SlideShare a Scribd company logo
1 of 52
© 2018 SPLUNK INC.© 2018 SPLUNK INC.
Splunk User Group Edinburgh
© 2018 SPLUNK INC.
Harry McLaren
● Alumnus of Edinburgh Napier (Active Mentor)
● Managing Consultant at ECS
● Leader of the Splunk User Group Edinburgh
© 2018 SPLUNK INC.
Introduction to ECS
Splunk Partner - UK
– Type: Security / IT Operations / Managed Services (SOC / Splunk)
– Awards: Splunk Revolution Award & Splunk Partner of the Year
© 2018 SPLUNK INC.
Agenda
• Housekeeping: Event Overview & House Rules
• Tstats, _internals and Me (Andrew McManus)
• Journey of a Splunk Trainer (Tom Wise)
• Development & Release Life-cycles with Splunk (Harry McLaren)
© 2018 SPLUNK INC.
Splunk [Official] User Group
“The overall goal is to create an authentic, ongoing
user group experience for our users, where
they contribute and get involved”
● Technical Discussions
● Sharing Environment
● Build Trust
● No Sales!
© 2018 SPLUNK INC.© 2018 SPLUNK INC.
| tstats, _internals and Me
Or How I Stopped Worrying About Expensive Search
Queries, and Learned to Love Interrogating the tsidx
Andrew McManus
© 2018 SPLUNK INC.
About Myself
● Associate Security Consultant at ECS
● Prior - Senior/Security Operations Center Analyst at ECS
● Credentials: Power User (Admin this weekend, hopefully)
● Current tasks at <redacted>: Troubleshooting configuration and
investigation.
© 2018 SPLUNK INC.
Why talk about this?
● No (Splunk) Environment is perfect.
– Scheduling, search run times, missing data sources
● Insight into environment required
● Internal logs provides insight into performance
● | tstats provides insight into data
● Combined, issues can be detected and squashed.
© 2018 SPLUNK INC.
What Splunk logs about itself?
● Splunk logs and indexes everything about itself
● _audit – user activity
– Login attempts, user searches, configuration changes
– Everything thrown together in one sourcetype, audittrail
● _internal – many sourcetypes containing various logs
– Scheduler logs, CPU/Mem usage, license usage and more.
– Sourcetype per log type.
– Events can have log_levels (INFO, WARN, ERROR)
● _introspection – system metrics.
– Per Process metrics
● _fishbucket – checkpoints for ingested files
© 2018 SPLUNK INC.
Scenario 1 – Licenser Issues
● Alert came in the prior day regarding your Licenser
● Don’t have access to DMC but _internal
● Use licenser logs to determine what data blew the license:
● Demo 1):
– index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" st=* | bucket _time span=1d | eventstats sum(b)
as total_used, values(poolsz) as limit by _time | eval over_limit=if(total_used>limit, "YES", "NO") | stats
sum(eval(b/1024/1024)) as mb values(over_limit) by st, _time
● (Can also check per_index_thruput metrics for indexers)
– index=_internal metrics kb series!=_* group="per_index_thruput" | eval indexed_GB = (kb / 1024 / 1024) | timechart
eval(round((sum(indexed_GB)),2)) as TotalGB fixedrange=t span=1d
© 2018 SPLUNK INC.
Scenario 2 – Missing Data
● Problem:
● Scheduled search gets data from number of logs w/ UTC timestamps
● Analyst notices that log source never shows up in search
● Search re-ran over same period the next day:
● Missing logs present when manually searched later than scheduled.
© 2018 SPLUNK INC.
Scenario 2 – Missing Data (cont)
● Investigation:
● Use _internal index to investigate scheduler logs to see
when search runs and what time-frame it scans.
– Or _audit
● Find events that aren’t indexed in time for search with tstats
© 2018 SPLUNK INC.
| tstats
● Uses tsidx files to report on:
– Indexed values
– Accelerated data models
● If field is not indexed, cannot be used in search
● Fast
● Seriously fast.
© 2018 SPLUNK INC.
Tsidx file
● Can use walklex to investigate what’s in a file.
– Returns unique id (term ID), how many times the term occurs and the term.
● Example:
© 2018 SPLUNK INC.
| tstats
● Can find event counts per index, sourcetype or source for
example.
● Metrics with indexing times can be determined.
● Fast stats on Accelerated Data Models can be determined in
seconds.
© 2018 SPLUNK INC.
Example – TSTATS count events by host
| stats countindex = main by host| tstats count where|tstats count where index=main by host, _time span=1h
© 2018 SPLUNK INC.
How Fast?
Without Tstats: 9.002s. With Tstats: 0.183s
48x decrease in time taken.
© 2018 SPLUNK INC.
Revisiting Scenario 2
● Using tstats, you can see every hour, events from source
comes in up to a hour later.
– | tstats earliest(_indextime) as it, latest(_indextime) as lit where index=<index>
sourcetype=<sourcetype> by source, _time span=1h | convert ctime(it) ctime(lit)
● This source is logging later than expected
– Another more complex search:
– | tstats earliest(_indextime) as earliest_indexed, latest(_indextime) as latest_indexed where index=<index>
sourcetype=<sourcetype> by source, _time span=1h | rename _time as time_window | join time_window [ search
index=_audit info=completed savedsearch_name=<savedsearch_name> | eval time_window=round(api_et,0) |
rename _time as search_time | table search_time time_window savedsearch_name] | eval data_missing =
if(latest_indexed>=search_time, "YES", "NO") | table savedsearch_name search_time time_window source
data_missing earliest_indexed latest_indexed | sort search_time source | convert ctime(search_time)
ctime(time_window) ctime(earliest_indexed) ctime(latest_indexed)
● Solution
● Change Scheduling for alert until after all logs come in.
© 2018 SPLUNK INC.
Other examples:
● Quick Glass pane view of event counts per index/host/source etc…
© 2018 SPLUNK INC.
Compare Event Counts to Run Times
© 2018 SPLUNK INC.
Scenario 1 in tstats?
● Internals by default appear to be put into a datamodel.
● index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" st=* | timechart
span=1h sum(eval(b/1024/1024/1024)) as gb by st
● Link: Search
● Or:
● | tstats sum(server.licenser.daily_usage.gb) as usage from datamodel=internal_server
where nodename=server.licenser.quota groupby server.st, _time span=1h
● Link: Search
© 2018 SPLUNK INC.
Further Reading
▶ .conf2017: Searching FAST: How to Start Using tstats and Other Acceleration Techniques -
David Veuve
• https://conf.splunk.com/files/2017/slides/searching-fast-how-to-start-using-tstats-and-other-
acceleration-techniques.pdf
• Covers Data Acceleration Models in greater detail.
▶ .conf2017: Worst Practices... And How To Fix Them - Jeff Champagne
• https://conf.splunk.com/files/2017/slides/worst-practicesand-how-to-fix-them.pdf
• (2016 the same content, except talks about Virtualisation)
© 2018 SPLUNK INC.
Any Questions?
● Have you made anything cool with tstats or _internal indexes?
Contact Me:
Andrew McManus – andrew.mcmanus@ecs.co.uk
Slack – On Splunk and SecurityScotland Slack Channels
My Journey
$ whoami
 Tom Wise
 Security Consultant & Splunk Specialist @ ECS
 Splunk Consultant II
 Splunk Architect II
 Splunk Trainer
Certifications….so far!
Accreditations…so far!
Splunk Accredited Sales Rep I
Splunk Accredited Sales Rep II
Splunk Accredited IT & App Sales Rep
Splunk Accredited Sales Engineer I
Splunk Accredited Implementation Fundamentals
Splunk Accredited Core Implementation
Splunk Accredited ES Implementation
Origin Story
 Every Splunk hero has one!
 Spanned 2 Continents
 Varsity Baby!
 Boom…Injury
 Return to roots.
 Man up & save the world one event at a time!
1st Foray into IT Wilderness
Space…the next frontier!
Personal Achievements
UK Challenge 2015
Lake District
6th / 60
Most Sporting Team
2015
Put that in your | and Splunk it!
 Started with ECS in June 2016
 Consultant II by November 2016
 ITSI Specialist since 2017
 Enterprise Security Implementation gained in 2018
 Splunk Trainer since January 2018
The Padawan to Master
 2 x Interviews with Heads of Splunk Training (US)
 Competence and Personality tested
 1 x Train the Trainer session
 Show the logistic tooling & processes
 Present a module to the Trainer
A Day in the Life…
 Access to the training center to confirm numbers and attendees.
 All pre-class actions are automated:
 Links to user watermarked documents sent to individuals & full list to trainer 2
days before the course.
 Lab credentials created and sent to instructor.
 WebEx session automatically configured ready to be joined.
 Question etiquette
 Best to save questions, unless pertinent to continuing, until at least after the 2nd
lab. Generally a lot of time is spent before and after first lab answering access
issues.
 Where possible ask the question to all participants as it will help in the learning
and is not as easy for the trainer to miss.
 Labs should be done in order as some activities rely on previous labs
being completed.
 However don’t rush! The labs do not need to be completed in the allotted
time, only before the entire course finishes.
 If in an office location, ensure that access over HTTPS and SSH is
available out of the network.
 If not then this can be worked around, but will take some time for the
instructor to implement.
 Test your access before the class (if possible)
Enablement
 This position allows me to:
 Offer more internal training along side the standard path.
 Provide Splunk training to ECS clients.
 Keep in touch with any changes coming in.
Tips
 Don’t eat yellow snow
 Install, Install, Install
 Until it is muscle memory
 Where possible script
 Helps develop logic and defensive coding practices.
 Always Best Practice in Labs & Exams!
 Implementing Best Practice even if not specifically asked can gain
additional points/kudos.
Questions?
© 2018 SPLUNK INC.
Development &
Release Cycles
Using SDLC for Controlled
Splunk-based Success
© 2018 SPLUNK INC.
Software Development Life Cycle
© 2018 SPLUNK INC.
Continuous Development, Deployment & Integration
“DevOps is a culture, and not a collection of technology or role”
© 2018 SPLUNK INC.
Splunk is “Agile” by Default
Search Processing Language (SPL)
Empowerment to Users
Web User Interface
Creation & Sharing of Knowledge Objects
© 2018 SPLUNK INC.
Where DIY Could Harm the Business
Security
• Tuning of Rules / Alerts
• Disabling of Saved Searches
IT
Monitoring
• Manually Setting Thresholds
• Forgetting Tactical Changes
Business
Analytics
• Changes to Business Logic
• Requirements Not Fully Understood
© 2018 SPLUNK INC.
▶ Local Work in Progress (WIP)
▶ Environment Specific Branches?
• Local > Dev > Test > Release
▶ Tags
▶ Integration into Workflow
Version Control
Systems (VCS)
© 2018 SPLUNK INC.
Configuration Management
● Manual vs. Automatic
● Agent & Agentless
● Actions, Roles, Groups
● Complemented by VCS
© 2018 SPLUNK INC.
Best of Both: Splunk Route-to-Live
New
Requirement
Create
Feature
in DevEnv
Commit to
Dev Branch
Validate /
Collect
Features
Merge into
Test Branch
Testing
Process in
TestEnv
Change /
Governance
Merge into
Prod Branch
Release into
ProdEnv
© 2018 SPLUNK INC.
Resources
● A Visual Guide to Version Control
● Version Control using Git and GitLab
● Deploying Splunk Securely with Ansible Config Management
● Configuration Management 101: Writing Ansible Playbooks
● What is DevOps?
● DevOps is a culture, not a role!
© 2018 SPLUNK INC.© 2018 SPLUNK INC.
Thank You
© 2018 SPLUNK INC.
Get Involved!
● Splunk User Group Edinburgh
– https://usergroups.splunk.com/group/splunk-user-group-edinburgh.html
– https://www.linkedin.com/groups/12013212
● Splunk’s Slack Group
– Register via http://splunk-usergroups.signup.team/
– Channel: #edinburgh
● Present & Share at the User Group?
Connect:
‣ Harry McLaren | harry.mclaren@ecs.co.uk | @cyberharibu | harrymclaren.co.uk
‣ ECS | enquiries@ecs.co.uk | @ECS_IT | ecs.co.uk
© 2018 SPLUNK INC.© 2018 SPLUNK INC.
Thank You

