SplunkLive! Zurich 2017 - Getting Started with Splunk Enterprise
Download as PPTX, PDF1 like499 views
The document is a comprehensive guide for getting started with Splunk, covering installation, data setup, and basic search operations. It outlines steps to download the necessary software and tutorial data, and provides examples of search queries and how to create dashboards. Additionally, it includes information on Splunk education resources available for further learning.
More Related Content
Similar to SplunkLive! Zurich 2017 - Getting Started with Splunk Enterprise (20)
SplunkLive! Zurich 2017 - Getting Started with Splunk Enterprise
- 1. © 2017 SPLUNK INC.© 2017 SPLUNK INC. MAY 9, 2017 | ZURICH
- 2. © 2017 SPLUNK INC. Getting Started with Splunk Tomas Baublys | Senior Sales Engineer MAY 9, 2017 | ZURICH
- 3. © 2017 SPLUNK INC. 1. Download and install 2. Get tutorial data 3. Build dashboards Just start!
- 4. © 2017 SPLUNK INC. 4 Set up Before You Can Play Get the following at splunk.com Download Splunk Enterprise https://www.splunk.com/download Dowload the Tutorial Data http://splk.it/2ey34P8 Dowload the lookup file http://splk.it/2fCgpXw Download the Search Tutorial http://splk.it/2ePSYKB
- 5. © 2017 SPLUNK INC. LET’S GET OUR HANDS DIRTY
- 6. © 2017 SPLUNK INC.
- 7. © 2017 SPLUNK INC. Rebus puzzle:
- 8. © 2017 SPLUNK INC. FrozenWARM COLDHOT Index How the Data is Stored and Aged in Splunk Hot – Newest buckets of data that are still open for write Warm – Recent data but closed for writing (read only) Cold – Oldest data, commonly on cheaper, slower storage Frozen – No longer searchable, commonly archived or deleted data Optional TSIDX Reduction
- 9. © 2017 SPLUNK INC. 9 Searches used buttercupgames 4* buttercupgames status=4* buttercupgames status!=200 | top limit=20 status buttercupgames status !=200 | timechart count buttercupgames status!=200 | stats count by status | where count > 700 buttercupgames status=403 OR status=404 | stats count sparkline by uri_path buttercupgames status=404 | timechart count | trendline sma3(count) buttercupgames status!=200 | timechart count | predict count as predictedCount buttercupgames status!=200 | iplocation clientip | geostats count buttercupgames status!=200 | iplocation clientip | eval featureId=Country | stats count by featureId | geom geo_countries
- 10. © 2017 SPLUNK INC. 10 Dashboard
- 11. © 2017 SPLUNK INC. Splunk Demo Appendix: Detailed Walkthrough
- 12. © 2017 SPLUNK INC. 12 Download Splunk Enterprise for your OS and Architecture.
- 13. © 2017 SPLUNK INC. 13 Unpack and start tar zxvf splunk-6.5.2- 67571ef4b87d-darwin-64.tgz splunk/bin/splunk start -- accept-license
- 14. © 2017 SPLUNK INC. 14 Download turotialdata.zip http://docs.splunk.com/images/Tutorial/tutorialdata.zip http://www.splunk.com/goto/book
- 15. © 2017 SPLUNK INC. 15 Text With Firefox, Chrome, or Safari – head to http://127.0.0.1:8000 . User=admin password=c
- 16. © 2017 SPLUNK INC. 16 You’ve successfully installed Splunk, and logged in! Let’s add the tutorialdata.zip via “
- 17. © 2017 SPLUNK INC. 17 You can also “Add Data” from Settings at the top.
- 18. © 2017 SPLUNK INC. 18 Click on upload.
- 19. © 2017 SPLUNK INC. 19 Let’s drag tutorialdata.zip into “Drop your data file here”.
- 20. © 2017 SPLUNK INC. 20 Click Next
- 21. © 2017 SPLUNK INC. 21 Splunk can auto detect the sourcetype. Lets change host field to buttercup-web01, and th
- 22. © 2017 SPLUNK INC. 22 Looks good, click Submit.
- 23. © 2017 SPLUNK INC. 23 Let’s Start Searching our data.
- 24. © 2017 SPLUNK INC. 24 We’re brought into a search with filters applied to search the data we just upload
- 25. © 2017 SPLUNK INC. 25 Let’s type “buttercupgames” in the search bar, and double click into a bar on the histogram.
