all the tips and tricks of Splunk that I shared with them.
Last but not least, I would like to express my gratitude to the entire team at Packt Publishing for giving me this opportunity.
www.PacktPub.com
For support files and downloads related to your book, please visit www.PacktPub.com.
Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at [email protected] for more details.
At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.
https://www.packtpub.com/mapt
Get the most in-demand software skills with Mapt. Mapt gives you full access to all Packt books and video courses, as well as industry-leading tools to help you plan your personal development and advance your career.
Why subscribe?
Preface
In Splunk Essentials, Second Edition, we have added many more features that readers should find useful. Splunk Enterprise Software, or Splunk, is an extremely powerful tool for searching, exploring, and visualizing data of all types. Splunk is becoming increasingly popular, as more and more businesses, both large and small, discover its ease and usefulness. Analysts, managers, students, and others can quickly learn how to use the data from their systems, networks, web traffic, and social media to make attractive and informative reports. This is a straightforward, practical, and quick introduction to Splunk that should have you making reports and gaining insights from your data in no time. We have added a number of helpful hints and exercises that will help you get up to speed with Splunk in no time. Throughout the book, we have provided step-by-step instructions, pointers, and illustrations to help you on your way.
What this book covers
Chapter 1, Splunk in Action, introduces you to Splunk Enterprise Software and its powerful capabilities.
Chapter 2, Bringing in Data, explains indexing and searching in Splunk, and introduces other data concepts that are important to understand.
Chapter 3, Search Processing Language, develops your skills in using Search Processing Language (SPL).
Chapter 4, Data Models and Pivot, shows you how to create a data model as well as a pivot table using Splunk.
Chapter 5, Data Optimization, Reports, Alerts, and Accelerating Searches, explores how to use data optimization and search acceleration with Splunk, and how to create effective reports and alerts.
Chapter 6, Panes of Glass, takes you step-by-step through the development of dashboard.
Chapter 7, Splunk SDK for JavaScript and D3.js, instructs you on how to use a Splunk SDK and D3 to create effective and attractive website visualizations.
Chapter 8, HTTP Event Collector, introduces how to use Splunk to monitor HTTP events.
Chapter 9, Best Practices and Advanced Queries, overviews various best practices for using Splunk and gives details on advanced queries that can be used to take advantage of Splunk’s many rich capabilities.
What you need for this book
Most personal computers today can run Splunk easily. For more technical details see http://docs.splunk.com/Documentation/6.4/Installation/Chooseyourplatform.
Who this book is for
Splunk Essentials, Second Edition, is intended for the Splunk developer, software engineer, businessperson, analyst, or student who wants to quickly learn how to use Splunk to manage data. Perhaps you have heard about this technology that is being used quite often now in fields like systems analysis, cyber security, and machine data management. In a matter of hours, this book will help you understand how to bring in data of all types, store it, and use it to create effective reports and dashboards. It would be helpful to have a bit of familiarity with basic computer concepts, but no prior experience is required.
Reader feedback
Feedback from our readers is always welcome. Let us know what you think about this book-what you liked or disliked. Reader feedback is important for us as it helps us develop titles that you will really get the most out of. To send us general feedback, simply e-mail [email protected], and mention the book's title in the subject of your message. If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide at www.packtpub.com/authors.
Customer support
Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.
Downloading the example code
You can download the example code files for this book from your account at http://www.packtpub.com. If you purchased this book elsewhere, you can visit http://www.packtpub.com/support and register to have the files e-mailed directly to you.
You can download the code files by following these steps:
Once the file is downloaded, please make sure that you unzip or extract the folder using the latest version of:
The code bundle for the book is also hosted on GitHub at https://github.com/PacktPublishing/Splunk-Essentials-Second-Edition. We also have other code bundles from our rich catalog of books and videos available at https://github.com/PacktPublishing/. Check them out!
Downloading the color images of this book
We also provide you with a PDF file that has color images of the screenshots/diagrams used in this book. The color images will help you better understand the changes in the output. You can download this file from https://www.packtpub.com/sites/default/files/downloads/SplunkEssentialsSecondEdition_ColorImages.pdf.
Errata
Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books-maybe a mistake in the text or the code-we would be grateful if you could report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the Errata Submission Form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website or added to any list of existing errata under the Errata section of that title.
To view the previously submitted errata, go to https://www.packtpub.com/books/content/support and enter the name of the book in the search field. The required information will appear under the Errata section.
Piracy
Piracy of copyrighted material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works in any form on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy.
Please contact us at [email protected] with a link to the suspected pirated material.
We appreciate your help in protecting our authors and our ability to bring you valuable content.
Questions
If you have a problem with any aspect of this book, you can contact us at [email protected], and we will do our best to address the problem.
Chapter 1. Splunk in Action
Splunk, whose name was inspired by the process of exploring caves, or spelunking, helps analysts, operators, programmers, and many others explore many types of data, including raw machine data from their organizations, by collecting, analyzing, and acting on them. This multinational company, cofounded by Michael Baum, Rob Das, and Erik Swan, has a core product called Splunk Enterprise. This product manages searches, inserts, deletes, filters, and analyzes big data that is generated by machines, as well as many other types of data.
Note
Throughout the book, we will be covering the fundamental, barebones concepts of Splunk so you can learn quickly and efficiently. We reserve any deep discussion of concepts to Splunk's online documentation. Where necessary, we provide links to help provide you with the practical skills, and examples, so you can get started quickly. All images and exercise materials used in this book are available at http://github.com/ericksond/splunk-essentials. Instructions for Mac OS X can also be found in the GitHub repository mentioned in the preceding link.
With very little time, you can achieve direct results using Splunk, which you can access through a free enterprise trial license. While this license limits you to 500 MB of data ingested per day, it will allow you to quickly get up to speed with Splunk and learn the essentials of this powerful software.
The exercises in this chapter may look challenging at first, but if you follow what we've written closely, we believe you will quickly learn the fundamentals you need to use Splunk effectively. Together, we will make the most of the Trial License and give you a visible result that you can use to create valuable insights for your company (and, if you like, proudly show to your friends and coworkers).
Your Splunk.com account
First you will need to register for a Splunk.com account. This is the account that you will use if you decide to purchase a license later. Go ahead and do this now. From here on, the password you use for your Splunk.com account will be referred to as your Splunk.com password.
Obtaining a Splunk.com account
To obtain your Splunk.com account, perform the following steps:
You will then need to download the Splunk Enterprise software. Go to http://download.splunk.com and select the Splunk Enterprise free download. Choose your operating system, being careful to select 32- or 64-bit (whichever is appropriate in your case; most should select 64-bit, which most computers today use). For Windows, download the *.msi file. For Mac OS X, download the *.dmg file. In this book, we will work with Version 6.4.1 or later.
The installation is very straightforward. Follow the steps for your particular operating system, whether it be Windows or Mac OS X.
Note
Make sure that there is no previous installation of Splunk in your system. If there is, uninstall the old version before proceeding with the next steps.
Installing Splunk on Windows
These are the instructions you need to follow to install Splunk on your Windows desktop. Take your time and do not rush the installation. Many chapters in this book will rely on these steps:
Note
Throughout the book, you will see references to $SPLUNK_HOME. This will be the installation directory of Splunk. In Windows, as a convention used in this book, $SPLUNK_HOME will be at C:\Splunk.