More Related Content

What's hot

8 Ocak 2015 SOME Etkinligi - BGA Cyber Security Incident Response Team
8 Ocak 2015 SOME Etkinligi - BGA Cyber Security Incident Response Team8 Ocak 2015 SOME Etkinligi - BGA Cyber Security Incident Response Team
8 Ocak 2015 SOME Etkinligi - BGA Cyber Security Incident Response TeamBGA Cyber Security
 
Building a Successful Threat Hunting Program
Building a Successful Threat Hunting ProgramBuilding a Successful Threat Hunting Program
Building a Successful Threat Hunting ProgramCarl C. Manion
 
Threat Hunting 102: Beyond the Basics
Threat Hunting 102: Beyond the BasicsThreat Hunting 102: Beyond the Basics
Threat Hunting 102: Beyond the BasicsCybereason
 
Cloud Breach – Preparation and Response
Cloud Breach – Preparation and ResponseCloud Breach – Preparation and Response
Cloud Breach – Preparation and ResponsePriyanka Aash
 
Soc 2030-socs-are-broken-lets-fix- them
Soc 2030-socs-are-broken-lets-fix- themSoc 2030-socs-are-broken-lets-fix- them
Soc 2030-socs-are-broken-lets-fix- themPriyanka Aash
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onSplunk
 
Insights from-NSAs-cybersecurity-threat-operations-center
Insights from-NSAs-cybersecurity-threat-operations-centerInsights from-NSAs-cybersecurity-threat-operations-center
Insights from-NSAs-cybersecurity-threat-operations-centerPriyanka Aash
 
ISACA 2019 Amman Chapter - Shah Sheikh - Cyber Resilience
ISACA 2019 Amman Chapter - Shah Sheikh - Cyber ResilienceISACA 2019 Amman Chapter - Shah Sheikh - Cyber Resilience
ISACA 2019 Amman Chapter - Shah Sheikh - Cyber ResilienceShah Sheikh
 
The Art and Science of Alert Triage
The Art and Science of Alert TriageThe Art and Science of Alert Triage
The Art and Science of Alert TriageSqrrl
 
Threat intel- -content-curation-organizing-the-path-to-successful-detection
Threat intel- -content-curation-organizing-the-path-to-successful-detectionThreat intel- -content-curation-organizing-the-path-to-successful-detection
Threat intel- -content-curation-organizing-the-path-to-successful-detectionPriyanka Aash
 
If We Only Had the Time: How Security Teams Can Focus On What’s Important
If We Only Had the Time: How Security Teams Can Focus On What’s ImportantIf We Only Had the Time: How Security Teams Can Focus On What’s Important
If We Only Had the Time: How Security Teams Can Focus On What’s ImportantNathan Burke
 
Best Practices for Scoping Infections and Disrupting Breaches
Best Practices for Scoping Infections and Disrupting BreachesBest Practices for Scoping Infections and Disrupting Breaches
Best Practices for Scoping Infections and Disrupting BreachesSplunk
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with SplunkSplunk
 
Partnership with a CFO: On the Front Line of Cybersecurity
Partnership with a CFO: On the Front Line of CybersecurityPartnership with a CFO: On the Front Line of Cybersecurity
Partnership with a CFO: On the Front Line of CybersecurityPriyanka Aash
 
DTS Solution - Company Presentation
DTS Solution - Company PresentationDTS Solution - Company Presentation
DTS Solution - Company PresentationShah Sheikh
 
How To Avoid The Top Ten Software Security Flaws
How To Avoid The Top Ten Software Security FlawsHow To Avoid The Top Ten Software Security Flaws
How To Avoid The Top Ten Software Security FlawsPriyanka Aash
 
