Copyright	
  ©	
  2015	
  Splunk	
  Inc.	
  
Filip	
  Wijnholds	
  
Sr.	
  Sales	
  Engineer	
  
GeAng	
  Started	
  with	
  
Splunk	
  Enterprise	
  
Filip	
  Wijnholds	
  
Joined	
  Splunk	
  June	
  2015	
  
	
  	
  Intel	
  Security	
  4	
  years	
  prior.	
  
	
  
“Packet	
  head”	
  Started	
  with	
  with	
  Sniffer	
  PRO	
  
	
   	
   	
  At	
  Network	
  General	
  
	
  
Favorite	
  T-­‐Shirt	
  Quote:	
  I	
  like	
  big	
  data	
  	
  
	
   	
   	
  and	
  I	
  cannot	
  lie.	
  
	
  
	
  
	
  
Legal	
  No)ces	
  
During	
  the	
  course	
  of	
  this	
  presentaUon,	
  we	
  may	
  make	
  forward-­‐looking	
  statements	
  regarding	
  future	
  
events	
  or	
  the	
  expected	
  performance	
  of	
  the	
  company.	
  We	
  cauUon	
  you	
  that	
  such	
  statements	
  reflect	
  our	
  
current	
  expectaUons	
  and	
  esUmates	
  based	
  on	
  factors	
  currently	
  known	
  to	
  us	
  and	
  that	
  actual	
  events	
  or	
  
results	
  could	
  differ	
  materially.	
  For	
  important	
  factors	
  that	
  may	
  cause	
  actual	
  results	
  to	
  differ	
  from	
  those	
  
contained	
  in	
  our	
  forward-­‐looking	
  statements,	
  please	
  review	
  our	
  filings	
  with	
  the	
  SEC.	
  	
  The	
  forward-­‐
looking	
  statements	
  made	
  in	
  this	
  presentaUon	
  are	
  being	
  made	
  as	
  of	
  the	
  Ume	
  and	
  date	
  of	
  its	
  live	
  
presentaUon.	
  	
  If	
  reviewed	
  a[er	
  its	
  live	
  presentaUon,	
  this	
  presentaUon	
  may	
  not	
  contain	
  current	
  or	
  
accurate	
  informaUon.	
  	
  	
  We	
  do	
  not	
  assume	
  any	
  obligaUon	
  to	
  update	
  any	
  forward-­‐looking	
  statements	
  
we	
  may	
  make.	
  	
  In	
  addiUon,	
  any	
  informaUon	
  about	
  our	
  roadmap	
  outlines	
  our	
  general	
  product	
  direcUon	
  
and	
  is	
  subject	
  to	
  change	
  at	
  any	
  Ume	
  without	
  noUce.	
  	
  It	
  is	
  for	
  informaUonal	
  purposes	
  only	
  and	
  shall	
  
not	
  be	
  incorporated	
  into	
  any	
  contract	
  or	
  other	
  commitment.	
  	
  Splunk	
  undertakes	
  no	
  obligaUon	
  either	
  
to	
  develop	
  the	
  features	
  or	
  funcUonality	
  described	
  or	
  to	
  include	
  any	
  such	
  feature	
  or	
  funcUonality	
  in	
  a	
  
future	
  release.	
  
3	
  
4	
  
Making	
  machine	
  data	
  accessible,	
  
usable	
  and	
  valuable	
  to	
  everyone.	
  	
