SlideShare a Scribd company logo

Getting Started with Splunk Enterprise - Demo

•
•
Splunk
Splunk

Splunk can be used to analyze log data from an online gaming company to help identify issues causing customer complaints. The demo shows how to ingest sample log data, perform searches to find error codes and pages, create alerts, and generate statistics and reports on the data. Dynamic field extraction, pivoting, and over 140 search commands allow transforming and analyzing the data in various ways. Results can be saved as dashboards and applications for ongoing monitoring and insights.

Technology
1 of 11
Getting Started with Splunk Page 1 of 11 Before Demo Things to do prior to demo: 1. Download latest version of Splunk from http://www.splunk.com/download 2. Download http://docs.splunk.com/images/Tutorial/tutorialdata.zip Notables The idea is to introduce the main features of Splunk iteratively as you do the demo, explaining what they are and how they work, not just simply point them out. [http://docs.splunk.com/images/e/e5/6.2tutorial_startsearching2.png] Also, please remember to sprinkle in Splunk’s typical value props as you demo: Real-Time architecture, agile statistics and reporting, schema on the fly, raw data stored – nothing filtered in the event, time-based series, etc. At a high level the customer has been receiving a lot of customer complaints when engaging in their online sales portal for video games. They would like visibility into what causes issues and be alerted when they do occur. Total demo time should be about 30 min or less. Demo 1. Install latest version of Splunk. 2. Start up the new installed instance of Splunk.  If not installing on a Windows based machine please mention it’s installed as a Service. Its start up status can be modified there.  On *nix platforms the following command can be run to ensure Splunk starts at boot time:  $SPLUNK_HOME/bin/splunk enable boot-start 3. Ingest Tutorial Data Click Path – Screen Action Say - Description Display Emulate thatyou download tutorialdata.zipandshow it’s contents. Docs Website where youcan getthisdata. Splunkprovidesanonlinetutorial for gettingdataintoSplunk. It includesa sample datafile thatcomesfromthe fictitious“ButterCupGames,Inc.”:A worldwide game companysellingit’s productsthroughit’sonline store. Thiszipfile iscollectionof webaccess logs,securitylogs,andvendorsales
Getting Started with Splunk Page 2 of 11 generatedfromwebsite infrastructure. Loginto newlyinstalledSplunk instance onyour laptop. There are twowaysto get to the appropriate menu. Afteryoulogin yousee the option “AddData” -> Settings -> Add Data OR -> Settings -> Data Input There are twomore optionsunderthe Settingsmenu. Yousee the “Add Data” image again,but underData youalso have “Data Inputs”. I’m goingto clickon “AddData” ClickUploadaftersayingthe following: Besidesuploading datayoualsosee youcan monitorfiles, use Windows ManagementInstrumentation(WMI), TCP/UDP,Scripts,and Modularinput for external datasources. Splunk’s Universal Forwarderallowsyouto securelyandefficientlyforwarddata fromremote server. We are goingto choose the uploadoption. SelectFile -> browse to tutorialdata -> www3 -> access.log OR Clickand Drag tutorialdata/www3/access.log to “Drop your data file here” ClickgreenNextbuttonattop of the screen. Once selected,Splunkwillshow me a sample of myeventsandmake a best guessonthe type of data, the timestamp,and determine if the data issingle line ormulti-line.Ican override Splunk’sbestguess,ordefine my ownsettingsforhow I wantthe data to be treated withthe user interface. Thisone time configuration providessupportfora varietyof out- of-box source typeswhilegivingyou the flexibilitytodefine anew source type basedonany customsourcesyou may have.
Getting Started with Splunk Page 3 of 11 ClickBack on the Web Browser. Click and drag tutorialdata.zip into“Drop your data file here”. ClickgreenNextbuttonattop of the screen You can eveningestcompressedfiles. So I letsuploadthe tutorialdata.zipfile to “bulk”uploadall of this data. ClickReviewtop of the screen aftersaying-> Here you can setadditional input parametersforthisdata. Sourcetype:TellsSplunkwhatkindof data youhave,allowingSplunk categorize yourdata soyou can searchit easily. Host: Name of machine whichthe data originated Index:A logical container/destination for yourdata. → Apps→ Searching& Reporting Withdata ingested we can immediatelybegintoSearchourdata and gainmeaningful insight. 4. Search Basics Letssay you are a Web Site Administrator. Yourecentlyreceivedusercomplaintsthatthatwebpagesare failingandnot returningcontentwhenitshould. Let’suse Splunktosearchthisdata,to not onlydetermine problems thathappened but factorsassociatedwithorcontributingtoit. Search Bar -> * Do thisbefore yousay -> At topof the screenyouhave a Search Bar, similartowhat youwoulduse if searchingthe Internet. I can simply type whatI’d like tosearchfor. Notice thatwhenyoudo searchit’s across all yourdata, structured, unstructured,andverylikely heterogeneous. Search Bar -> buttercupgames (returns36,819 events) SimilartoGoogle,Ican use whole words,suchas typinginthe word “buttercupgames”. Pleasenotice that as youtype Splunkdisplays“Matching terms”justbelow the searchbar. Splunkalsodisplaysdifferentwaysto use searchto return events. Splunk’s goal is to enable ourcustomerstouse
Getting Started with Splunk Page 4 of 11 manyof the skillstheyalreadyhave whensearching,makingiteasytodo while providingquicktime tovalue. Executingthe search for “buttercupgames”returnsevents containingthatword. Splunk returns eventscontainingthatterm, highlightingthe terminthe events returned. Search Bar -> buttercupgames 403 (returns282 events) Letssay a customermade a valid requestbutbuttercupgames web service simplyfailedtorespond,the webserverwouldrespondwitha403 code. Expandour search for403. Whensearchingfortwo termsthe ANDis implied. Search Bar -> buttercupgames 403 OR 404 (returns1013 events) Maybe a webpage resource was missing,thatwouldbe encodedasa 404, so we can lookfor either403 OR 404 Search Bar -> buttercupgames 40* (returns5268 events) Insteadof OR maybe we use a wildcard,searchfor40*. Notice that returnstermsstartingwith“40”, dramatically increasingourresultset. You can see terms408, 404, 406, etc. highlighted.