Agile Security—Field of Dreams
Agile Security—Field of DreamsAgile Security—Field of Dreams
Agile Security—Field of DreamsPriyanka Aash
 
Extending Your Network Cloud Security to AWS
Extending Your Network Cloud Security to AWSExtending Your Network Cloud Security to AWS
Extending Your Network Cloud Security to AWSFidelis Cybersecurity
 
Tomorrow Starts Here - Security Everywhere
Tomorrow Starts Here - Security Everywhere Tomorrow Starts Here - Security Everywhere
Tomorrow Starts Here - Security Everywhere Cisco Canada
 

What's hot (20)

8 Ocak 2015 SOME Etkinligi - BGA Cyber Security Incident Response Team
8 Ocak 2015 SOME Etkinligi - BGA Cyber Security Incident Response Team8 Ocak 2015 SOME Etkinligi - BGA Cyber Security Incident Response Team
8 Ocak 2015 SOME Etkinligi - BGA Cyber Security Incident Response Team
 
Building a Successful Threat Hunting Program
Building a Successful Threat Hunting ProgramBuilding a Successful Threat Hunting Program
Building a Successful Threat Hunting Program
 
Threat Hunting 102: Beyond the Basics
Threat Hunting 102: Beyond the BasicsThreat Hunting 102: Beyond the Basics
Threat Hunting 102: Beyond the Basics
 
Cloud Breach – Preparation and Response
Cloud Breach – Preparation and ResponseCloud Breach – Preparation and Response
Cloud Breach – Preparation and Response
 
Pulling our-socs-up
Pulling our-socs-upPulling our-socs-up
Pulling our-socs-up
 
Soc 2030-socs-are-broken-lets-fix- them
Soc 2030-socs-are-broken-lets-fix- themSoc 2030-socs-are-broken-lets-fix- them
Soc 2030-socs-are-broken-lets-fix- them
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
 
Insights from-NSAs-cybersecurity-threat-operations-center
Insights from-NSAs-cybersecurity-threat-operations-centerInsights from-NSAs-cybersecurity-threat-operations-center
Insights from-NSAs-cybersecurity-threat-operations-center
 
ISACA 2019 Amman Chapter - Shah Sheikh - Cyber Resilience
ISACA 2019 Amman Chapter - Shah Sheikh - Cyber ResilienceISACA 2019 Amman Chapter - Shah Sheikh - Cyber Resilience
ISACA 2019 Amman Chapter - Shah Sheikh - Cyber Resilience
 
The Art and Science of Alert Triage
The Art and Science of Alert TriageThe Art and Science of Alert Triage
The Art and Science of Alert Triage
 
Threat intel- -content-curation-organizing-the-path-to-successful-detection
Threat intel- -content-curation-organizing-the-path-to-successful-detectionThreat intel- -content-curation-organizing-the-path-to-successful-detection
Threat intel- -content-curation-organizing-the-path-to-successful-detection
 
If We Only Had the Time: How Security Teams Can Focus On What’s Important
If We Only Had the Time: How Security Teams Can Focus On What’s ImportantIf We Only Had the Time: How Security Teams Can Focus On What’s Important
If We Only Had the Time: How Security Teams Can Focus On What’s Important
 
Best Practices for Scoping Infections and Disrupting Breaches
Best Practices for Scoping Infections and Disrupting BreachesBest Practices for Scoping Infections and Disrupting Breaches
Best Practices for Scoping Infections and Disrupting Breaches
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
Partnership with a CFO: On the Front Line of Cybersecurity
Partnership with a CFO: On the Front Line of CybersecurityPartnership with a CFO: On the Front Line of Cybersecurity
Partnership with a CFO: On the Front Line of Cybersecurity
 
DTS Solution - Company Presentation
DTS Solution - Company PresentationDTS Solution - Company Presentation
DTS Solution - Company Presentation
 
How To Avoid The Top Ten Software Security Flaws
How To Avoid The Top Ten Software Security FlawsHow To Avoid The Top Ten Software Security Flaws
How To Avoid The Top Ten Software Security Flaws
 
Agile Security—Field of Dreams
Agile Security—Field of DreamsAgile Security—Field of Dreams
Agile Security—Field of Dreams
 
Extending Your Network Cloud Security to AWS
Extending Your Network Cloud Security to AWSExtending Your Network Cloud Security to AWS
Extending Your Network Cloud Security to AWS
 
Tomorrow Starts Here - Security Everywhere
Tomorrow Starts Here - Security Everywhere Tomorrow Starts Here - Security Everywhere
Tomorrow Starts Here - Security Everywhere
 

Similar to TSTAS, the Life of a Splunk Trainer and using DevOps in Splunk Development

Agile Testing Analytics
Agile Testing AnalyticsAgile Testing Analytics
Agile Testing AnalyticsQASymphony
 
SplunkLive! Zurich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...
SplunkLive! Zurich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...SplunkLive! Zurich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...
SplunkLive! Zurich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...Splunk
 
Splunk Fundamentals: Investigations with Core Splunk - Splunk Tech Day
Splunk Fundamentals: Investigations with Core Splunk - Splunk Tech DaySplunk Fundamentals: Investigations with Core Splunk - Splunk Tech Day
Splunk Fundamentals: Investigations with Core Splunk - Splunk Tech DayZivaro Inc
 
SplunkLive! Frankfurt 2018 - Legacy SIEM to Splunk, How to Conquer Migration ...
SplunkLive! Frankfurt 2018 - Legacy SIEM to Splunk, How to Conquer Migration ...SplunkLive! Frankfurt 2018 - Legacy SIEM to Splunk, How to Conquer Migration ...
SplunkLive! Frankfurt 2018 - Legacy SIEM to Splunk, How to Conquer Migration ...Splunk
 
SplunkLive! Zurich 2018: Event Analytics
SplunkLive! Zurich 2018: Event AnalyticsSplunkLive! Zurich 2018: Event Analytics
SplunkLive! Zurich 2018: Event AnalyticsSplunk
 
Machine Data Is EVERYWHERE: Use It for Testing
Machine Data Is EVERYWHERE: Use It for TestingMachine Data Is EVERYWHERE: Use It for Testing
Machine Data Is EVERYWHERE: Use It for TestingTechWell
 
PSUG 1 - 2024-01-22 - Onboarding Best Practices
PSUG 1 - 2024-01-22 - Onboarding Best PracticesPSUG 1 - 2024-01-22 - Onboarding Best Practices
PSUG 1 - 2024-01-22 - Onboarding Best PracticesTomas Moser
 
Splunk Discovery: Warsaw 2018 - Legacy SIEM to Splunk, How to Conquer Migrati...
Splunk Discovery: Warsaw 2018 - Legacy SIEM to Splunk, How to Conquer Migrati...Splunk Discovery: Warsaw 2018 - Legacy SIEM to Splunk, How to Conquer Migrati...
Splunk Discovery: Warsaw 2018 - Legacy SIEM to Splunk, How to Conquer Migrati...Splunk
 
SplunkLive! Frankfurt 2018 - Integrating Metrics & Logs
SplunkLive! Frankfurt 2018 - Integrating Metrics & LogsSplunkLive! Frankfurt 2018 - Integrating Metrics & Logs
SplunkLive! Frankfurt 2018 - Integrating Metrics & LogsSplunk
 
Latest Updates to Splunk from .conf 2017 Announcements
Latest Updates to Splunk from .conf 2017 Announcements Latest Updates to Splunk from .conf 2017 Announcements
Latest Updates to Splunk from .conf 2017 Announcements Harry McLaren
 
Sumo Logic Cert Jam - Fundamentals
Sumo Logic Cert Jam - FundamentalsSumo Logic Cert Jam - Fundamentals
Sumo Logic Cert Jam - FundamentalsSumo Logic
 
Splunk .conf18 Updates, Config Add-on, SplDevOps
Splunk .conf18 Updates, Config Add-on, SplDevOpsSplunk .conf18 Updates, Config Add-on, SplDevOps
Splunk .conf18 Updates, Config Add-on, SplDevOpsHarry McLaren
 