- 26. © 2017 SPLUNK INC. 26 Notice the time picker changed with our drill into the histogram bar.
- 27. © 2017 SPLUNK INC. 27 Given that this data is web access, lets do a string search for 400, which is a “Bad Requ Notice that there’s 188 events returned. (number will vary for you).
- 28. © 2017 SPLUNK INC. 28 Lets also add 300 into the mix, and notice that my event count is higher now.
- 29. © 2017 SPLUNK INC. 29 We can see the 400 status codes, but not 300’s. That’s because the string search of 300 d search for status code of 300 – it’ll string match any event that contains “300”.
- 30. © 2017 SPLUNK INC. 30 Lets explicitly search for status codes equaling values we want to see return
- 31. © 2017 SPLUNK INC. 31 Great, we’re now returned all the events containing the two status codes we search Click on “Top values by time”, which will build out a timechart for us.
- 32. © 2017 SPLUNK INC. 32 Notice how our search query changed, there’s a | (pipe), and a timechart comman The pipe followed by a command allows further operation on your filtered data set
- 33. © 2017 SPLUNK INC. 33 Let’s change our search to: buttercupgames status=* And – drill into one bar on the histogram.
- 34. © 2017 SPLUNK INC. 34 Click on “top values by time” under the status field on the left, which will produce the timechart above.
- 35. © 2017 SPLUNK INC. 35 Let’s exclude 200 status codes by adding AND status!=200, and change Line to Column.
- 36. © 2017 SPLUNK INC. 36 After changing from Line to Column, lets Stack the results (middle stack under Stack Mo
- 37. © 2017 SPLUNK INC. 37 Lets now save this to a dashboard, a place we can go to view this search without having t remember what we had just searched for. Click Save AS -> Dashboard Panel. Fill in, and click Save.
- 38. © 2017 SPLUNK INC. 38 Click on Search to get us back to our search bar, and lets key in: buttercupgames. Development wants to know what web browsers are being used to access the site, but no fields currently exist. No problem – lets extract the browser field. Find an event that contains a value that you’re looking for, and click the “>” arrow just to the left of “Time”. The event will expand with a down arrow, and Extract Fields will be under Event Actions. Click Extract Fields.
- 39. © 2017 SPLUNK INC. 39 Click Regular Expression (Splunk will build a regular expression to extract our fields), and click next. Highlight the value of the field you’d like to create, and lets name the field: browser_type Click Add Extraction.
- 40. © 2017 SPLUNK INC. 40 Let’s verify that the extracted field contains values that are indeed types of browsers. Good, click next to proceed. Now, open the permissions to “App” which will allow users of the App the ability to leverage this extraction.
- 41. © 2017 SPLUNK INC. 41 Success, Let’s explore the fields just created in search, by clicking the link.
- 42. © 2017 SPLUNK INC. 42 You’ll now be taken to search, with the filter set to the sourcetype that the field extraction has been applied to. Note – field extractions are coupled to a sourcetype. Click on “Top values”.
- 43. © 2017 SPLUNK INC. 43 Notice how the search changed. And, instead of a bar graph, we want a pie chart, so drop down the “bar” option and change it to Pie.
- 44. © 2017 SPLUNK INC. 44 Lets add this search to our dashboard, and then view the dashboard. Click Edit -> Edit Panels to drag the different panels to
- 45. © 2017 SPLUNK INC. 45 Let’s go back to search, and search for buttercupgames AND status!=200 (we want to see events that aren’t successful. Add the stats and where clause above, to return when there’s more than 100 unsuccessful status codes.
- 46. © 2017 SPLUNK INC. 46 Let’s create an alert. Save As -> Alert. Fill out the Title, Scheduled, Earliest + Latest, and Cron Expression (Instead of 48, change to minutes a few ahead of your current time. Ie. If it’s 9:00am, change to 05.
- 47. © 2017 SPLUNK INC. 47 Add to Triggered Alerts, and Save.
- 48. © 2017 SPLUNK INC. 48 You should see an alert trigger once your scheduled search runs at the cron expression you defined. *Note – it was mentioned that alerts wouldn’t work on a trial license. *Correction – alerts
- 49. © 2017 SPLUNK INC. 49 Let’s go back to search and: buttercupgames status=* | iplocation clientip We want to lookup the clientip values against the MaxMind database to pull in City, Country, State, Lat, Lon of the IPs.