Getting Started with Splunk Page 5 of 11 5. Time Picker Search Bar -> buttercupgames 403 → Time Drop Down All eventsinSplunkare time-based. Keyingoff time isanotherwayto enable efficientsearching. Splunk providesaTime-Picker, givingyou flexibilitytosearchreal-time data, relative time ranges,suchasprevious businessweek,last30 minutes,orall time. You can alsodefine specific time or date ranges. Highlightthe histogram Belowthe searchbar isa histogram displayingthe frequencyof events. Thiscan be veryhelpful if I’mlooking for gapsor spikesincertaintypesof events. Ialsohave the optionof zoominginonthe histogramor focusingall the waydownto milliseconds. 6. Extracted Fields Expandon the first event. The real secretsauce to Splunkisit’s abilitytorecognize andextract informationcontainwithinthe events. Splunkwill automaticallypull outany key/value pairs,IPaddresses,time and date fields,aswell ascommon formatssuch as comma,tab delimited fieldsinacsv file. Splunkdoesthis while retainingthe entire raw event. Clickon the value of status – Add to search By clickingonany givenvalue youcan Addit or Exclude itfroma search, or evenstarta new searchbasedonthat value. Addingitto our existing searchyou’ll notice akey-value pair addedto our search. Now,insteadof justsearchingfora giventerminany eventyoucan furtherrefine your searchto eventswho’sgiven extractedfieldcontainsaspecific value.
Getting Started with Splunk Page 6 of 11 Highlightlefthandpane On the left,Ican see ALL the fields that were dynamicallyextractedand are available tome forsearchingand reportingpurposes. Splunkalso showsthe numberof unique valuesit foundforeverygivenfielditfound. -> Smart Mode You can alsoadjustSplunk’s “discoverymode”forfielddata extractionduringsearches. 7. Dynamic Field Extraction a Expand an Event, click on Event Actions -> Extract Fields b Extract the field after status code, should be the response size.  It will miss some, no worries, just highlight the values missed in events and add to extraction. 8. Alerts -> Save As -> Alert Now,if a serverrefusestorespondsto a usersrequest,status=403, Splunk can detectthat and alertusto it. ClickReal Time, Provide a Title,then clickNext I can choose to constantlymonitorfor thisinreal-time orto schedule this alertbasedon a varietyof frequencies.
Getting Started with Splunk Page 7 of 11 Splunkprovidesflexiblenotification options,allowingyouto assign severity tothe Alert, toautomatically distribute anemail (orSMStext) and include outputinline orasan attachment. You can even domore advancedactionslike runa script native tothe OS Splunkrunsfor such thingsas mitigationorremediation.
Getting Started with Splunk Page 8 of 11 9. Statistics and Reporting Search Bar -> buttercupgames status=403 → Statisticstab Splunkmakesgatheringstatisticsand reportinga snap. Let’sclickon the “Statistics”tab underneaththe search bar. -> Quick Reports You are presentedwiththreedifferent options. QuickReportsletsyouclick on anyfieldfora listof quickreports. -> uri_path To findoutthose webpages associatedwiththe serverfailingto respondtoa request,clickon uri_path. Here Splunkprovidesyou withdifferentreportingoptions:Top Values,TopValuesbyTime,etc. -> uri_path -> Top values ClickingonTopValuesIget a break downof the total numberof events associatedwiththe serverfailingto respond,brokendownperuri_pathor webpage. ->Bar -> Pie Reportingisagile,youcaneasily modifythe reportingvisualization. Maybe we wanta pie chart insteadof a bar chart,no problem. -> Save As -> Dashboard Panel  Fill inDashboardtitle  Enable “SharedinApp”for DashboardPermissions  Panel Title “FailuresbyWeb Page”  ClickSave
Getting Started with Splunk Page 9 of 11  ClickViewDashboard Search -> Search Bar -> buttercupgames Clickon Statisticstab, choose Pivot. ClickOK. Splunkalsoallowsyoutobuildtables and visualizationsusingmultiple fields and metricswithoutwritingsearches. Pivotautomaticallygeneratesdata modelsbasedonyourdata, allowing youto pivotaroundyour data to extractstatisticsandreports. -> + (Nextto time filter), status, then match = 403 We can selectthe status attribute, thenenterina value of 403 SplitRows -> + -> uri_path, Add to Table We can splitthe numberof server refusedresponsesbyuri_path. Clickon Horizontal Bar Chart on reporting panel. We can leave the datain tabularform or simply choose another visualization. -> Save As -> Dashboard Panel -> Existing.
Getting Started with Splunk Page 10 of 11 Make sure the previous Dashboard“ServerFailures” appears. Provide aModel Title and ID. ClickSave -> View Dashboard. 10. Command Language Search -> Search Bar -> buttercupgames| stats count by status Save As -> Report There are nearly140 search commandsthat can be appliedto data. Whensearchingdata you isolatedeventsyouare interestedin, thenapplySplunk’scommandsto transformdata, furtherreduce data sets,generate statisticsorperform analyticsonthe data. To dothiswe applya pipe character(|) thenissue the desiredcommand. I.e.If we wantedto geta countof all statuscodesfoundinour data, we can use the stats command,countall eventswithstatusvalues,thensplit the count by individual statusvalues. Letssave that as a report: Search Bar -> buttercupgames | stats count by status | where status=403 OR status=404 Save As -> Dashboard Maybe we’re onlyinterestedin403’s and 404’s? Noproblemletsjustuse a WHERE commandto isolate those. Cool. Let’smake thispart of a dashboard.
Getting Started with Splunk Page 11 of 11 Search Bar -> buttercupgames | stats count, sparkline by uri_path | where status=403 OR status=404 In additiontocountingyoucan see trendinginformationbyaddinga sparkline commandtostats. Heck, letsevenbreakitdownbywebpage too. We’ll addthatour dashboard. Search Bar -> buttercupgames NOT status=200| timechart count by uri_path What if we want to see anyresponse that wasn’tOK, basicallyanynon200 code,and we like tosee an actual time distributionof those. The timechartfunctionhandlesthatquite nicely. Because Splunk’s reportingis agile youcan easilychange the visualizationonthe fly. Maybe want stack our valuesfora givenday. Totallycool! Letssave that to our dashboard. Search Bar -> buttercupgames NOT status=200 | iplocation clientip | geostats count Want to see where yourclientsare locatedencounteringthese browser requestsproblems,justuse the iplocationandgeostatscommands. Definitelywanttoaddthat to my dashboard! These are justa few waysto applythe over140 commandsavailable in Splunk. 11. Splunk Applications https://splunkbase.splunk.com The collectionsof these savedreports, dashboards,alerts,inputsettings,etc. iswhat Splunkreferstoas an Application. There are over600 readilyavailable applicationsonthe splunkbase website–meantto provide youinstantvalue byproviding prebuilddashboards,alerts,and reportsfor yourdatasources.