Ssw forte-agile-seminar
Ssw forte-agile-seminarSsw forte-agile-seminar
Ssw forte-agile-seminarSSW
 
Learnings from Developing a New B2B SaaS Product (Suryaveer Lodha (Sunny) Pro...
Learnings from Developing a New B2B SaaS Product (Suryaveer Lodha (Sunny) Pro...Learnings from Developing a New B2B SaaS Product (Suryaveer Lodha (Sunny) Pro...
Learnings from Developing a New B2B SaaS Product (Suryaveer Lodha (Sunny) Pro...IT Arena
 
Splunk User Group Edinburgh - November Event
Splunk User Group Edinburgh - November EventSplunk User Group Edinburgh - November Event
Splunk User Group Edinburgh - November EventHarry McLaren
 
Splunk for Machine Learning and Analytics
Splunk for Machine Learning and AnalyticsSplunk for Machine Learning and Analytics
Splunk for Machine Learning and AnalyticsSplunk
 
Splunk User Group Edinburgh - September Event
Splunk User Group Edinburgh - September EventSplunk User Group Edinburgh - September Event
Splunk User Group Edinburgh - September EventHarry McLaren
 
GTRI Splunk Case Studies - Splunk Tech Day
GTRI Splunk Case Studies - Splunk Tech DayGTRI Splunk Case Studies - Splunk Tech Day
GTRI Splunk Case Studies - Splunk Tech DayZivaro Inc
 
SplunkLive! Munich 2018: Integrating Metrics and Logs
SplunkLive! Munich 2018: Integrating Metrics and LogsSplunkLive! Munich 2018: Integrating Metrics and Logs
SplunkLive! Munich 2018: Integrating Metrics and LogsSplunk
 

Similar to TSTAS, the Life of a Splunk Trainer and using DevOps in Splunk Development (20)

Agile scrum induction
Agile scrum inductionAgile scrum induction
Agile scrum induction
 
Agile Testing Analytics
Agile Testing AnalyticsAgile Testing Analytics
Agile Testing Analytics
 
SplunkLive! Zurich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...
SplunkLive! Zurich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...SplunkLive! Zurich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...
SplunkLive! Zurich 2018: Legacy SIEM to Splunk, How to Conquer Migration and ...
 
Splunk Fundamentals: Investigations with Core Splunk - Splunk Tech Day
Splunk Fundamentals: Investigations with Core Splunk - Splunk Tech DaySplunk Fundamentals: Investigations with Core Splunk - Splunk Tech Day
Splunk Fundamentals: Investigations with Core Splunk - Splunk Tech Day
 
SplunkLive! Frankfurt 2018 - Legacy SIEM to Splunk, How to Conquer Migration ...
SplunkLive! Frankfurt 2018 - Legacy SIEM to Splunk, How to Conquer Migration ...SplunkLive! Frankfurt 2018 - Legacy SIEM to Splunk, How to Conquer Migration ...
SplunkLive! Frankfurt 2018 - Legacy SIEM to Splunk, How to Conquer Migration ...
 
SplunkLive! Zurich 2018: Event Analytics
SplunkLive! Zurich 2018: Event AnalyticsSplunkLive! Zurich 2018: Event Analytics
SplunkLive! Zurich 2018: Event Analytics
 
Machine Data Is EVERYWHERE: Use It for Testing
Machine Data Is EVERYWHERE: Use It for TestingMachine Data Is EVERYWHERE: Use It for Testing
Machine Data Is EVERYWHERE: Use It for Testing
 
PSUG 1 - 2024-01-22 - Onboarding Best Practices
PSUG 1 - 2024-01-22 - Onboarding Best PracticesPSUG 1 - 2024-01-22 - Onboarding Best Practices
PSUG 1 - 2024-01-22 - Onboarding Best Practices
 
Splunk Discovery: Warsaw 2018 - Legacy SIEM to Splunk, How to Conquer Migrati...
Splunk Discovery: Warsaw 2018 - Legacy SIEM to Splunk, How to Conquer Migrati...Splunk Discovery: Warsaw 2018 - Legacy SIEM to Splunk, How to Conquer Migrati...
Splunk Discovery: Warsaw 2018 - Legacy SIEM to Splunk, How to Conquer Migrati...
 
SplunkLive! Frankfurt 2018 - Integrating Metrics & Logs
SplunkLive! Frankfurt 2018 - Integrating Metrics & LogsSplunkLive! Frankfurt 2018 - Integrating Metrics & Logs
SplunkLive! Frankfurt 2018 - Integrating Metrics & Logs
 
Latest Updates to Splunk from .conf 2017 Announcements
Latest Updates to Splunk from .conf 2017 Announcements Latest Updates to Splunk from .conf 2017 Announcements
Latest Updates to Splunk from .conf 2017 Announcements
 
Sumo Logic Cert Jam - Fundamentals
Sumo Logic Cert Jam - FundamentalsSumo Logic Cert Jam - Fundamentals
Sumo Logic Cert Jam - Fundamentals
 
Splunk .conf18 Updates, Config Add-on, SplDevOps
Splunk .conf18 Updates, Config Add-on, SplDevOpsSplunk .conf18 Updates, Config Add-on, SplDevOps
Splunk .conf18 Updates, Config Add-on, SplDevOps
 
Ssw forte-agile-seminar
Ssw forte-agile-seminarSsw forte-agile-seminar
Ssw forte-agile-seminar
 
Learnings from Developing a New B2B SaaS Product (Suryaveer Lodha (Sunny) Pro...
Learnings from Developing a New B2B SaaS Product (Suryaveer Lodha (Sunny) Pro...Learnings from Developing a New B2B SaaS Product (Suryaveer Lodha (Sunny) Pro...
Learnings from Developing a New B2B SaaS Product (Suryaveer Lodha (Sunny) Pro...
 
Splunk User Group Edinburgh - November Event
Splunk User Group Edinburgh - November EventSplunk User Group Edinburgh - November Event
Splunk User Group Edinburgh - November Event
 
Splunk for Machine Learning and Analytics
Splunk for Machine Learning and AnalyticsSplunk for Machine Learning and Analytics
Splunk for Machine Learning and Analytics
 
Splunk User Group Edinburgh - September Event
Splunk User Group Edinburgh - September EventSplunk User Group Edinburgh - September Event
Splunk User Group Edinburgh - September Event
 
GTRI Splunk Case Studies - Splunk Tech Day
GTRI Splunk Case Studies - Splunk Tech DayGTRI Splunk Case Studies - Splunk Tech Day
GTRI Splunk Case Studies - Splunk Tech Day
 
SplunkLive! Munich 2018: Integrating Metrics and Logs
SplunkLive! Munich 2018: Integrating Metrics and LogsSplunkLive! Munich 2018: Integrating Metrics and Logs
SplunkLive! Munich 2018: Integrating Metrics and Logs
 

More from Harry McLaren

Modern Security Operations & Common Roles/Competencies
Modern Security Operations & Common Roles/Competencies Modern Security Operations & Common Roles/Competencies
Modern Security Operations & Common Roles/Competencies Harry McLaren
 
Collecting AWS Logs & Introducing Splunk New S3 Compatible Storage (SmartStore)
Collecting AWS Logs & Introducing Splunk New S3 Compatible Storage (SmartStore) Collecting AWS Logs & Introducing Splunk New S3 Compatible Storage (SmartStore)
Collecting AWS Logs & Introducing Splunk New S3 Compatible Storage (SmartStore) Harry McLaren
 
Using Metrics for Fun, Developing with the KV Store + Javascript & News from ...
Using Metrics for Fun, Developing with the KV Store + Javascript & News from ...Using Metrics for Fun, Developing with the KV Store + Javascript & News from ...
Using Metrics for Fun, Developing with the KV Store + Javascript & News from ...Harry McLaren
 
