2. Agenda
Assumptions
SAs, TAs, Field Aliasing, CIM, Eventtypes, Tags
Dashboard Customization Made Easy
High Availability and Clustering
Report Acceleration
Lookups
Support and Community
2
4. You Are in This Session Because….
4
• You have developed advanced searches with Splunk to manipulate
and present data
• You have mastered sourcetyping and extracting fields
• You have built reports beyond | timechart count
• You have created dashboards of some kind
• You have http://www.splunk.com/base/Documentation bookmarked
6. What Are We Talking About Here?
6
• Terminology
• Field Aliasing ability to add hierarchy of fields for easy transaction
analysis.
• CIM – Common Information Model mapping to consistent field across
different sources of data
• SA – Supporting Add-ons contains underlying support modules and
tools
• TA – Technology Add-on contains field extractions and mapping to CIM
• Eventtypes – An event type is a user-defined field that simplifies search
by letting you categorize events
• Tags – Grouping of event data groups with related field values.
7. How Can I Learn More???
7
Searching and Reporting with Splunk -
http://www.splunk.com/view/SP-CAAAGCB
Advanced Admin - http://www.splunk.com/view/SP-
CAAAGNF
9. Splunk Dashboard Customization?
9
• Splunk Live Advance App – Tips/Tricks Covered:
• App Menu Customization Adding menu’s for your custom created
searches/reports/dashboards..
• Adding a Time Selector Add a time selector dropdown for your Simple
XML dashboard.
• Converting Simple XML to Advance XML Quickly create an Advance
XML dashboard using a Simple XML dashboard as the source.
• Adding Dashboard Editor to Advance XML Add the useful Dashboard
editor to your Advance XML dashboards, for quick editing.
• Add a custom chart module – Donut Chart Quickly add a custom
chart, leveraging a custom chart module from Highcharts.com
10. *Disclaimer
10
• The App and Splunk Web customizations that we will show in this
presentation are by no means comprehensive
• Please see the Developer Manual for more detail
http://www.splunk.com/base/Documentation/latest/Developer/
12. Other User Control Methods
12
Edit Permissions by App in the App Manager
Remove options for users in the AccountBar
<module name="AccountBar" layoutPanel="appHeader">
<param name="mode">lite</param>
</module>
13. Other Customization Options
13
• App Icon – create your own icon to show on Home screen
– $SPLUNK_HOME/etc/apps/your_app_name/appserver/static/appIcon.png
• Custom Cascading Style Sheets (CSS) - background colors, fonts,
logos, buttons, navigation, menus, etc
– Default:
$SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/css/skins/defaul
t/default.css
– Create your application.css in
$SPLUNK_HOME/etc/app/your_app_name/appserver/static
– See Splunk Apps (Splunk for *NIX, Splunk for Windows, etc) for examples
14. Where Do I Go From Here?
14
Developing Apps with Splunk -
http://www.splunk.com/view/SP-CAAAGCD
16. Index Replication or clustering
•New in 5.0, Splunk indexers can be configuredto replicateindexed data
amongstthemselvesin a group of servers
•Data replicationallows for rapid failure recovery
•Fully configurablereplicationallows you to balancespeed of recovery and
overall disk usage
17. Why Use Index Replication?
• When you need highly availableaccess to your data – during maintenance,
planneddowntimes, etc.
• When you want to ensure high data fidelity – add another layer of protection
beyond backups
• When you need rapid failure (hardware or software) recovery – if you don’t
want to resort to tape when hard disks die
• Collateralbenefit: multiplesearch peers means faster searches!