Recommended

Splunk Tutorial for Beginners - What is Splunk | Edureka
Splunk Tutorial for Beginners - What is Splunk | EdurekaSplunk Tutorial for Beginners - What is Splunk | Edureka
Splunk Tutorial for Beginners - What is Splunk | EdurekaEdureka!
 
SplunkLive 2011 Beginners Session
SplunkLive 2011 Beginners SessionSplunkLive 2011 Beginners Session
SplunkLive 2011 Beginners SessionSplunk
 
Splunk Architecture overview
Splunk Architecture overviewSplunk Architecture overview
Splunk Architecture overviewAlex Fok
 
Splunk Data Onboarding Overview - Splunk Data Collection Architecture
Splunk Data Onboarding Overview - Splunk Data Collection ArchitectureSplunk Data Onboarding Overview - Splunk Data Collection Architecture
Splunk Data Onboarding Overview - Splunk Data Collection ArchitectureSplunk
 
Splunk Overview
Splunk OverviewSplunk Overview
Splunk OverviewSplunk
 
Splunk
SplunkSplunk
SplunkKnoldus Inc.
 
Splunk for Enterprise Security and User Behavior Analytics
Splunk for Enterprise Security and User Behavior Analytics Splunk for Enterprise Security and User Behavior Analytics
Splunk for Enterprise Security and User Behavior AnalyticsSplunk
 
Splunk overview
Splunk overviewSplunk overview
Splunk overviewDaniel Hernandez
 

Recommended

Splunk Tutorial for Beginners - What is Splunk | Edureka
Splunk Tutorial for Beginners - What is Splunk | EdurekaSplunk Tutorial for Beginners - What is Splunk | Edureka
Splunk Tutorial for Beginners - What is Splunk | EdurekaEdureka!
 
SplunkLive 2011 Beginners Session
SplunkLive 2011 Beginners SessionSplunkLive 2011 Beginners Session
SplunkLive 2011 Beginners SessionSplunk
 
Splunk Architecture overview
Splunk Architecture overviewSplunk Architecture overview
Splunk Architecture overviewAlex Fok
 
Splunk Data Onboarding Overview - Splunk Data Collection Architecture
Splunk Data Onboarding Overview - Splunk Data Collection ArchitectureSplunk Data Onboarding Overview - Splunk Data Collection Architecture
Splunk Data Onboarding Overview - Splunk Data Collection ArchitectureSplunk
 
Splunk Overview
Splunk OverviewSplunk Overview
Splunk OverviewSplunk
 
Splunk
SplunkSplunk
SplunkKnoldus Inc.
 
Splunk for Enterprise Security and User Behavior Analytics
Splunk for Enterprise Security and User Behavior Analytics Splunk for Enterprise Security and User Behavior Analytics
Splunk for Enterprise Security and User Behavior AnalyticsSplunk
 
Splunk overview
Splunk overviewSplunk overview
Splunk overviewDaniel Hernandez
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk
 
Splunk Distributed Management Console
Splunk Distributed Management Console Splunk Distributed Management Console
Splunk Distributed Management Console Splunk
 
IBM Security QRadar
IBM Security QRadar IBM Security QRadar
IBM Security QRadarVirginia Fernandez
 
Splunk Architecture
Splunk ArchitectureSplunk Architecture
Splunk ArchitectureKishore Chaganti
 
Splunk 6.4 Administration.pdf
Splunk 6.4 Administration.pdfSplunk 6.4 Administration.pdf
Splunk 6.4 Administration.pdfnitinscribd
 
Getting started with Splunk
Getting started with SplunkGetting started with Splunk
Getting started with SplunkSplunk
 
Splunk Phantom SOAR Roundtable
Splunk Phantom SOAR RoundtableSplunk Phantom SOAR Roundtable
Splunk Phantom SOAR RoundtableSplunk
 
dlux - Splunk Technical Overview
dlux - Splunk Technical Overviewdlux - Splunk Technical Overview
dlux - Splunk Technical OverviewDavid Lutz
 
Getting Started with Splunk (Hands-On)
Getting Started with Splunk (Hands-On) Getting Started with Splunk (Hands-On)
Getting Started with Splunk (Hands-On) Splunk
 
Splunk for IT Operations
Splunk for IT OperationsSplunk for IT Operations
Splunk for IT OperationsSplunk
 
Splunk Enterprise Security
Splunk Enterprise SecuritySplunk Enterprise Security
Splunk Enterprise SecuritySplunk
 
Splunk-Presentation
Splunk-Presentation Splunk-Presentation
Splunk-Presentation PrasadThorat23
 