  
4	
  
Our	
  Plan	
  of	
  AcUon	
  
5	
  
1. SeAng	
  the	
  stage.	
  
2. How	
  does	
  Splunk	
  fit	
  in	
  the	
  landscape?	
  
3. What	
  differen'ates	
  Splunk?	
  
4. Components	
  that	
  make	
  up	
  Splunk?	
  
5. Demo	
  -­‐	
  How	
  it	
  works?	
  
The	
  AcceleraUng	
  Pace	
  of	
  Data	
  
Volume	
  	
  |	
  	
  Velocity	
  	
  |	
  	
  Variety	
  |	
  Variability	
  
GPS,	
  
RFID,	
  
Hypervisor,	
  
Web	
  Servers,	
  
Email,	
  Messaging,	
  
Clickstreams,	
  Mobile,	
  	
  
Telephony,	
  IVR,	
  Databases,	
  
Sensors,	
  TelemaUcs,	
  Storage,	
  
Servers,	
  Security	
  Devices,	
  Desktops	
  	
  
Machine	
  data	
  is	
  the	
  fastest	
  growing,	
  most	
  
complex,	
  most	
  valuable	
  area	
  of	
  big	
  data	
  
6	
  
Industry	
  Leading	
  Pladorm	
  For	
  Machine	
  Data	
  
	
  Machine	
  Data:	
  Any	
  Loca)on,	
  Type,	
  Volume	
  
Online	
  
Services	
  
Web	
  
Services	
  
Servers	
  
Security	
   GPS	
  
LocaUon	
  
Storage	
  
Desktops	
  
Networks	
  
Packaged	
  
ApplicaUons	
  
Custom	
  
ApplicaUons	
  Messaging	
  
Telecoms	
  
Online	
  
Shopping	
  
Cart	
  
Web	
  
Clickstreams	
  
Databases	
  
Energy	
  
Meters	
  
Call	
  Detail	
  
Records	
  
Smartphones	
  
and	
  Devices	
  
RFID	
  
On-­‐	
  
Premises	
  
Private	
  	
  
Cloud	
  
Public	
  	
  
Cloud	
  
PlaAorm	
  Support	
  (Apps	
  /	
  API	
  /	
  SDKs)	
  
Enterprise	
  Scalability	
  
Universal	
  Indexing	
  
Answer	
  Any	
  Ques)on	
  
Developer	
  
PlaAorm	
  
Report	
  and	
  	
  
analyze	
  
Custom	
  	
  
dashboards	
  
Monitor	
  	
  
and	
  alert	
  
Ad	
  hoc	
  	
  
search	
  
Universal	
  
Machine	
  Data	
  
Pladorm	
  
Industry	
  Leading	
  Pladorm	
  For	
  Machine	
  Data	
  
	
  Machine	
  Data:	
  Any	
  Loca)on,	
  Type,	
  Volume	
  
Online	
  
Services	
  
Web	
  
Services	
  
Servers	
  
Security	
   GPS	
  
LocaUon	
  
Storage	
  
Desktops	
  
Networks	
  
Packaged	
  
ApplicaUons	
  
Custom	
  
ApplicaUons	
  Messaging	
  
Telecoms	
  
Online	
  
Shopping	
  
Cart	
  
Web	
  
Clickstreams	
  
Databases	
  
Energy	
  
Meters	
  
Call	
  Detail	
  
Records	
  
Smartphones	
  
and	
  Devices	
  
RFID	
  
On-­‐	
  
Premises	
  
Private	
  	
  
Cloud	
  
Public	
  	
  
Cloud	
  
PlaAorm	
  Support	
  (Apps	
  /	
  API	
  /	
  SDKs)	
  
Enterprise	
  Scalability	
  
Universal	
  Indexing	
  
Answer	
  Any	
  Ques)on	
  
Developer	
  
PlaAorm	
  
Report	
  and	
  	
  
analyze	
  
Custom	
  	
  
dashboards	
  
Monitor	
  	
  
and	
  alert	
  
Ad	
  hoc	
  	
  
search	
  
Any	
  amount,	
  any	
  locaUon,	
  any	
  source	
  
Schema-­‐
on-­‐the-­‐fly	
  
Universal	
  
indexing	
  
No	
  	
  
back-­‐end	
  
RDBMS	
  
No	
  need	
  	
  
to	
  filter	
  
data	
  
Schema	
  on	
  
the	
  Fly	
  
Mainframe	
  
Data	
  
VMware	
  
Pladorm	
  for	
  Machine	
  Data	
  
Easy	
  to	
  Adopt	
  Splunk	
  
Exchange	
   PCI	
  Security	
  
DB	
  Connect	
   Mobile	
  Forwarders	
  
Syslog	
  /	
  	
  
TCP	
  /	
  Other	
  
Sensors	
  &	
  
Control	
  Systems	
  
Rich	
  Ecosystem	
  of	
  Apps	
  
Across	
  Data	
  Sources,	
  Use	
  Cases	
  &	
  Consump)on	
  Models	
  
Stream	
  
9	
  
Passionate	
  
and	
  Vibrant	
  
Community	
  
Big	
  Data	
  Landscape	
  
Key/Value,	
  Columnar	
  or	
  	
  
Other	
  (semi-­‐structured)	
  