SplDevOps: Making Splunk Development a Breeze With a Deep Dive on DevOps' Con...
SplDevOps: Making Splunk Development a Breeze With a Deep Dive on DevOps' Con...SplDevOps: Making Splunk Development a Breeze With a Deep Dive on DevOps' Con...
SplDevOps: Making Splunk Development a Breeze With a Deep Dive on DevOps' Con...Harry McLaren
 
Lessons on Human Vulnerability within InfoSec/Cyber
Lessons on Human Vulnerability within InfoSec/CyberLessons on Human Vulnerability within InfoSec/Cyber
Lessons on Human Vulnerability within InfoSec/CyberHarry McLaren
 
Big Data For Threat Detection & Response
Big Data For Threat Detection & ResponseBig Data For Threat Detection & Response
Big Data For Threat Detection & ResponseHarry McLaren
 
OWASP - Analyst, Engineer or Consultant?
OWASP - Analyst, Engineer or Consultant?OWASP - Analyst, Engineer or Consultant?
OWASP - Analyst, Engineer or Consultant?Harry McLaren
 
Cyber Scotland Connect: What is Security Engineering?
Cyber Scotland Connect: What is Security Engineering?Cyber Scotland Connect: What is Security Engineering?
Cyber Scotland Connect: What is Security Engineering?Harry McLaren
 
Cyber Scotland Connect: Getting into Cybersecurity (Deck 2)
Cyber Scotland Connect: Getting into Cybersecurity (Deck 2)Cyber Scotland Connect: Getting into Cybersecurity (Deck 2)
Cyber Scotland Connect: Getting into Cybersecurity (Deck 2)Harry McLaren
 
Cyber Scotland Connect: Getting into Cybersecurity (Deck 1)
Cyber Scotland Connect: Getting into Cybersecurity (Deck 1)Cyber Scotland Connect: Getting into Cybersecurity (Deck 1)
Cyber Scotland Connect: Getting into Cybersecurity (Deck 1)Harry McLaren
 
Cyber Scotland Connect: Welcome & Purpose Statement
Cyber Scotland Connect: Welcome & Purpose StatementCyber Scotland Connect: Welcome & Purpose Statement
Cyber Scotland Connect: Welcome & Purpose StatementHarry McLaren
 
Securing the Enterprise/Cloud with Splunk at the Centre
Securing the Enterprise/Cloud with Splunk at the CentreSecuring the Enterprise/Cloud with Splunk at the Centre
Securing the Enterprise/Cloud with Splunk at the CentreHarry McLaren
 
Security Meetup Scotland - August 2017 (Deconstructing SIEM)
Security Meetup Scotland - August 2017 (Deconstructing SIEM)Security Meetup Scotland - August 2017 (Deconstructing SIEM)
Security Meetup Scotland - August 2017 (Deconstructing SIEM)Harry McLaren
 
Supporting Splunk at Scale, Splunking at Home & Introduction to Enterprise Se...
Supporting Splunk at Scale, Splunking at Home & Introduction to Enterprise Se...Supporting Splunk at Scale, Splunking at Home & Introduction to Enterprise Se...
Supporting Splunk at Scale, Splunking at Home & Introduction to Enterprise Se...Harry McLaren
 
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics Harry McLaren
 
Splunk Dashboarding & Universal Vs. Heavy Forwarders
Splunk Dashboarding & Universal Vs. Heavy ForwardersSplunk Dashboarding & Universal Vs. Heavy Forwarders
Splunk Dashboarding & Universal Vs. Heavy ForwardersHarry McLaren
 

More from Harry McLaren (17)

Modern Security Operations & Common Roles/Competencies
Modern Security Operations & Common Roles/Competencies Modern Security Operations & Common Roles/Competencies
Modern Security Operations & Common Roles/Competencies
 
Collecting AWS Logs & Introducing Splunk New S3 Compatible Storage (SmartStore)
Collecting AWS Logs & Introducing Splunk New S3 Compatible Storage (SmartStore) Collecting AWS Logs & Introducing Splunk New S3 Compatible Storage (SmartStore)
Collecting AWS Logs & Introducing Splunk New S3 Compatible Storage (SmartStore)
 
Using Metrics for Fun, Developing with the KV Store + Javascript & News from ...
Using Metrics for Fun, Developing with the KV Store + Javascript & News from ...Using Metrics for Fun, Developing with the KV Store + Javascript & News from ...
Using Metrics for Fun, Developing with the KV Store + Javascript & News from ...
 
SplDevOps: Making Splunk Development a Breeze With a Deep Dive on DevOps' Con...
SplDevOps: Making Splunk Development a Breeze With a Deep Dive on DevOps' Con...SplDevOps: Making Splunk Development a Breeze With a Deep Dive on DevOps' Con...
SplDevOps: Making Splunk Development a Breeze With a Deep Dive on DevOps' Con...
 
Lessons on Human Vulnerability within InfoSec/Cyber
Lessons on Human Vulnerability within InfoSec/CyberLessons on Human Vulnerability within InfoSec/Cyber
Lessons on Human Vulnerability within InfoSec/Cyber
 
Big Data For Threat Detection & Response
Big Data For Threat Detection & ResponseBig Data For Threat Detection & Response
Big Data For Threat Detection & Response
 
OWASP - Analyst, Engineer or Consultant?
OWASP - Analyst, Engineer or Consultant?OWASP - Analyst, Engineer or Consultant?
OWASP - Analyst, Engineer or Consultant?
 
Cyber Scotland Connect: What is Security Engineering?
Cyber Scotland Connect: What is Security Engineering?Cyber Scotland Connect: What is Security Engineering?
Cyber Scotland Connect: What is Security Engineering?
 
Cyber Scotland Connect: Getting into Cybersecurity (Deck 2)
Cyber Scotland Connect: Getting into Cybersecurity (Deck 2)Cyber Scotland Connect: Getting into Cybersecurity (Deck 2)
Cyber Scotland Connect: Getting into Cybersecurity (Deck 2)
 
Cyber Scotland Connect: Getting into Cybersecurity (Deck 1)
Cyber Scotland Connect: Getting into Cybersecurity (Deck 1)Cyber Scotland Connect: Getting into Cybersecurity (Deck 1)
Cyber Scotland Connect: Getting into Cybersecurity (Deck 1)
 
Cyber Scotland Connect: Welcome & Purpose Statement
Cyber Scotland Connect: Welcome & Purpose StatementCyber Scotland Connect: Welcome & Purpose Statement
Cyber Scotland Connect: Welcome & Purpose Statement
 
Securing the Enterprise/Cloud with Splunk at the Centre
Securing the Enterprise/Cloud with Splunk at the CentreSecuring the Enterprise/Cloud with Splunk at the Centre
Securing the Enterprise/Cloud with Splunk at the Centre
 
Security Meetup Scotland - August 2017 (Deconstructing SIEM)
Security Meetup Scotland - August 2017 (Deconstructing SIEM)Security Meetup Scotland - August 2017 (Deconstructing SIEM)
Security Meetup Scotland - August 2017 (Deconstructing SIEM)
 
Deconstructing SIEM
Deconstructing SIEMDeconstructing SIEM
Deconstructing SIEM
 
Supporting Splunk at Scale, Splunking at Home & Introduction to Enterprise Se...
Supporting Splunk at Scale, Splunking at Home & Introduction to Enterprise Se...Supporting Splunk at Scale, Splunking at Home & Introduction to Enterprise Se...
Supporting Splunk at Scale, Splunking at Home & Introduction to Enterprise Se...
 