- 50. © 2017 SPLUNK INC. 50 Now, business is interested in seeing plots on a map of web users and what they’re doing with the website. Lets append a geostats command that counts the events by the values of the action
- 51. © 2017 SPLUNK INC. 51 Awesome! Now we have a single pane of glass that Operations, Development, and Business all care about – from one data source! Talk about value!
- 52. © 2017 SPLUNK INC. 52 MY TIME
- 53. © 2017 SPLUNK INC. Take the Survey on Pony Poll ponypoll.com/zurich2017
- 54. © 2017 SPLUNK INC. Get Started Fast! splunk.com/education
- 55. © 2017 SPLUNK INC. Splunk Fundamentals 1. Coming in Summer 2017. Also available at Splunk University, .conf2017 Course Topics Introduction to Splunk's interface Basic searching Using fields in searches Search fundamentals Transforming commands Creating reports and dashboards Datasets The Common Information Model (CIM) Creating and using lookups Scheduled Reports Alerts Using Pivot https://www.splunk.com/view/SP-CAAAPX9
- 56. © 2017 SPLUNK INC. Become a Splunk Expert Knowledge is Power Using Splunk Searching and Reporting with Splunk Creating Splunk Knowledge Objects Splunk Administration Architecting and Deploying Splunk Developing Apps with Splunk Splunk Architect Certification Lab
- 57. © 2017 SPLUNK INC. Splunk Education for Security Knowledge is Power Using Splunk Searching and Reporting with Splunk Creating Splunk Knowledge Objects Using the Splunk App for Enterprise Security Splunk Administration Architecting and Deploying Splunk Administering the Splunk App for Enterprise Security
- 58. © 2017 SPLUNK INC. Splunk Education for IT Service Intelligence Knowledge is Power Using Splunk Searching and Reporting with Splunk Creating Splunk Knowledge Objects Splunk Administration Implementing IT Service Intelligence
- 59. © 2017 SPLUNK INC. Course Topics • Overview of ITSI features • ITSI architecture and deployment • Installing ITSI • Designing and implementing services and entities • Configuring correlation searches and notable events • Creating deep dive pages • Creating glass tables • ITSI troubleshooting Splunk Education for IT Service Intelligence Knowledge is Power
- 60. © 2017 SPLUNK INC. Splunk Education for IT Service Intelligence Knowledge is Power Course Topics • Overview of ITSI features • ITSI architecture and deployment • Installing ITSI • Designing and implementing services and entities • Configuring correlation searches and notable events • Creating deep dive pages • Creating glass tables • ITSI troubleshooting PREREQUISITES | 13.5 hour course Using Splunk, Searching and Reporting with Splunk, Creating Splunk Knowledge Objects, Splunk Administration
Editor's Notes
- #9: As the data ages it will transition between hot, warm, and cold buckets. Each index can be configured to move the data based on amount of disk used or the age of the data. For example, there may be a mandate to keep security data for 7 years, but only the last year is ever really searched. The data older than a year can be sent to cheaper disks (or even archived on tape). TSIDX Reduction (Optional) – For more information see Slide 42 in the Appendix. In 6.4 Users have the ability to reduce Splunk performance optimization data (TSIDX) files – yielding a smaller footprint. 40-80% reduction in data footprint No functionality loss Limited performance tradeoff
- #55: Are you looking to learn, share, and participate with other Splunk users? Visit usergroups.splunk.com, search for <<City Name>>, and join the local user group to receive updates on upcoming meetings! We will also provide you with a link to the group in the SplunkLive! Follow-up email.
- #56: https://www.splunk.com/view/SP-CAAAPX9
- #57: Certification 8 Certification Tracks - Title list chart with checks Image / website
- #58: Certification 8 Certification Tracks - Title list chart with checks Image / website
- #59: Certification 8 Certification Tracks - Title list chart with checks Image / website
- #60: Course Topics Overview of ITSI features ITSI architecture and deployment Installing ITSI Designing and implementing services and entities Configuring correlation searches and notable events Creating deep dive pages Creating glass tables ITSI troubleshooting
- #61: Course Topics Overview of ITSI features ITSI architecture and deployment Installing ITSI Designing and implementing services and entities Configuring correlation searches and notable events Creating deep dive pages Creating glass tables ITSI troubleshooting