Cassandra	
  
CouchDB	
  
MongoDB	
  
NoSQL	
  
10	
  
Rela)onal	
  Database	
  
	
  (highly	
  structured)	
  
SQL	
  &	
  
MapReduce	
  
RDBMS	
  
Oracle,	
  
MySQL,	
  
IBM	
  DB2,	
  
Teradata	
  
Teradata	
  Aster	
  Data	
  
SQL	
  on	
  Hadoop	
  
Distributed	
  File	
  System	
  
(semi-­‐structured)	
  
Hadoop	
  
HDFS	
  Storage	
  +	
  	
  
MapReduce	
  
Temporal,	
  Unstructured	
  
Heterogeneous	
  
Real-­‐Time	
  Indexing	
  
MapReduce	
  
Big	
  Data	
  Landscape	
  
Key/Value,	
  Columnar	
  or	
  	
  
Other	
  (semi-­‐structured)	
  
Cassandra	
  
CouchDB	
  
MongoDB	
  
NoSQL	
  
11	
  
Rela)onal	
  Database	
  
	
  (highly	
  structured)	
  
SQL	
  &	
  
MapReduce	
  
RDBMS	
  
Oracle,	
  
MySQL,	
  
IBM	
  DB2,	
  
Teradata	
  
Teradata	
  Aster	
  Data	
  
SQL	
  on	
  Hadoop	
  
Distributed	
  File	
  System	
  
(semi-­‐structured)	
  
Hadoop	
  
HDFS	
  Storage	
  +	
  	
  
MapReduce	
  
Temporal,	
  Unstructured	
  
Heterogeneous	
  
Real-­‐Time	
  Indexing	
  
MapReduce	
  
1.	
  
2.	
  
3.	
  
4.	
  
How	
  to	
  Get	
  Started	
  
Download	
  
Install	
  
Forward	
  Data	
  
Search	
  
Databases	
  
Networks	
  
Servers	
  
Virtual	
  
Machines	
  
Smart	
  
phones	
  
and	
  
Devices	
  
Custom	
  
ApplicaUons	
  
Security	
  
Web	
  Server	
  
Sensors	
  
Four	
  steps:	
  
Define	
  Product	
  Roles	
  
" Searching	
  and	
  ReporUng	
  (Search	
  Head)	
  
	
  
" Indexing	
  and	
  Search	
  Services	
  (Indexer)	
  
	
  
" Data	
  CollecUon	
  and	
  Forwarding	
  (Forwarder)	
  
" Data	
  Governor	
  (Cluster	
  Master)	
  
" Distributed	
  Management	
  (Deployment	
  Server)	
  
	
  
Databases	
  
Networks	
  
Servers	
  
Virtual	
  
Machines	
  
Smart	
  
phones	
  
and	
  
Devices	
  
Custom	
  
ApplicaUons	
  
Security	
  
Web	
  Server	
  
Sensors	
  
Scales	
  from	
  
Desktop	
  to	
  
Enterprise	
  
Scales	
  to	
  Hundreds	
  of	
  TBs/Day	
  
Enterprise-­‐Class	
  Scale,	
  Resilience	
  and	
  Interoperability	
  
Send	
  data	
  from	
  thousands	
  of	
  servers	
  using	
  any	
  combinaUon	
  of	
  Splunk	
  Forwarders	
  	
  	
  
Auto	
  load-­‐balanced	
  forwarding	
  to	
  Splunk	
  Indexers	
  
Offload	
  search	
  load	
  to	
  Splunk	
  Search	
  Heads	
  
Scales	
  from	
  
Desktop	
  to	
  
Enterprise	
  
Demo	
  –	
  How	
  it	
  Works	
  
15	
  
1.  	
  	