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics
Building Splunk Apps, Development Paths with Splunk & User Behaviour Analytics
 
Splunk Dashboarding & Universal Vs. Heavy Forwarders
Splunk Dashboarding & Universal Vs. Heavy ForwardersSplunk Dashboarding & Universal Vs. Heavy Forwarders
Splunk Dashboarding & Universal Vs. Heavy Forwarders
 

Recently uploaded

如何办理(UPenn毕业证书)宾夕法尼亚大学毕业证成绩单本科硕士学位证留信学历认证
如何办理(UPenn毕业证书)宾夕法尼亚大学毕业证成绩单本科硕士学位证留信学历认证如何办理(UPenn毕业证书)宾夕法尼亚大学毕业证成绩单本科硕士学位证留信学历认证
如何办理(UPenn毕业证书)宾夕法尼亚大学毕业证成绩单本科硕士学位证留信学历认证acoha1
 
Predictive Precipitation: Advanced Rain Forecasting Techniques
Predictive Precipitation: Advanced Rain Forecasting TechniquesPredictive Precipitation: Advanced Rain Forecasting Techniques
Predictive Precipitation: Advanced Rain Forecasting TechniquesBoston Institute of Analytics
 
NOAM AAUG Adobe Summit 2024: Summit Slam Dunks
NOAM AAUG Adobe Summit 2024: Summit Slam DunksNOAM AAUG Adobe Summit 2024: Summit Slam Dunks
NOAM AAUG Adobe Summit 2024: Summit Slam Dunksgmuir1066
 
社内勉強会資料_Object Recognition as Next Token Prediction
社内勉強会資料_Object Recognition as Next Token Prediction社内勉強会資料_Object Recognition as Next Token Prediction
社内勉強会資料_Object Recognition as Next Token PredictionNABLAS株式会社
 
Sensing the Future: Anomaly Detection and Event Prediction in Sensor Networks
Sensing the Future: Anomaly Detection and Event Prediction in Sensor NetworksSensing the Future: Anomaly Detection and Event Prediction in Sensor Networks
Sensing the Future: Anomaly Detection and Event Prediction in Sensor NetworksBoston Institute of Analytics
 
NO1 Best Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialist I...
NO1 Best Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialist I...NO1 Best Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialist I...
NO1 Best Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialist I...Amil baba
 
edited gordis ebook sixth edition david d.pdf
edited gordis ebook sixth edition david d.pdfedited gordis ebook sixth edition david d.pdf
edited gordis ebook sixth edition david d.pdfgreat91
 
如何办理英国卡迪夫大学毕业证(Cardiff毕业证书)成绩单留信学历认证
如何办理英国卡迪夫大学毕业证(Cardiff毕业证书)成绩单留信学历认证如何办理英国卡迪夫大学毕业证(Cardiff毕业证书)成绩单留信学历认证
如何办理英国卡迪夫大学毕业证(Cardiff毕业证书)成绩单留信学历认证ju0dztxtn
 
Audience Researchndfhcvnfgvgbhujhgfv.pptx
Audience Researchndfhcvnfgvgbhujhgfv.pptxAudience Researchndfhcvnfgvgbhujhgfv.pptx
Audience Researchndfhcvnfgvgbhujhgfv.pptxStephen266013
 
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...Valters Lauzums
 
Statistics Informed Decisions Using Data 5th edition by Michael Sullivan solu...
Statistics Informed Decisions Using Data 5th edition by Michael Sullivan solu...Statistics Informed Decisions Using Data 5th edition by Michael Sullivan solu...
Statistics Informed Decisions Using Data 5th edition by Michael Sullivan solu...ssuserf63bd7
 
How to Transform Clinical Trial Management with Advanced Data Analytics
How to Transform Clinical Trial Management with Advanced Data AnalyticsHow to Transform Clinical Trial Management with Advanced Data Analytics
How to Transform Clinical Trial Management with Advanced Data AnalyticsBrainSell Technologies
 
Credit Card Fraud Detection: Safeguarding Transactions in the Digital Age
Credit Card Fraud Detection: Safeguarding Transactions in the Digital AgeCredit Card Fraud Detection: Safeguarding Transactions in the Digital Age
Credit Card Fraud Detection: Safeguarding Transactions in the Digital AgeBoston Institute of Analytics
 
如何办理哥伦比亚大学毕业证(Columbia毕业证)成绩单原版一比一
如何办理哥伦比亚大学毕业证(Columbia毕业证)成绩单原版一比一如何办理哥伦比亚大学毕业证(Columbia毕业证)成绩单原版一比一
如何办理哥伦比亚大学毕业证(Columbia毕业证)成绩单原版一比一fztigerwe
 
如何办理(Dalhousie毕业证书)达尔豪斯大学毕业证成绩单留信学历认证
如何办理(Dalhousie毕业证书)达尔豪斯大学毕业证成绩单留信学历认证如何办理(Dalhousie毕业证书)达尔豪斯大学毕业证成绩单留信学历认证
如何办理(Dalhousie毕业证书)达尔豪斯大学毕业证成绩单留信学历认证zifhagzkk
 
Abortion Clinic in Randfontein +27791653574 Randfontein WhatsApp Abortion Cli...
Abortion Clinic in Randfontein +27791653574 Randfontein WhatsApp Abortion Cli...Abortion Clinic in Randfontein +27791653574 Randfontein WhatsApp Abortion Cli...
Abortion Clinic in Randfontein +27791653574 Randfontein WhatsApp Abortion Cli...mikehavy0
 
MATERI MANAJEMEN OF PENYAKIT TETANUS.ppt
MATERI  MANAJEMEN OF PENYAKIT TETANUS.pptMATERI  MANAJEMEN OF PENYAKIT TETANUS.ppt
MATERI MANAJEMEN OF PENYAKIT TETANUS.pptRachmaGhifari
 
一比一原版(Monash毕业证书)莫纳什大学毕业证成绩单如何办理
一比一原版(Monash毕业证书)莫纳什大学毕业证成绩单如何办理一比一原版(Monash毕业证书)莫纳什大学毕业证成绩单如何办理
一比一原版(Monash毕业证书)莫纳什大学毕业证成绩单如何办理pyhepag
 

Recently uploaded (20)

如何办理(UPenn毕业证书)宾夕法尼亚大学毕业证成绩单本科硕士学位证留信学历认证
如何办理(UPenn毕业证书)宾夕法尼亚大学毕业证成绩单本科硕士学位证留信学历认证如何办理(UPenn毕业证书)宾夕法尼亚大学毕业证成绩单本科硕士学位证留信学历认证
如何办理(UPenn毕业证书)宾夕法尼亚大学毕业证成绩单本科硕士学位证留信学历认证
 
Predictive Precipitation: Advanced Rain Forecasting Techniques
Predictive Precipitation: Advanced Rain Forecasting TechniquesPredictive Precipitation: Advanced Rain Forecasting Techniques
Predictive Precipitation: Advanced Rain Forecasting Techniques
 
Abortion pills in Riyadh Saudi Arabia (+966572737505 buy cytotec
Abortion pills in Riyadh Saudi Arabia (+966572737505 buy cytotecAbortion pills in Riyadh Saudi Arabia (+966572737505 buy cytotec
Abortion pills in Riyadh Saudi Arabia (+966572737505 buy cytotec
 
NOAM AAUG Adobe Summit 2024: Summit Slam Dunks
NOAM AAUG Adobe Summit 2024: Summit Slam DunksNOAM AAUG Adobe Summit 2024: Summit Slam Dunks
NOAM AAUG Adobe Summit 2024: Summit Slam Dunks
 
社内勉強会資料_Object Recognition as Next Token Prediction
社内勉強会資料_Object Recognition as Next Token Prediction社内勉強会資料_Object Recognition as Next Token Prediction
社内勉強会資料_Object Recognition as Next Token Prediction
 
123.docx. .
123.docx.                                 .123.docx.                                 .
123.docx. .
 