Splunk Cloud
Splunk CloudSplunk Cloud
Splunk CloudSplunk
 
Splunk 101
Splunk 101Splunk 101
Splunk 101Splunk
 
Getting started with Splunk - Break out Session
Getting started with Splunk - Break out SessionGetting started with Splunk - Break out Session
Getting started with Splunk - Break out SessionGeorg Knon
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
Analytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopAnalytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopSplunk
 
Splunk for ITOps
Splunk for ITOpsSplunk for ITOps
Splunk for ITOpsSplunk
 
Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...
Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...
Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...Edureka!
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
Getting started with Splunk
Getting started with SplunkGetting started with Splunk
Getting started with SplunkSanjib Dhar
 
Getting Started with Splunk Enterprise Hands-On Breakout Session
Getting Started with Splunk Enterprise Hands-On Breakout SessionGetting Started with Splunk Enterprise Hands-On Breakout Session
Getting Started with Splunk Enterprise Hands-On Breakout SessionSplunk
 

More Related Content

What's hot

Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk
 
Splunk Distributed Management Console
Splunk Distributed Management Console Splunk Distributed Management Console
Splunk Distributed Management Console Splunk
 
Splunk 6.4 Administration.pdf
Splunk 6.4 Administration.pdfSplunk 6.4 Administration.pdf
Splunk 6.4 Administration.pdfnitinscribd
 
Getting started with Splunk
Getting started with SplunkGetting started with Splunk
Getting started with SplunkSplunk
 
Splunk Phantom SOAR Roundtable
Splunk Phantom SOAR RoundtableSplunk Phantom SOAR Roundtable
Splunk Phantom SOAR RoundtableSplunk
 
dlux - Splunk Technical Overview
dlux - Splunk Technical Overviewdlux - Splunk Technical Overview
dlux - Splunk Technical OverviewDavid Lutz
 
Getting Started with Splunk (Hands-On)
Getting Started with Splunk (Hands-On) Getting Started with Splunk (Hands-On)
Getting Started with Splunk (Hands-On) Splunk
 
Splunk for IT Operations
Splunk for IT OperationsSplunk for IT Operations
Splunk for IT OperationsSplunk
 
Splunk Enterprise Security
Splunk Enterprise SecuritySplunk Enterprise Security
Splunk Enterprise SecuritySplunk
 
Splunk Cloud
Splunk CloudSplunk Cloud
Splunk CloudSplunk
 
Splunk 101
Splunk 101Splunk 101
Splunk 101Splunk
 
Getting started with Splunk - Break out Session
Getting started with Splunk - Break out SessionGetting started with Splunk - Break out Session
Getting started with Splunk - Break out SessionGeorg Knon
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
Analytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopAnalytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopSplunk
 
Splunk for ITOps
Splunk for ITOpsSplunk for ITOps
Splunk for ITOpsSplunk
 
Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...
Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...
Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...Edureka!
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 

What's hot (20)

Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk Enterprise
 
Splunk Distributed Management Console
Splunk Distributed Management Console Splunk Distributed Management Console
Splunk Distributed Management Console
 
IBM Security QRadar
IBM Security QRadar IBM Security QRadar
IBM Security QRadar
 
Splunk Architecture
Splunk ArchitectureSplunk Architecture
Splunk Architecture
 
Splunk 6.4 Administration.pdf
Splunk 6.4 Administration.pdfSplunk 6.4 Administration.pdf
Splunk 6.4 Administration.pdf
 
Getting started with Splunk
Getting started with SplunkGetting started with Splunk
Getting started with Splunk
 
Splunk Phantom SOAR Roundtable
Splunk Phantom SOAR RoundtableSplunk Phantom SOAR Roundtable
Splunk Phantom SOAR Roundtable
 
dlux - Splunk Technical Overview
dlux - Splunk Technical Overviewdlux - Splunk Technical Overview
dlux - Splunk Technical Overview
 
Getting Started with Splunk (Hands-On)
Getting Started with Splunk (Hands-On) Getting Started with Splunk (Hands-On)
Getting Started with Splunk (Hands-On)
 
Splunk for IT Operations
Splunk for IT OperationsSplunk for IT Operations
Splunk for IT Operations
 
Splunk Enterprise Security
Splunk Enterprise SecuritySplunk Enterprise Security
Splunk Enterprise Security
 
Splunk-Presentation
Splunk-Presentation Splunk-Presentation
Splunk-Presentation
 
Splunk Cloud
Splunk CloudSplunk Cloud
Splunk Cloud
 
Splunk 101
Splunk 101Splunk 101
Splunk 101
 
Getting started with Splunk - Break out Session
Getting started with Splunk - Break out SessionGetting started with Splunk - Break out Session
Getting started with Splunk - Break out Session
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)
 
Analytics Driven SIEM Workshop
Analytics Driven SIEM WorkshopAnalytics Driven SIEM Workshop
Analytics Driven SIEM Workshop
 
Splunk for ITOps
Splunk for ITOpsSplunk for ITOps
Splunk for ITOps
 
Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...
Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...
Splunk Architecture | Splunk Tutorial For Beginners | Splunk Training | Splun...
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 

Similar to Getting Started with Splunk Enterprise - Demo

Getting started with Splunk
Getting started with SplunkGetting started with Splunk
Getting started with SplunkSanjib Dhar
 
Getting Started with Splunk Enterprise Hands-On Breakout Session
Getting Started with Splunk Enterprise Hands-On Breakout SessionGetting Started with Splunk Enterprise Hands-On Breakout Session
Getting Started with Splunk Enterprise Hands-On Breakout SessionSplunk
 
Splunk 6.5.0-pivot tutorial (7)
Splunk 6.5.0-pivot tutorial (7)Splunk 6.5.0-pivot tutorial (7)
Splunk 6.5.0-pivot tutorial (7)Zoumana Diomande
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseShannon Cuthbertson
 
SplunkSummit 2015 - Security Ninjitsu
SplunkSummit 2015 - Security NinjitsuSplunkSummit 2015 - Security Ninjitsu
SplunkSummit 2015 - Security NinjitsuSplunk
 