  Installing	
  and	
  StarUng	
  Splunk	
  
2.  	
  	
  IngesUng	
  Data	
  
3.  	
  	
  Search	
  Basics	
  	
  
•  Search	
  Bar	
  
•  Time	
  Picker	
  
•  Extracted	
  Fields	
  	
  
4.  	
  	
  Dynamic	
  Field	
  ExtracUon	
  	
  
5.  	
  	
  AlerUng	
  
6.  	
  	
  StaUsUcs	
  and	
  ReporUng	
  
7.  	
  	
  Command	
  Language	
  
8.  	
  	
  Splunk	
  ApplicaUons	
  
Supplemental	
  InformaUon	
  
16	
  
Get	
  the	
  following	
  at	
  splunk.does-­‐it.net	
  
	
  
Download	
  
•  www.splunk.com/download	
  
	
  
Search	
  Tutorial:	
  
•  docs.splunk.com/DocumentaUon/Splunk/latest/SearchTutorial	
  
	
  
Tutorial	
  Data:	
  
•  docs.splunk.com/images/Tutorial/tutorialdata.zip	
  
	
  
Demo	
  
17	
  
EducaUon	
  Resources	
  
18	
  
Splunk	
  Educa)on	
  
•  www.splunk.com/educaUon	
  
	
  	
  
Using	
  Splunk,	
  Searching	
  and	
  ReporUng,	
  Developing	
  Apps,	
  	
  
Administering	
  Splunk,	
  and	
  more!	
  
	
  
Books	
  
•  ImplemenUng	
  Splunk:	
  Big	
  Data	
  EssenUals	
  for	
  OperaUonal	
  Intelligence	
  
•  Splunk	
  EssenUals	
  
•  Exploring	
  Splunk	
  
•  Splunk	
  OperaUonal	
  Intelligence	
  Cookbook	
  
Things	
  to	
  Remember	
  
19	
  
1.  	
  	
  Splunk	
  is	
  Free	
  –	
  Download	
  and	
  get	
  started	
  today	
  
2.  	
  	
  Quick	
  Time	
  to	
  Value	
  
3.  	
  	
  Data	
  Gold	
  Mines	
  –	
  what	
  informaUonal	
  fortune	
  awaits?!	
  
4.  	
  	
  Leverage	
  the	
  Splunk	
  Community	
  
•  splunkbase.splunk.com	
  
•  answers.splunk.com	
  
•  blogs.splunk.com	
  
5.  	
  	
  Happy	
  Splunking!!	
  
QuesUons?	
  