19. Index Replication Server Types
•Master node: Splunk instancewhich controls and manages a replication
cluster – there can only be one master
•Peer node: Similar to an indexer in any multi-server Splunk install, indexes
data from inputs/forwarders PLUS it replicates data to other peer nodes as
indicated by the master
•Search head: Works as any Splunk search head, but is a required
component of any replication cluster
20. Enabling Index Replication
•EnablingIndex Replication automatically sets up the following:
– Distributed search link is created across the whole replication cluster: master,
search head, and peers
– Aconfigurable replication port is created on all peers to send and receive replicated
data to other peers
– Aheartbeat is established between the peers and the master – default timeout 60
seconds
21. Where Do I Go From Here?
21
Advanced Admin -
http://www.splunk.com/view/SP-CAAAGNF
23. Report Acceleration Overview
• Reports that cover a large volume of data can:
– Takelong timeto complete
– Consumea greatdeal ofsystem resources
• You can ‘accelerate’a qualifying report when you:
– Saveit
– Createa dashboardpanel basedonit
– Edita qualifying saved search
• Common use cases include:
- Moreefficientlyrun reportsfor large datasetsover longtimeranges
▸Showthenumberofpageviewsandvisitorsforeachofyour web sitesoverthepast30
days,brokenoutbysite
- Buildarolling report thatshows aggregatedstatisticsover longperiods of time
▸Displaya runningcountofdownloadsforaspecificfileonawebsite
▸Calculatetheaverageamountspentperpurchaseoverayear
24. Report Acceleration Overview (cont’d)
•To acceleratethe search, Splunk creates an accelerationsummary
•Accelerationsummaries
– Efficientlyreport on large volumes of data
– Qualify future searches against the summary
•To acceleratea report, Search Mode must be set to Smart or Fast
– Neither theTimeline nor the Fields sidebar display
•By default, only power users can acceleratereports
•If you delete all the searches that use a summary, the summary is deleted
•If an accelerationsummary is created from a shared search, other reports
that can use it, will use it
25. Populating Search Requirements
•Qualifyingsearches
– Search must include a reporting command
▸Forexample: chart, timechart, stats, top, and rare
– Any command before the reporting command must be a streaming command,
that is a command that applies a transformation to each event returned by the
search
▸Forexample: eval, fields,multikv, rex,rename, and replace
27. Run as a normal
search
Creating Acceleration Summaries
Power
role?
# of events
returned >
100,000?
Qualified
search?
Select acceleration
and summary range
Build acceleration
summary
YES
NO
Summary
too large*
[See docs]
NO
YES
Acceleration
summary
YES
Run
normal
search
Launchs
earch
Run normal
search
NO
YES
NO
28. Cases Where Splunk Will Not Build a Summary
•There are cases where Splunk allows you to "accelerate" a search, but a
summarywon't be created
•Splunk knows what's most efficient and generally won't generate a
summary if:
– There are fewer than 100K events in the summary range - it’s faster executing the
search without a summary
– Summary size is projected to too large - it’s faster executing the search because
the main index is smaller
•If a summary is defined and not created for the above reasons, Splunk
continuesto check periodically, then automatically creates a summary once it
meets the requirements
29. Where Do I Go From Here?
29
Searching and Reporting with Splunk -
http://www.splunk.com/view/SP-CAAAGCB
34. Where to Go for Help
34
• Documentation
– http://www.splunk.com/base/Documentation
• Technical Support
– http://www.splunk.com/support
• Videos
– http://www.splunk.com/videos
• Education
– http://www.splunk.com/goto/education
• Professional Services
Once you have been awed by the power of Splunk to search on any data in your world (and others), you generally want organize things in a way that will get relevant information into the hands of the right people. Whether this is creating a place for those pesky developers to look at their logs, providing the security team with a trail of evidence, or impressing your boss with pie charts.
Once you have been awed by the power of Splunk to search on any data in your world (and others), you generally want organize things in a way that will get relevant information into the hands of the right people. Whether this is creating a place for those pesky developers to look at their logs, providing the security team with a trail of evidence, or impressing your boss with pie charts.
The second option must be done in Advanced XML. We’ll cover that later.
Others: Customize login screen, event display, add HTML with a ServerSideInclude, put in an external website with IFrameInclude module.
We say Power user here, but the user must have the schedule_search privilege to create an acceleration summary.Users with schedule_search capability can accelerate reports, ie power users by default
*greater than 10% of total bucket size
We see the field product_id in our event but would like to map this to the actual product name for reporting purposes and to make the results more readable.
