Splunk

Splunk Architecture

1. Universal Forwarders
2. Heavy Forwarders
3. Indexers
4. Search Heads

Roles in Splunk

Administrator : Can install apps and create knowledge objects  for all users
Power  : Can create and share knowledge objects for users of an app and do real time searches
User :Will only see their own knowledge objects  and those shared with them

Splunk base --> https://splunkbase.splunk.com/
App development course --> http://www.splunk.com/view/SP-CAAAH9P
Knowledge --> http://www.splunk.com/view/SP-CAAAH9E

Lab which was used --> http://wbtuse64.class.splunk.com/en-US/app/search/search#en-US/app/search/search

Splunk breaks data into events

The five major components of Splunk

a. Index Data (Collect and Index Data)
b. Search & Investigate
c. Add Knowledge
d. Monitor & Alert
e. Report & analyze


Heart of Splunk is Index Data


What is sourcetype in splunk?
Sourcetype is used to break the data into single events.

Search & Reporting App :

Default interface for searching and analyzing the data.
It enables to create
      a. Knowledge object
      b. Reports
      c. Dashboards

Expand Search
 wildcard * can be used

fil* fetch

fail
failed
failure

These can be used with multiple terms
AND
NOT
OR

If we want search with failed and not password then we use failed NOT password
If we want search with failed or password then we use failed OR password

 While searching in splunk we have the following
a. Selected fields
b. Interesting fields/Events

Selected Fields
    a. host
    b. source
    c. sourcetype

Naming convention --> http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Developnamingconventionsforknowledgeobjecttitles

Report acceleration --> http://docs.splunk.com/Splexicon:Reportacceleration

Search commands -- http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands

Search Report --> http://www.splunk.com/view/SP-CAAAH9C

Developer framework --> http://www.splunk.com/view/SP-CAAAH9C

Developer courses --> http://www.splunk.com/view/SP-CAAAH9P

alert manualling --> http://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts

Create knowledge Object Course --> http://www.splunk.com/view/SP-CAAAH9E