SplunkLive! Frankfurt 2018 - Intro to Security Analytics Methods
SplunkLive! Frankfurt 2018 - Intro to Security Analytics MethodsSplunkLive! Frankfurt 2018 - Intro to Security Analytics Methods
SplunkLive! Frankfurt 2018 - Intro to Security Analytics MethodsSplunk
 
SplunkLive! Tampa: Splunk for Security - Hands-On Session
SplunkLive! Tampa: Splunk for Security - Hands-On SessionSplunkLive! Tampa: Splunk for Security - Hands-On Session
SplunkLive! Tampa: Splunk for Security - Hands-On SessionSplunk
 
Getting started with Splunk Breakout Session
Getting started with Splunk Breakout SessionGetting started with Splunk Breakout Session
Getting started with Splunk Breakout SessionSplunk
 
SplunkLive! Munich 2018: Intro to Security Analytics Methods
SplunkLive! Munich 2018: Intro to Security Analytics MethodsSplunkLive! Munich 2018: Intro to Security Analytics Methods
SplunkLive! Munich 2018: Intro to Security Analytics MethodsSplunk
 
SplunkLive! Washington DC May 2013 - Search Language Beginner
SplunkLive! Washington DC May 2013 - Search Language BeginnerSplunkLive! Washington DC May 2013 - Search Language Beginner
SplunkLive! Washington DC May 2013 - Search Language BeginnerSplunk
 
Splunk Discovery: Warsaw 2018 - Intro to Security Analytics Methods
Splunk Discovery: Warsaw 2018 - Intro to Security Analytics MethodsSplunk Discovery: Warsaw 2018 - Intro to Security Analytics Methods
Splunk Discovery: Warsaw 2018 - Intro to Security Analytics MethodsSplunk
 
Getting Started Getting Started With Splunk Enterprise
Getting Started Getting Started With Splunk EnterpriseGetting Started Getting Started With Splunk Enterprise
Getting Started Getting Started With Splunk EnterpriseSplunk
 
Splunk conf2014 - Onboarding Data Into Splunk
Splunk conf2014 - Onboarding Data Into SplunkSplunk conf2014 - Onboarding Data Into Splunk
Splunk conf2014 - Onboarding Data Into SplunkSplunk
 
Snowflake_free_trial_LabGuide.pdf
Snowflake_free_trial_LabGuide.pdfSnowflake_free_trial_LabGuide.pdf
Snowflake_free_trial_LabGuide.pdfAdrianMontero30
 
SplunkLive! Tampa: Splunk Ninjas: New Features, Pivot, and Search Dojo
SplunkLive! Tampa: Splunk Ninjas: New Features, Pivot, and Search Dojo SplunkLive! Tampa: Splunk Ninjas: New Features, Pivot, and Search Dojo
SplunkLive! Tampa: Splunk Ninjas: New Features, Pivot, and Search Dojo Splunk
 
Splunk Ninjas: New Features and Search Dojo
Splunk Ninjas: New Features and Search DojoSplunk Ninjas: New Features and Search Dojo
Splunk Ninjas: New Features and Search DojoSplunk
 
BestInFlowCompetitionTutorials03May2023
BestInFlowCompetitionTutorials03May2023BestInFlowCompetitionTutorials03May2023
BestInFlowCompetitionTutorials03May2023Timothy Spann
 
Snowflake free trial_lab_guide
Snowflake free trial_lab_guideSnowflake free trial_lab_guide
Snowflake free trial_lab_guideslidedown1
 

Similar to Getting Started with Splunk Enterprise - Demo (20)

Getting started with Splunk
Getting started with SplunkGetting started with Splunk
Getting started with Splunk
 
Getting Started with Splunk Enterprise Hands-On Breakout Session
Getting Started with Splunk Enterprise Hands-On Breakout SessionGetting Started with Splunk Enterprise Hands-On Breakout Session
Getting Started with Splunk Enterprise Hands-On Breakout Session
 
Splunk 6.5.0-pivot tutorial (7)
Splunk 6.5.0-pivot tutorial (7)Splunk 6.5.0-pivot tutorial (7)
Splunk 6.5.0-pivot tutorial (7)
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk Enterprise
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk Enterprise
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk Enterprise
 
SplunkSummit 2015 - Security Ninjitsu
SplunkSummit 2015 - Security NinjitsuSplunkSummit 2015 - Security Ninjitsu
SplunkSummit 2015 - Security Ninjitsu
 
SplunkLive! Frankfurt 2018 - Intro to Security Analytics Methods
SplunkLive! Frankfurt 2018 - Intro to Security Analytics MethodsSplunkLive! Frankfurt 2018 - Intro to Security Analytics Methods
SplunkLive! Frankfurt 2018 - Intro to Security Analytics Methods
 
SplunkLive! Tampa: Splunk for Security - Hands-On Session
SplunkLive! Tampa: Splunk for Security - Hands-On SessionSplunkLive! Tampa: Splunk for Security - Hands-On Session
SplunkLive! Tampa: Splunk for Security - Hands-On Session
 
Getting started with Splunk Breakout Session
Getting started with Splunk Breakout SessionGetting started with Splunk Breakout Session
Getting started with Splunk Breakout Session
 
SplunkLive! Munich 2018: Intro to Security Analytics Methods
SplunkLive! Munich 2018: Intro to Security Analytics MethodsSplunkLive! Munich 2018: Intro to Security Analytics Methods
SplunkLive! Munich 2018: Intro to Security Analytics Methods
 
SplunkLive! Washington DC May 2013 - Search Language Beginner
SplunkLive! Washington DC May 2013 - Search Language BeginnerSplunkLive! Washington DC May 2013 - Search Language Beginner
SplunkLive! Washington DC May 2013 - Search Language Beginner
 
Splunk Discovery: Warsaw 2018 - Intro to Security Analytics Methods
Splunk Discovery: Warsaw 2018 - Intro to Security Analytics MethodsSplunk Discovery: Warsaw 2018 - Intro to Security Analytics Methods
Splunk Discovery: Warsaw 2018 - Intro to Security Analytics Methods
 
