Getting Started Getting Started With Splunk Enterprise
3 likes658 views
The document serves as a guide on getting started with Splunk Enterprise, detailing its mission to make machine data accessible and valuable. It includes a walkthrough for installing Splunk, collecting various types of data, and using its features for real-time analysis and reporting. Additionally, it provides resources for further support and a summary of troubleshooting common problems encountered during setup.
Getting Started Getting Started With Splunk Enterprise
- 1. Copyright © 2017 Splunk Inc. Getting Started with Splunk Enterprise Tomas Baublys Senior Sales Engineer [email protected]
- 3. 3 3 Make machine data accessible, usable and valuable to everyone. 3
- 4. 4 COLLECT DATA FROM ANYWHERE SEARCH AND ANALYZE EVERYTHING GAIN REAL-TIME OPERATIONAL INTELLIGENCE The Power of Splunk 4
- 5. 5 What is machine data? Challenges: Volume | Velocity | Variety | Variability GPS, RFID, Hypervisor, Web Servers, Email, Messaging, Clickstreams, Mobile, Telephony, IVR, Databases, Sensors, Telematics, Storage, Servers, Security Devices, Desktops 5 Splunk’s Mission: Making machine data accessible, usable and valuable to everyone.
- 6. 6 Machine data is not only “machine” data
- 7. 7 What Does Machine Data Look Like? Sources Order Processing Twitter Care IVR Middleware Error
- 8. 8 Machine Data Contains Critical Insights Customer ID Order ID Customer’s Tweet Time Waiting On Hold Twitter ID Product ID Company’s Twitter ID Customer ID Order ID Customer ID Sources Order Processing Twitter Care IVR Middleware Error
- 9. 9 Splunk Unlocks Critical Insights Order ID Customer’s Tweet Time Waiting On Hold Product ID Company’s Twitter ID Order ID Customer ID Twitter ID Customer ID Customer ID Sources Order Processing Twitter Care IVR Middleware Error
- 10. 10 THE Industry Leading Platform For Machine Data Machine Data: Any Location, Type, Volume Online Services Web Services Servers Security GPS Location Storage Desktops Networks Packaged Applications Custom ApplicationsMessaging Telecoms Online Shopping Cart Web Clickstreams Databases Energy Meters Call Detail Records Smartphones and Devices RFID On- Premises Private Cloud Public Cloud Platform Support (Apps / API / SDKs) Enterprise Scalability Universal Indexing Answer Any Question Developer Platform Report and analyze Custom dashboards Monitor and alert Ad hoc search Universal Machine Data Platform No backend database Schema-on-the-fly No need to filter data Quick time to value Agile reporting and analytics Real-time architecture
- 11. 11 Time to start SPLUNKING!!! SplunkLive! Presentations – http://splunklive.splunk.com/presentations.html Documentation – http://www.splunk.com/base/Documentation Technical Support – http://www.splunk.com/support Videos – http://www.splunk.com/videos Education – http://education.splunk.com Community – http://answers.splunk.com Splunk Book – http://splunkbook.com Where do I go for help?
- 12. 12 dev.splunk.com 40,000+ Q & A – answers.splunk.com 1,200+ apps splunkbase.splunk.com Thriving Splunk Community 12 usergroups.splunk.com
- 13. Copyright © 2015 Splunk Inc. Wrap-up/Q&A 1
- 14. Copyright © 2015 Splunk Inc. Appendix: Detailed Walkthrough
- 15. 15 Download Splunk Enterprise for your OS and Architecture.
- 16. 16 Unpack and start tar zxvf splunk-6.5.2- 67571ef4b87d-darwin-64.tgz splunk/bin/splunk start -- accept-license
- 18. 18 Text With Firefox, Chrome, or Safari – head to http://127.0.0.1:8000 . User=admin password=changeme
- 19. 19 You’ve successfully installed Splunk, and logged in! Let’s add the tutorialdata.zip via “Add Data”
- 20. 20 You can also “Add Data” from Settings at the top.
- 22. 22 Let’s drag tutorialdata.zip into “Drop your data file here”.
- 23. 23 Click Next
- 24. 24 Splunk can auto detect the sourcetype. Lets change host field to buttercup-web01, and then click Review.
- 25. 25 Looks good, click Submit.
- 26. 26 Let’s Start Searching our data.