Thank	
  You	
  

SplunkLive! Amsterdam 2015 Breakout - Getting Started with Splunk

  • 1.
    Copyright  ©  2015  Splunk  Inc.   Filip  Wijnholds   Sr.  Sales  Engineer   GeAng  Started  with   Splunk  Enterprise  
  • 2.
    Filip  Wijnholds   Joined  Splunk  June  2015      Intel  Security  4  years  prior.     “Packet  head”  Started  with  with  Sniffer  PRO        At  Network  General     Favorite  T-­‐Shirt  Quote:  I  like  big  data          and  I  cannot  lie.        
  • 3.
    Legal  No)ces   During  the  course  of  this  presentaUon,  we  may  make  forward-­‐looking  statements  regarding  future   events  or  the  expected  performance  of  the  company.  We  cauUon  you  that  such  statements  reflect  our   current  expectaUons  and  esUmates  based  on  factors  currently  known  to  us  and  that  actual  events  or   results  could  differ  materially.  For  important  factors  that  may  cause  actual  results  to  differ  from  those   contained  in  our  forward-­‐looking  statements,  please  review  our  filings  with  the  SEC.    The  forward-­‐ looking  statements  made  in  this  presentaUon  are  being  made  as  of  the  Ume  and  date  of  its  live   presentaUon.    If  reviewed  a[er  its  live  presentaUon,  this  presentaUon  may  not  contain  current  or   accurate  informaUon.      We  do  not  assume  any  obligaUon  to  update  any  forward-­‐looking  statements   we  may  make.    In  addiUon,  any  informaUon  about  our  roadmap  outlines  our  general  product  direcUon   and  is  subject  to  change  at  any  Ume  without  noUce.    It  is  for  informaUonal  purposes  only  and  shall   not  be  incorporated  into  any  contract  or  other  commitment.    Splunk  undertakes  no  obligaUon  either   to  develop  the  features  or  funcUonality  described  or  to  include  any  such  feature  or  funcUonality  in  a   future  release.   3  
  • 4.
    4   Making  machine  data  accessible,   usable  and  valuable  to  everyone.     4  
  • 5.
    Our  Plan  of  AcUon   5   1. SeAng  the  stage.   2. How  does  Splunk  fit  in  the  landscape?   3. What  differen'ates  Splunk?   4. Components  that  make  up  Splunk?   5. Demo  -­‐  How  it  works?  
  • 6.
    The  AcceleraUng  Pace  of  Data   Volume    |    Velocity    |    Variety  |  Variability   GPS,   RFID,   Hypervisor,   Web  Servers,   Email,  Messaging,   Clickstreams,  Mobile,     Telephony,  IVR,  Databases,   Sensors,  TelemaUcs,  Storage,   Servers,  Security  Devices,  Desktops     Machine  data  is  the  fastest  growing,  most   complex,  most  valuable  area  of  big  data   6  
  • 7.
    Industry  Leading  Pladorm  For  Machine  Data    Machine  Data:  Any  Loca)on,  Type,  Volume   Online   Services   Web   Services   Servers   Security   GPS   LocaUon   Storage   Desktops   Networks   Packaged   ApplicaUons   Custom   ApplicaUons  Messaging   Telecoms   Online   Shopping   Cart   Web   Clickstreams   Databases   Energy   Meters   Call  Detail   Records   Smartphones   and  Devices   RFID   On-­‐   Premises   Private     Cloud   Public     Cloud   PlaAorm  Support  (Apps  /  API  /  SDKs)   Enterprise  Scalability   Universal  Indexing   Answer  Any  Ques)on   Developer   PlaAorm   Report  and     analyze   Custom     dashboards   Monitor     and  alert   Ad  hoc     search   Universal   Machine  Data   Pladorm  
  • 8.
    Industry  Leading  Pladorm  For  Machine  Data    Machine  Data:  Any  Loca)on,  Type,  Volume   Online   Services   Web   Services   Servers   Security   GPS   LocaUon   Storage   Desktops   Networks   Packaged   ApplicaUons   Custom   ApplicaUons  Messaging   Telecoms   Online   Shopping   Cart   Web   Clickstreams   Databases   Energy   Meters   Call  Detail   Records   Smartphones   and  Devices   RFID   On-­‐   Premises   Private     Cloud   Public     Cloud   PlaAorm  Support  (Apps  /  API  /  SDKs)   Enterprise  Scalability   Universal  Indexing   Answer  Any  Ques)on   Developer   PlaAorm   Report  and     analyze   Custom     dashboards   Monitor     and  alert   Ad  hoc     search   Any  amount,  any  locaUon,  any  source   Schema-­‐ on-­‐the-­‐fly   Universal   indexing   No     back-­‐end   RDBMS   No  need     to  filter   data   Schema  on   the  Fly  