Getting Started Getting Started With Splunk Enterprise
Getting Started Getting Started With Splunk EnterpriseGetting Started Getting Started With Splunk Enterprise
Getting Started Getting Started With Splunk Enterprise
 
Splunk conf2014 - Onboarding Data Into Splunk
Splunk conf2014 - Onboarding Data Into SplunkSplunk conf2014 - Onboarding Data Into Splunk
Splunk conf2014 - Onboarding Data Into Splunk
 
Snowflake_free_trial_LabGuide.pdf
Snowflake_free_trial_LabGuide.pdfSnowflake_free_trial_LabGuide.pdf
Snowflake_free_trial_LabGuide.pdf
 
SplunkLive! Tampa: Splunk Ninjas: New Features, Pivot, and Search Dojo
SplunkLive! Tampa: Splunk Ninjas: New Features, Pivot, and Search Dojo SplunkLive! Tampa: Splunk Ninjas: New Features, Pivot, and Search Dojo
SplunkLive! Tampa: Splunk Ninjas: New Features, Pivot, and Search Dojo
 
Splunk Ninjas: New Features and Search Dojo
Splunk Ninjas: New Features and Search DojoSplunk Ninjas: New Features and Search Dojo
Splunk Ninjas: New Features and Search Dojo
 
BestInFlowCompetitionTutorials03May2023
BestInFlowCompetitionTutorials03May2023BestInFlowCompetitionTutorials03May2023
BestInFlowCompetitionTutorials03May2023
 
Snowflake free trial_lab_guide
Snowflake free trial_lab_guideSnowflake free trial_lab_guide
Snowflake free trial_lab_guide
 

More from Splunk

.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routine.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routineSplunk
 
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTVSplunk
 
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica).conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica)Splunk
 
.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank International.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank InternationalSplunk
 
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett .conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett Splunk
 
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär).conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)Splunk
 
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu....conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...Splunk
 
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever....conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...Splunk
 
.conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex).conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex)Splunk
 
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)Splunk
 
Splunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11ySplunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11ySplunk
 
Splunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go KölnSplunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go KölnSplunk
 
Splunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go KölnSplunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go KölnSplunk
 
Data foundations building success, at city scale – Imperial College London
Data foundations building success, at city scale – Imperial College London Data foundations building success, at city scale – Imperial College London
Data foundations building success, at city scale – Imperial College LondonSplunk
 
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...Splunk
 
SOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSplunk
 
.conf Go 2022 - Observability Session
.conf Go 2022 - Observability Session.conf Go 2022 - Observability Session
.conf Go 2022 - Observability SessionSplunk
 
.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - Keynote.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - KeynoteSplunk
 
.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform Session.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform SessionSplunk
 
.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security SessionSplunk
 

More from Splunk (20)

.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routine.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routine
 
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
 
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica).conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
 
.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank International.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank International
 
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett .conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
 
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär).conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
 
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu....conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
 
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever....conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
 
.conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex).conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex)
 
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
 
Splunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11ySplunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11y
 
Splunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go KölnSplunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go Köln
 
Splunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go KölnSplunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go Köln
 
Data foundations building success, at city scale – Imperial College London
Data foundations building success, at city scale – Imperial College London Data foundations building success, at city scale – Imperial College London
Data foundations building success, at city scale – Imperial College London
 
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
 
SOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security Webinar
 
.conf Go 2022 - Observability Session
.conf Go 2022 - Observability Session.conf Go 2022 - Observability Session
.conf Go 2022 - Observability Session
 
.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - Keynote.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - Keynote
 
.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform Session.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform Session
 
.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session
 

Recently uploaded

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native ApplicationsWSO2
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodJuan lago vázquez
 
WSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2
 
Platformless Horizons for Digital Adaptability
Platformless Horizons for Digital AdaptabilityPlatformless Horizons for Digital Adaptability
Platformless Horizons for Digital AdaptabilityWSO2
 
AI in Action: Real World Use Cases by Anitaraj
AI in Action: Real World Use Cases by AnitarajAI in Action: Real World Use Cases by Anitaraj
AI in Action: Real World Use Cases by AnitarajAnitaRaj43
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdfSandro Moreira
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusZilliz
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyKhushali Kathiriya
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxRustici Software
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...apidays
 
Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Zilliz
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10
 
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)Samir Dash
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfOrbitshub
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century educationjfdjdjcjdnsjd
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businesspanagenda
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 

Recently uploaded (20)

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
WSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering Developers
 
Platformless Horizons for Digital Adaptability
Platformless Horizons for Digital AdaptabilityPlatformless Horizons for Digital Adaptability
Platformless Horizons for Digital Adaptability
 
AI in Action: Real World Use Cases by Anitaraj
AI in Action: Real World Use Cases by AnitarajAI in Action: Real World Use Cases by Anitaraj
AI in Action: Real World Use Cases by Anitaraj
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with Milvus
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..
 