- 27. 27 We’re brought into a search with filters applied to search the data we just uploaded.
- 28. 28 Let’s type “buttercupgames” in the search bar, and double click into a bar on the histogram.
- 29. 29 Notice the time picker changed with our drill into the histogram bar.
- 30. 30 Given that this data is web access, lets do a string search for 400, which is a “Bad Request” code. Notice that there’s 188 events returned. (number will vary for you).
- 31. 31 Lets also add 300 into the mix, and notice that my event count is higher now.
- 32. 32 We can see the 400 status codes, but not 300’s. That’s because the string search of 300 doesn’t explicitly search for status code of 300 – it’ll string match any event that contains “300”.
- 33. 33 Lets explicitly search for status codes equaling values we want to see returned.
- 34. 34 Great, we’re now returned all the events containing the two status codes we searched for. Click on “Top values by time”, which will build out a timechart for us.
- 35. 35 Notice how our search query changed, there’s a | (pipe), and a timechart command added. The pipe followed by a command allows further operation on your filtered data set.
- 36. 36 Let’s change our search to: buttercupgames status=* And – drill into one bar on the histogram.
- 37. 37 Click on “top values by time” under the status field on the left, which will produce the timechart above.
- 38. 38 Let’s exclude 200 status codes by adding AND status!=200, and change Line to Column.
- 39. 39 After changing from Line to Column, lets Stack the results (middle stack under Stack Mode). Much better!
- 40. 40 Lets now save this to a dashboard, a place we can go to view this search without having to remember what we had just searched for. Click Save AS -> Dashboard Panel. Fill in, and click Save. Then View dashboard.
- 41. 41 Click on Search to get us back to our search bar, and lets key in: buttercupgames. Development wants to know what web browsers are being used to access the site, but no fields currently exist. No problem – lets extract the browser field. Find an event that contains a value that you’re looking for, and click the “>” arrow just to the left of “Time”. The event will expand with a down arrow, and Extract Fields will be under Event Actions. Click Extract Fields.
- 42. 42 Click Regular Expression (Splunk will build a regular expression to extract our fields), and click next. Highlight the value of the field you’d like to create, and lets name the field: browser_type Click Add Extraction.
- 43. 43 Let’s verify that the extracted field contains values that are indeed types of browsers. Good, click next to proceed. Now, open the permissions to “App” which will allow users of the App the ability to leverage this extraction. Click Next.
- 44. 44 Success, Let’s explore the fields just created in search, by clicking the link.
- 45. 45 You’ll now be taken to search, with the filter set to the sourcetype that the field extraction has been applied to. Note – field extractions are coupled to a sourcetype. Click on “Top values”.
- 46. 46 Notice how the search changed. And, instead of a bar graph, we want a pie chart, so drop down the “bar” option and change it to Pie.
- 47. 47 Lets add this search to our dashboard, and then view the dashboard. Click Edit -> Edit Panels to drag the different panels to different positions.
- 48. 48 Let’s go back to search, and search for buttercupgames AND status!=200 (we want to see events that aren’t successful. Add the stats and where clause above, to return when there’s more than 100 unsuccessful status codes.
- 49. 49 Let’s create an alert. Save As -> Alert. Fill out the Title, Scheduled, Earliest + Latest, and Cron Expression (Instead of 48, change to minutes a few ahead of your current time. Ie. If it’s 9:00am, change to 05.
- 50. 50 Add to Triggered Alerts, and Save.
- 51. 51 You should see an alert trigger once your scheduled search runs at the cron expression you defined. *Note – it was mentioned that alerts wouldn’t work on a trial license. *Correction – alerts will work until the trial license expires.
- 52. 52 Let’s go back to search and: buttercupgames status=* | iplocation clientip We want to lookup the clientip values against the MaxMind database to pull in City, Country, State, Lat, Lon of the IPs.
- 53. 53 Now, business is interested in seeing plots on a map of web users and what they’re doing with the website. Lets append a geostats command that counts the events by the values of the action field. Pretty cool! This is definitely dashboard worthy! Lets add to dashboard.
- 54. 54 Awesome! Now we have a single pane of glass that Operations, Development, and Business all care about – from one data source! Talk about value!