Sensing the Future: Anomaly Detection and Event Prediction in Sensor Networks
Sensing the Future: Anomaly Detection and Event Prediction in Sensor NetworksSensing the Future: Anomaly Detection and Event Prediction in Sensor Networks
Sensing the Future: Anomaly Detection and Event Prediction in Sensor Networks
 
NO1 Best Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialist I...
NO1 Best Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialist I...NO1 Best Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialist I...
NO1 Best Kala Jadu Expert Specialist In Germany Kala Jadu Expert Specialist I...
 
edited gordis ebook sixth edition david d.pdf
edited gordis ebook sixth edition david d.pdfedited gordis ebook sixth edition david d.pdf
edited gordis ebook sixth edition david d.pdf
 
如何办理英国卡迪夫大学毕业证(Cardiff毕业证书)成绩单留信学历认证
如何办理英国卡迪夫大学毕业证(Cardiff毕业证书)成绩单留信学历认证如何办理英国卡迪夫大学毕业证(Cardiff毕业证书)成绩单留信学历认证
如何办理英国卡迪夫大学毕业证(Cardiff毕业证书)成绩单留信学历认证
 
Audience Researchndfhcvnfgvgbhujhgfv.pptx
Audience Researchndfhcvnfgvgbhujhgfv.pptxAudience Researchndfhcvnfgvgbhujhgfv.pptx
Audience Researchndfhcvnfgvgbhujhgfv.pptx
 
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...
 
Statistics Informed Decisions Using Data 5th edition by Michael Sullivan solu...
Statistics Informed Decisions Using Data 5th edition by Michael Sullivan solu...Statistics Informed Decisions Using Data 5th edition by Michael Sullivan solu...
Statistics Informed Decisions Using Data 5th edition by Michael Sullivan solu...
 
How to Transform Clinical Trial Management with Advanced Data Analytics
How to Transform Clinical Trial Management with Advanced Data AnalyticsHow to Transform Clinical Trial Management with Advanced Data Analytics
How to Transform Clinical Trial Management with Advanced Data Analytics
 
Credit Card Fraud Detection: Safeguarding Transactions in the Digital Age
Credit Card Fraud Detection: Safeguarding Transactions in the Digital AgeCredit Card Fraud Detection: Safeguarding Transactions in the Digital Age
Credit Card Fraud Detection: Safeguarding Transactions in the Digital Age
 
如何办理哥伦比亚大学毕业证(Columbia毕业证)成绩单原版一比一
如何办理哥伦比亚大学毕业证(Columbia毕业证)成绩单原版一比一如何办理哥伦比亚大学毕业证(Columbia毕业证)成绩单原版一比一
如何办理哥伦比亚大学毕业证(Columbia毕业证)成绩单原版一比一
 
如何办理(Dalhousie毕业证书)达尔豪斯大学毕业证成绩单留信学历认证
如何办理(Dalhousie毕业证书)达尔豪斯大学毕业证成绩单留信学历认证如何办理(Dalhousie毕业证书)达尔豪斯大学毕业证成绩单留信学历认证
如何办理(Dalhousie毕业证书)达尔豪斯大学毕业证成绩单留信学历认证
 
Abortion Clinic in Randfontein +27791653574 Randfontein WhatsApp Abortion Cli...
Abortion Clinic in Randfontein +27791653574 Randfontein WhatsApp Abortion Cli...Abortion Clinic in Randfontein +27791653574 Randfontein WhatsApp Abortion Cli...
Abortion Clinic in Randfontein +27791653574 Randfontein WhatsApp Abortion Cli...
 
MATERI MANAJEMEN OF PENYAKIT TETANUS.ppt
MATERI  MANAJEMEN OF PENYAKIT TETANUS.pptMATERI  MANAJEMEN OF PENYAKIT TETANUS.ppt
MATERI MANAJEMEN OF PENYAKIT TETANUS.ppt
 
一比一原版(Monash毕业证书)莫纳什大学毕业证成绩单如何办理
一比一原版(Monash毕业证书)莫纳什大学毕业证成绩单如何办理一比一原版(Monash毕业证书)莫纳什大学毕业证成绩单如何办理
一比一原版(Monash毕业证书)莫纳什大学毕业证成绩单如何办理
 

