Ch. 1 Splunk Intro

  • Machine Data - raw data from servers, network devices, and web apps

  • Splunk Index - Repository for event data (i.e. Machine Data that has been processed)

    • Source Type - Data classification for Machine Data in Splunk index in order to determine how data will be processed

    • Data Transformation - Once a source type is assigned data is normalized and ingested into the index, which then allows the Data Ingestion - After data transformation, the data is ingested into Index which then becomes Event Data that can be queried and analyzed

    • Factory Analogy - Index is a factory and the machine data is the raw materials that are inspected and processed

  • Splunk Search Bar - This is where you enter a query in order to pull data from Index

  • Splunk Report - Queries from Splunk Search Bar can be saved as reports

    • Functionality: Can be scheduled, and control who has read and write permissions based on user group

  • Dashboard & Panels - Data visualization tool for Splunk Reports

    • Functionality: you can save a dashboard (i.e. graph) just like a report

  • Data Model - Structured datasets from Knowledge

  • Pivot - Data visualization tool for Data Models

  • Alerts - Trigger creation tool, and set triggers based on data processing pipeline

  • Knowledge Object - user defined entity that enriches existing data inside Splunk.

    • Ex. saved search, reports event types, tags, data models, etc.

  • Splunk App - preconfigured environment on top of your Splunk Instance. They are similar to workspaces built to solve a specific user case

  • Splunk Enterprise Default Roles

    • Admin - install apps, ingest data, and create knowledge objects

    • Power - share knowledge objects, perform searches in Search Bar

    • User - only see their own knowledge object and those that have been shared with them

  • Data Summary

    • Sources - location of event data data

    • Hosts - Hostname, IP address, or Domain Name of the system where the event (i.e. Machine Data) origination from

  • Search Bar Best Practice Time - adding a time range to a query improves performance

  • Wildcard Search - add to then end of term (ex. Fail*) will return all events that start with term

  • Commands - Splunk Search Language

    • Example: replace, and, or, not

    • Transformation Commands - commands that create statistics and visualization, by transforming event data into data tables

  • Knowledge Object Pt. 2 - Splunk tools that help discover and analyze data.

  • 5 Classifications of Knowledge Objects

    • Data Interpretation

      • fields - ex. product_name

      • field extraction

      • calculated fields

    • Data Classification

      • event types - categorize events based on search terms

      • transactions - groupings of conceptually related events that span time

    • Data Enrichment

      • lookups - add other fields or values to your events not included in the index data

      • workflow actions - create links within events that interact with external resources or narrow our search

    • Data Normalization

      • tags - create descriptive names for key value pairs, i.e. labels for your data

      • field aliases - normalize data over multiple sources

    • Data Models

      • hierarchal structured data sets that are composed of events, searches, and transactions

  • Knowledge Object Use Cases - Created, shared, saved, and reusable