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 

Getting Started with Splunk Enterprise - Demo

  • 1. Getting Started with Splunk Page 1 of 11 Before Demo Things to do prior to demo: 1. Download latest version of Splunk from http://www.splunk.com/download 2. Download http://docs.splunk.com/images/Tutorial/tutorialdata.zip Notables The idea is to introduce the main features of Splunk iteratively as you do the demo, explaining what they are and how they work, not just simply point them out. [http://docs.splunk.com/images/e/e5/6.2tutorial_startsearching2.png] Also, please remember to sprinkle in Splunk’s typical value props as you demo: Real-Time architecture, agile statistics and reporting, schema on the fly, raw data stored – nothing filtered in the event, time-based series, etc. At a high level the customer has been receiving a lot of customer complaints when engaging in their online sales portal for video games. They would like visibility into what causes issues and be alerted when they do occur. Total demo time should be about 30 min or less. Demo 1. Install latest version of Splunk. 2. Start up the new installed instance of Splunk.  If not installing on a Windows based machine please mention it’s installed as a Service. Its start up status can be modified there.  On *nix platforms the following command can be run to ensure Splunk starts at boot time:  $SPLUNK_HOME/bin/splunk enable boot-start 3. Ingest Tutorial Data Click Path – Screen Action Say - Description Display Emulate thatyou download tutorialdata.zipandshow it’s contents. Docs Website where youcan getthisdata. Splunkprovidesanonlinetutorial for gettingdataintoSplunk. It includesa sample datafile thatcomesfromthe fictitious“ButterCupGames,Inc.”:A worldwide game companysellingit’s productsthroughit’sonline store. Thiszipfile iscollectionof webaccess logs,securitylogs,andvendorsales
  • 2. Getting Started with Splunk Page 2 of 11 generatedfromwebsite infrastructure. Loginto newlyinstalledSplunk instance onyour laptop. There are twowaysto get to the appropriate menu. Afteryoulogin yousee the option “AddData” -> Settings -> Add Data OR -> Settings -> Data Input There are twomore optionsunderthe Settingsmenu. Yousee the “Add Data” image again,but underData youalso have “Data Inputs”. I’m goingto clickon “AddData” ClickUploadaftersayingthe following: Besidesuploading datayoualsosee youcan monitorfiles, use Windows ManagementInstrumentation(WMI), TCP/UDP,Scripts,and Modularinput for external datasources. Splunk’s Universal Forwarderallowsyouto securelyandefficientlyforwarddata fromremote server. We are goingto choose the uploadoption. SelectFile -> browse to tutorialdata -> www3 -> access.log OR Clickand Drag tutorialdata/www3/access.log to “Drop your data file here” ClickgreenNextbuttonattop of the screen. Once selected,Splunkwillshow me a sample of myeventsandmake a best guessonthe type of data, the timestamp,and determine if the data issingle line ormulti-line.Ican override Splunk’sbestguess,ordefine my ownsettingsforhow I wantthe data to be treated withthe user interface. Thisone time configuration providessupportfora varietyof out- of-box source typeswhilegivingyou the flexibilitytodefine anew source type basedonany customsourcesyou may have.
  • 3. Getting Started with Splunk Page 3 of 11 ClickBack on the Web Browser. Click and drag tutorialdata.zip into“Drop your data file here”. ClickgreenNextbuttonattop of the screen You can eveningestcompressedfiles. So I letsuploadthe tutorialdata.zipfile to “bulk”uploadall of this data. ClickReviewtop of the screen aftersaying-> Here you can setadditional input parametersforthisdata. Sourcetype:TellsSplunkwhatkindof data youhave,allowingSplunk categorize yourdata soyou can searchit easily. Host: Name of machine whichthe data originated Index:A logical container/destination for yourdata. → Apps→ Searching& Reporting Withdata ingested we can immediatelybegintoSearchourdata and gainmeaningful insight. 4. Search Basics Letssay you are a Web Site Administrator. Yourecentlyreceivedusercomplaintsthatthatwebpagesare failingandnot returningcontentwhenitshould. Let’suse Splunktosearchthisdata,to not onlydetermine problems thathappened but factorsassociatedwithorcontributingtoit. Search Bar -> * Do thisbefore yousay -> At topof the screenyouhave a Search Bar, similartowhat youwoulduse if searchingthe Internet. I can simply type whatI’d like tosearchfor. Notice thatwhenyoudo searchit’s across all yourdata, structured, unstructured,andverylikely heterogeneous. Search Bar -> buttercupgames (returns36,819 events) SimilartoGoogle,Ican use whole words,suchas typinginthe word “buttercupgames”. Pleasenotice that as youtype Splunkdisplays“Matching terms”justbelow the searchbar. Splunkalsodisplaysdifferentwaysto use searchto return events. Splunk’s goal is to enable ourcustomerstouse
  • 4. Getting Started with Splunk Page 4 of 11 manyof the skillstheyalreadyhave whensearching,makingiteasytodo while providingquicktime tovalue. Executingthe search for “buttercupgames”returnsevents containingthatword. Splunk returns eventscontainingthatterm, highlightingthe terminthe events returned. Search Bar -> buttercupgames 403 (returns282 events) Letssay a customermade a valid requestbutbuttercupgames web service simplyfailedtorespond,the webserverwouldrespondwitha403 code. Expandour search for403. Whensearchingfortwo termsthe ANDis implied. Search Bar -> buttercupgames 403 OR 404 (returns1013 events) Maybe a webpage resource was missing,thatwouldbe encodedasa 404, so we can lookfor either403 OR 404 Search Bar -> buttercupgames 40* (returns5268 events) Insteadof OR maybe we use a wildcard,searchfor40*. Notice that returnstermsstartingwith“40”, dramatically increasingourresultset. You can see terms408, 404, 406, etc. highlighted.