  • 9.
    Mainframe   Data   VMware   Pladorm  for  Machine  Data   Easy  to  Adopt  Splunk   Exchange   PCI  Security   DB  Connect   Mobile  Forwarders   Syslog  /     TCP  /  Other   Sensors  &   Control  Systems   Rich  Ecosystem  of  Apps   Across  Data  Sources,  Use  Cases  &  Consump)on  Models   Stream   9   Passionate   and  Vibrant   Community  
  • 10.
    Big  Data  Landscape   Key/Value,  Columnar  or     Other  (semi-­‐structured)   Cassandra   CouchDB   MongoDB   NoSQL   10   Rela)onal  Database    (highly  structured)   SQL  &   MapReduce   RDBMS   Oracle,   MySQL,   IBM  DB2,   Teradata   Teradata  Aster  Data   SQL  on  Hadoop   Distributed  File  System   (semi-­‐structured)   Hadoop   HDFS  Storage  +     MapReduce   Temporal,  Unstructured   Heterogeneous   Real-­‐Time  Indexing   MapReduce  
  • 11.
    Big  Data  Landscape   Key/Value,  Columnar  or     Other  (semi-­‐structured)   Cassandra   CouchDB   MongoDB   NoSQL   11   Rela)onal  Database    (highly  structured)   SQL  &   MapReduce   RDBMS   Oracle,   MySQL,   IBM  DB2,   Teradata   Teradata  Aster  Data   SQL  on  Hadoop   Distributed  File  System   (semi-­‐structured)   Hadoop   HDFS  Storage  +     MapReduce   Temporal,  Unstructured   Heterogeneous   Real-­‐Time  Indexing   MapReduce  
  • 12.
    1.   2.   3.   4.   How  to  Get  Started   Download   Install   Forward  Data   Search   Databases   Networks   Servers   Virtual   Machines   Smart   phones   and   Devices   Custom   ApplicaUons   Security   Web  Server   Sensors   Four  steps:  
  • 13.
    Define  Product  Roles   " Searching  and  ReporUng  (Search  Head)     " Indexing  and  Search  Services  (Indexer)     " Data  CollecUon  and  Forwarding  (Forwarder)   " Data  Governor  (Cluster  Master)   " Distributed  Management  (Deployment  Server)     Databases   Networks   Servers   Virtual   Machines   Smart   phones   and   Devices   Custom   ApplicaUons   Security   Web  Server   Sensors   Scales  from   Desktop  to   Enterprise  
  • 14.
    Scales  to  Hundreds  of  TBs/Day   Enterprise-­‐Class  Scale,  Resilience  and  Interoperability   Send  data  from  thousands  of  servers  using  any  combinaUon  of  Splunk  Forwarders       Auto  load-­‐balanced  forwarding  to  Splunk  Indexers   Offload  search  load  to  Splunk  Search  Heads   Scales  from   Desktop  to   Enterprise  
  • 15.
    Demo  –  How  it  Works   15   1.     Installing  and  StarUng  Splunk   2.     IngesUng  Data   3.     Search  Basics     •  Search  Bar   •  Time  Picker   •  Extracted  Fields     4.     Dynamic  Field  ExtracUon     5.     AlerUng   6.     StaUsUcs  and  ReporUng   7.     Command  Language   8.     Splunk  ApplicaUons  
  • 16.
    Supplemental  InformaUon   16   Get  the  following  at  splunk.does-­‐it.net     Download   •  www.splunk.com/download     Search  Tutorial:   •  docs.splunk.com/DocumentaUon/Splunk/latest/SearchTutorial     Tutorial  Data:   •  docs.splunk.com/images/Tutorial/tutorialdata.zip    
  • 17.
  • 18.
    EducaUon  Resources   18   Splunk  Educa)on   •  www.splunk.com/educaUon       Using  Splunk,  Searching  and  ReporUng,  Developing  Apps,     Administering  Splunk,  and  more!     Books   •  ImplemenUng  Splunk:  Big  Data  EssenUals  for  OperaUonal  Intelligence   •  Splunk  EssenUals   •  Exploring  Splunk   •  Splunk  OperaUonal  Intelligence  Cookbook  
  • 19.
    Things  to  Remember   19   1.     Splunk  is  Free  –  Download  and  get  started  today   2.     Quick  Time  to  Value   3.     Data  Gold  Mines  –  what  informaUonal  fortune  awaits?!   4.     Leverage  the  Splunk  Community   •  splunkbase.splunk.com   •  answers.splunk.com   •  blogs.splunk.com   5.     Happy  Splunking!!  
  • 20.
  • 21.