TSTAS, the Life of a Splunk Trainer and using DevOps in Splunk Development

  • 1. © 2018 SPLUNK INC.© 2018 SPLUNK INC. Splunk User Group Edinburgh
  • 2. © 2018 SPLUNK INC. Harry McLaren ● Alumnus of Edinburgh Napier (Active Mentor) ● Managing Consultant at ECS ● Leader of the Splunk User Group Edinburgh
  • 3. © 2018 SPLUNK INC. Introduction to ECS Splunk Partner - UK – Type: Security / IT Operations / Managed Services (SOC / Splunk) – Awards: Splunk Revolution Award & Splunk Partner of the Year
  • 4. © 2018 SPLUNK INC. Agenda • Housekeeping: Event Overview & House Rules • Tstats, _internals and Me (Andrew McManus) • Journey of a Splunk Trainer (Tom Wise) • Development & Release Life-cycles with Splunk (Harry McLaren)
  • 5. © 2018 SPLUNK INC. Splunk [Official] User Group “The overall goal is to create an authentic, ongoing user group experience for our users, where they contribute and get involved” ● Technical Discussions ● Sharing Environment ● Build Trust ● No Sales!
  • 6. © 2018 SPLUNK INC.© 2018 SPLUNK INC. | tstats, _internals and Me Or How I Stopped Worrying About Expensive Search Queries, and Learned to Love Interrogating the tsidx Andrew McManus
  • 7. © 2018 SPLUNK INC. About Myself ● Associate Security Consultant at ECS ● Prior - Senior/Security Operations Center Analyst at ECS ● Credentials: Power User (Admin this weekend, hopefully) ● Current tasks at <redacted>: Troubleshooting configuration and investigation.
  • 8. © 2018 SPLUNK INC. Why talk about this? ● No (Splunk) Environment is perfect. – Scheduling, search run times, missing data sources ● Insight into environment required ● Internal logs provides insight into performance ● | tstats provides insight into data ● Combined, issues can be detected and squashed.
  • 9. © 2018 SPLUNK INC. What Splunk logs about itself? ● Splunk logs and indexes everything about itself ● _audit – user activity – Login attempts, user searches, configuration changes – Everything thrown together in one sourcetype, audittrail ● _internal – many sourcetypes containing various logs – Scheduler logs, CPU/Mem usage, license usage and more. – Sourcetype per log type. – Events can have log_levels (INFO, WARN, ERROR) ● _introspection – system metrics. – Per Process metrics ● _fishbucket – checkpoints for ingested files
  • 10. © 2018 SPLUNK INC. Scenario 1 – Licenser Issues ● Alert came in the prior day regarding your Licenser ● Don’t have access to DMC but _internal ● Use licenser logs to determine what data blew the license: ● Demo 1): – index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" st=* | bucket _time span=1d | eventstats sum(b) as total_used, values(poolsz) as limit by _time | eval over_limit=if(total_used>limit, "YES", "NO") | stats sum(eval(b/1024/1024)) as mb values(over_limit) by st, _time ● (Can also check per_index_thruput metrics for indexers) – index=_internal metrics kb series!=_* group="per_index_thruput" | eval indexed_GB = (kb / 1024 / 1024) | timechart eval(round((sum(indexed_GB)),2)) as TotalGB fixedrange=t span=1d
  • 11. © 2018 SPLUNK INC. Scenario 2 – Missing Data ● Problem: ● Scheduled search gets data from number of logs w/ UTC timestamps ● Analyst notices that log source never shows up in search ● Search re-ran over same period the next day: ● Missing logs present when manually searched later than scheduled.
  • 12. © 2018 SPLUNK INC. Scenario 2 – Missing Data (cont) ● Investigation: ● Use _internal index to investigate scheduler logs to see when search runs and what time-frame it scans. – Or _audit ● Find events that aren’t indexed in time for search with tstats
  • 13. © 2018 SPLUNK INC. | tstats ● Uses tsidx files to report on: – Indexed values – Accelerated data models ● If field is not indexed, cannot be used in search ● Fast ● Seriously fast.
  • 14. © 2018 SPLUNK INC. Tsidx file ● Can use walklex to investigate what’s in a file. – Returns unique id (term ID), how many times the term occurs and the term. ● Example:
  • 15. © 2018 SPLUNK INC. | tstats ● Can find event counts per index, sourcetype or source for example. ● Metrics with indexing times can be determined. ● Fast stats on Accelerated Data Models can be determined in seconds.
  • 16. © 2018 SPLUNK INC. Example – TSTATS count events by host | stats countindex = main by host| tstats count where|tstats count where index=main by host, _time span=1h
  • 17. © 2018 SPLUNK INC. How Fast? Without Tstats: 9.002s. With Tstats: 0.183s 48x decrease in time taken.
  • 18. © 2018 SPLUNK INC. Revisiting Scenario 2 ● Using tstats, you can see every hour, events from source comes in up to a hour later. – | tstats earliest(_indextime) as it, latest(_indextime) as lit where index=<index> sourcetype=<sourcetype> by source, _time span=1h | convert ctime(it) ctime(lit) ● This source is logging later than expected – Another more complex search: – | tstats earliest(_indextime) as earliest_indexed, latest(_indextime) as latest_indexed where index=<index> sourcetype=<sourcetype> by source, _time span=1h | rename _time as time_window | join time_window [ search index=_audit info=completed savedsearch_name=<savedsearch_name> | eval time_window=round(api_et,0) | rename _time as search_time | table search_time time_window savedsearch_name] | eval data_missing = if(latest_indexed>=search_time, "YES", "NO") | table savedsearch_name search_time time_window source data_missing earliest_indexed latest_indexed | sort search_time source | convert ctime(search_time) ctime(time_window) ctime(earliest_indexed) ctime(latest_indexed) ● Solution ● Change Scheduling for alert until after all logs come in.
  • 19. © 2018 SPLUNK INC. Other examples: ● Quick Glass pane view of event counts per index/host/source etc…
  • 20. © 2018 SPLUNK INC. Compare Event Counts to Run Times
  • 21. © 2018 SPLUNK INC. Scenario 1 in tstats? ● Internals by default appear to be put into a datamodel. ● index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" st=* | timechart span=1h sum(eval(b/1024/1024/1024)) as gb by st ● Link: Search ● Or: ● | tstats sum(server.licenser.daily_usage.gb) as usage from datamodel=internal_server where nodename=server.licenser.quota groupby server.st, _time span=1h ● Link: Search
  • 22. © 2018 SPLUNK INC. Further Reading ▶ .conf2017: Searching FAST: How to Start Using tstats and Other Acceleration Techniques - David Veuve • https://conf.splunk.com/files/2017/slides/searching-fast-how-to-start-using-tstats-and-other- acceleration-techniques.pdf • Covers Data Acceleration Models in greater detail. ▶ .conf2017: Worst Practices... And How To Fix Them - Jeff Champagne • https://conf.splunk.com/files/2017/slides/worst-practicesand-how-to-fix-them.pdf • (2016 the same content, except talks about Virtualisation)
  • 23. © 2018 SPLUNK INC. Any Questions? ● Have you made anything cool with tstats or _internal indexes? Contact Me: Andrew McManus – andrew.mcmanus@ecs.co.uk Slack – On Splunk and SecurityScotland Slack Channels
  • 25. $ whoami  Tom Wise  Security Consultant & Splunk Specialist @ ECS  Splunk Consultant II  Splunk Architect II  Splunk Trainer
  • 26.
  • 28. Accreditations…so far! Splunk Accredited Sales Rep I Splunk Accredited Sales Rep II Splunk Accredited IT & App Sales Rep Splunk Accredited Sales Engineer I Splunk Accredited Implementation Fundamentals Splunk Accredited Core Implementation Splunk Accredited ES Implementation
  • 29. Origin Story  Every Splunk hero has one!  Spanned 2 Continents  Varsity Baby!  Boom…Injury  Return to roots.  Man up & save the world one event at a time!
  • 30. 1st Foray into IT Wilderness
  • 33. UK Challenge 2015 Lake District 6th / 60 Most Sporting Team 2015
  • 34. Put that in your | and Splunk it!  Started with ECS in June 2016  Consultant II by November 2016  ITSI Specialist since 2017  Enterprise Security Implementation gained in 2018  Splunk Trainer since January 2018
  • 35. The Padawan to Master  2 x Interviews with Heads of Splunk Training (US)  Competence and Personality tested  1 x Train the Trainer session  Show the logistic tooling & processes  Present a module to the Trainer
  • 36. A Day in the Life…  Access to the training center to confirm numbers and attendees.  All pre-class actions are automated:  Links to user watermarked documents sent to individuals & full list to trainer 2 days before the course.  Lab credentials created and sent to instructor.  WebEx session automatically configured ready to be joined.  Question etiquette  Best to save questions, unless pertinent to continuing, until at least after the 2nd lab. Generally a lot of time is spent before and after first lab answering access issues.  Where possible ask the question to all participants as it will help in the learning and is not as easy for the trainer to miss.
  • 37.  Labs should be done in order as some activities rely on previous labs being completed.  However don’t rush! The labs do not need to be completed in the allotted time, only before the entire course finishes.  If in an office location, ensure that access over HTTPS and SSH is available out of the network.  If not then this can be worked around, but will take some time for the instructor to implement.  Test your access before the class (if possible)
  • 38. Enablement  This position allows me to:  Offer more internal training along side the standard path.  Provide Splunk training to ECS clients.  Keep in touch with any changes coming in.
  • 39. Tips  Don’t eat yellow snow  Install, Install, Install  Until it is muscle memory  Where possible script  Helps develop logic and defensive coding practices.  Always Best Practice in Labs & Exams!  Implementing Best Practice even if not specifically asked can gain additional points/kudos.
  • 41. © 2018 SPLUNK INC. Development & Release Cycles Using SDLC for Controlled Splunk-based Success
  • 42. © 2018 SPLUNK INC. Software Development Life Cycle
  • 43. © 2018 SPLUNK INC. Continuous Development, Deployment & Integration “DevOps is a culture, and not a collection of technology or role”
  • 44. © 2018 SPLUNK INC. Splunk is “Agile” by Default Search Processing Language (SPL) Empowerment to Users Web User Interface Creation & Sharing of Knowledge Objects
  • 45. © 2018 SPLUNK INC. Where DIY Could Harm the Business Security • Tuning of Rules / Alerts • Disabling of Saved Searches IT Monitoring • Manually Setting Thresholds • Forgetting Tactical Changes Business Analytics • Changes to Business Logic • Requirements Not Fully Understood
  • 46. © 2018 SPLUNK INC. ▶ Local Work in Progress (WIP) ▶ Environment Specific Branches? • Local > Dev > Test > Release ▶ Tags ▶ Integration into Workflow Version Control Systems (VCS)
  • 47. © 2018 SPLUNK INC. Configuration Management ● Manual vs. Automatic ● Agent & Agentless ● Actions, Roles, Groups ● Complemented by VCS
  • 48. © 2018 SPLUNK INC. Best of Both: Splunk Route-to-Live New Requirement Create Feature in DevEnv Commit to Dev Branch Validate / Collect Features Merge into Test Branch Testing Process in TestEnv Change / Governance Merge into Prod Branch Release into ProdEnv
  • 49. © 2018 SPLUNK INC. Resources ● A Visual Guide to Version Control ● Version Control using Git and GitLab ● Deploying Splunk Securely with Ansible Config Management ● Configuration Management 101: Writing Ansible Playbooks ● What is DevOps? ● DevOps is a culture, not a role!
  • 50. © 2018 SPLUNK INC.© 2018 SPLUNK INC. Thank You
  • 51. © 2018 SPLUNK INC. Get Involved! ● Splunk User Group Edinburgh – https://usergroups.splunk.com/group/splunk-user-group-edinburgh.html – https://www.linkedin.com/groups/12013212 ● Splunk’s Slack Group – Register via http://splunk-usergroups.signup.team/ – Channel: #edinburgh ● Present & Share at the User Group? Connect: ‣ Harry McLaren | harry.mclaren@ecs.co.uk | @cyberharibu | harrymclaren.co.uk ‣ ECS | enquiries@ecs.co.uk | @ECS_IT | ecs.co.uk
  • 52. © 2018 SPLUNK INC.© 2018 SPLUNK INC. Thank You

Editor's Notes

  1. http://splunk-usergroups.signup.team/