  • 5. Getting Started with Splunk Page 5 of 11 5. Time Picker Search Bar -> buttercupgames 403 → Time Drop Down All eventsinSplunkare time-based. Keyingoff time isanotherwayto enable efficientsearching. Splunk providesaTime-Picker, givingyou flexibilitytosearchreal-time data, relative time ranges,suchasprevious businessweek,last30 minutes,orall time. You can alsodefine specific time or date ranges. Highlightthe histogram Belowthe searchbar isa histogram displayingthe frequencyof events. Thiscan be veryhelpful if I’mlooking for gapsor spikesincertaintypesof events. Ialsohave the optionof zoominginonthe histogramor focusingall the waydownto milliseconds. 6. Extracted Fields Expandon the first event. The real secretsauce to Splunkisit’s abilitytorecognize andextract informationcontainwithinthe events. Splunkwill automaticallypull outany key/value pairs,IPaddresses,time and date fields,aswell ascommon formatssuch as comma,tab delimited fieldsinacsv file. Splunkdoesthis while retainingthe entire raw event. Clickon the value of status – Add to search By clickingonany givenvalue youcan Addit or Exclude itfroma search, or evenstarta new searchbasedonthat value. Addingitto our existing searchyou’ll notice akey-value pair addedto our search. Now,insteadof justsearchingfora giventerminany eventyoucan furtherrefine your searchto eventswho’sgiven extractedfieldcontainsaspecific value.
  • 6. Getting Started with Splunk Page 6 of 11 Highlightlefthandpane On the left,Ican see ALL the fields that were dynamicallyextractedand are available tome forsearchingand reportingpurposes. Splunkalso showsthe numberof unique valuesit foundforeverygivenfielditfound. -> Smart Mode You can alsoadjustSplunk’s “discoverymode”forfielddata extractionduringsearches. 7. Dynamic Field Extraction a Expand an Event, click on Event Actions -> Extract Fields b Extract the field after status code, should be the response size.  It will miss some, no worries, just highlight the values missed in events and add to extraction. 8. Alerts -> Save As -> Alert Now,if a serverrefusestorespondsto a usersrequest,status=403, Splunk can detectthat and alertusto it. ClickReal Time, Provide a Title,then clickNext I can choose to constantlymonitorfor thisinreal-time orto schedule this alertbasedon a varietyof frequencies.
  • 7. Getting Started with Splunk Page 7 of 11 Splunkprovidesflexiblenotification options,allowingyouto assign severity tothe Alert, toautomatically distribute anemail (orSMStext) and include outputinline orasan attachment. You can even domore advancedactionslike runa script native tothe OS Splunkrunsfor such thingsas mitigationorremediation.
  • 8. Getting Started with Splunk Page 8 of 11 9. Statistics and Reporting Search Bar -> buttercupgames status=403 → Statisticstab Splunkmakesgatheringstatisticsand reportinga snap. Let’sclickon the “Statistics”tab underneaththe search bar. -> Quick Reports You are presentedwiththreedifferent options. QuickReportsletsyouclick on anyfieldfora listof quickreports. -> uri_path To findoutthose webpages associatedwiththe serverfailingto respondtoa request,clickon uri_path. Here Splunkprovidesyou withdifferentreportingoptions:Top Values,TopValuesbyTime,etc. -> uri_path -> Top values ClickingonTopValuesIget a break downof the total numberof events associatedwiththe serverfailingto respond,brokendownperuri_pathor webpage. ->Bar -> Pie Reportingisagile,youcaneasily modifythe reportingvisualization. Maybe we wanta pie chart insteadof a bar chart,no problem. -> Save As -> Dashboard Panel  Fill inDashboardtitle  Enable “SharedinApp”for DashboardPermissions  Panel Title “FailuresbyWeb Page”  ClickSave
  • 9. Getting Started with Splunk Page 9 of 11  ClickViewDashboard Search -> Search Bar -> buttercupgames Clickon Statisticstab, choose Pivot. ClickOK. Splunkalsoallowsyoutobuildtables and visualizationsusingmultiple fields and metricswithoutwritingsearches. Pivotautomaticallygeneratesdata modelsbasedonyourdata, allowing youto pivotaroundyour data to extractstatisticsandreports. -> + (Nextto time filter), status, then match = 403 We can selectthe status attribute, thenenterina value of 403 SplitRows -> + -> uri_path, Add to Table We can splitthe numberof server refusedresponsesbyuri_path. Clickon Horizontal Bar Chart on reporting panel. We can leave the datain tabularform or simply choose another visualization. -> Save As -> Dashboard Panel -> Existing.
  • 10. Getting Started with Splunk Page 10 of 11 Make sure the previous Dashboard“ServerFailures” appears. Provide aModel Title and ID. ClickSave -> View Dashboard. 10. Command Language Search -> Search Bar -> buttercupgames| stats count by status Save As -> Report There are nearly140 search commandsthat can be appliedto data. Whensearchingdata you isolatedeventsyouare interestedin, thenapplySplunk’scommandsto transformdata, furtherreduce data sets,generate statisticsorperform analyticsonthe data. To dothiswe applya pipe character(|) thenissue the desiredcommand. I.e.If we wantedto geta countof all statuscodesfoundinour data, we can use the stats command,countall eventswithstatusvalues,thensplit the count by individual statusvalues. Letssave that as a report: Search Bar -> buttercupgames | stats count by status | where status=403 OR status=404 Save As -> Dashboard Maybe we’re onlyinterestedin403’s and 404’s? Noproblemletsjustuse a WHERE commandto isolate those. Cool. Let’smake thispart of a dashboard.
  • 11. Getting Started with Splunk Page 11 of 11 Search Bar -> buttercupgames | stats count, sparkline by uri_path | where status=403 OR status=404 In additiontocountingyoucan see trendinginformationbyaddinga sparkline commandtostats. Heck, letsevenbreakitdownbywebpage too. We’ll addthatour dashboard. Search Bar -> buttercupgames NOT status=200| timechart count by uri_path What if we want to see anyresponse that wasn’tOK, basicallyanynon200 code,and we like tosee an actual time distributionof those. The timechartfunctionhandlesthatquite nicely. Because Splunk’s reportingis agile youcan easilychange the visualizationonthe fly. Maybe want stack our valuesfora givenday. Totallycool! Letssave that to our dashboard. Search Bar -> buttercupgames NOT status=200 | iplocation clientip | geostats count Want to see where yourclientsare locatedencounteringthese browser requestsproblems,justuse the iplocationandgeostatscommands. Definitelywanttoaddthat to my dashboard! These are justa few waysto applythe over140 commandsavailable in Splunk. 11. Splunk Applications https://splunkbase.splunk.com The collectionsof these savedreports, dashboards,alerts,inputsettings,etc. iswhat Splunkreferstoas an Application. There are over600 readilyavailable applicationsonthe splunkbase website–meantto provide youinstantvalue byproviding prebuilddashboards,alerts,and reportsfor yourdatasources.