- 55. 5 Thank You
- 56. Copyright © 2015 Splunk Inc. Installing & Using Splunk (Live Demonstration & Walkthrough)
- 57. 57 Set up Before You Can Play Get the following at splunk.com Download Splunk Enterprise https://www.splunk.com/download Dowload the Tutorial Data http://splk.it/2ey34P8 Dowload the lookup file http://splk.it/2fCgpXw Download the Search Tutorial http://splk.it/2ePSYKB
- 58. 58 IMPORT THE ZIP FILE, not individual files within it: http://www.splunkbook.com (sample data is located under ‘related links’ section) Log into Splunk – http://127.0.0.1:8000 username=admin password=changeme To add the file to Splunk: – Click Add Data – Click Upload files from my computer. – Drag and drop you sample data zip file. – Review and Finish. Getting Data into Splunk We will import sample web ecommerce store events
- 59. 59 Common problems at this point License expired (already had older version installed) – Close browser, empty cache, open browser. If that doesn’t work: – Stop Splunk. – Uninstall all Splunk versions Windows Control Panel->Uninstall programs->Splunk OS X. Finder->Applications->Right click Splunk, Move to trash – Reinstall – Start Splunk Can’t start Splunk – Windows, Search Control panel ->Services->Splunk start – Linux; cd <SPLUNK dir>/splunk/bin;./splunk start
- 60. Copyright © 2015 Splunk Inc. Let’s get our hands dirty!
- 61. 61 Searches used buttercupgames 4* buttercupgames status=4* buttercupgames status!=200 | top limit=20 status buttercupgames status !=200 | timechart count buttercupgames status!=200 | stats count by status | where count > 700 buttercupgames status=403 OR status=404 | stats count sparkline by uri_path buttercupgames status=404 | timechart count | trendline sma3(count) buttercupgames status!=200 | timechart count | predict count as predictedCount buttercupgames status!=200 | iplocation clientip | geostats count buttercupgames status!=200 | iplocation clientip | eval featureId=Country | stats count by featureId | geom geo_countries
- 62. 62 Dashboard
Editor's Notes
- #2: Intro Mention to people to start downloading Splunk
- #4: At Splunk, our mission is to make machine data accessible, usable and valuable to everyone. And this overarching mission is what drives our company and product priorities.
- #5: At it’s core, the Splunk platform enables you to: Collect data from anywhere – with universal forwarding and indexing technology. Search and analyze across all your data – with powerful search and schema-on-the-fly technology. Rapidly deliver real-time insights from machine data to IT and business people – through a powerful UI and dashboards. This is what we call Operational Intelligence.
- #6: What is machine data? Machine data is the definitive record of what’s happening or has happened in your technology infrastructure Often machine data is linked through common information or fields Valuable because it contains records of user behavior, infrastructure, application and service health and customer experience. All technology creates machine data and its projected to grow 40-60% compounded annually At the same time, these massive streams of data come in an array of unpredictable formats that are difficult to process and analyze in a timely manner by traditional methods (data warehouse in database)
- #7: http://www.stuff.co.nz/life-style/well-good/teach-me/71439165/are-we-taking-healthtracking-to-extremes http://www.dasinvestment.com/studie-zu-fitness-apps-jeder-zweite-deutsche-wuerde-fuer-geld-fitnessdaten-an-krankenversicherer-weitergeben/ http://www.idgconnect.com/abstract/14364/under-skin-implants-health-tracking-facebook-feed-brain http://fortune.com/2017/03/10/sex-toy-maker-settlement-smart-vibrator-lawsuit/
- #8: Machine data has lots of VARIETY and high volume. You’ll notice that machine data events are also typically time-stamped – or time-series data. Take this example of purchasing a product on your tablet or smartphone: the purchase transaction fails you call the call center then tweet about your experience all these events are captured as they occur in the machine data generated by the different systems supporting these different interactions. each of the underlying systems can generate millions of machine data events daily that can be very difficult to understand using traditional methods.
- #9: When we look more closely at the data we see that it contains valuable information – customer id, order id, time waiting on hold, twitter id … what was tweeted. If you can correlate and visualize related events across these disparate sources, you can build a picture of activity, behavior and experience. That’s exactly what Splunk is designed to do
- #10: And that’s exactly what Splunk empowers organizations to do. Correlating high volume machine data from disparate data sources in real-time without the need to transform the data so organizations can make more informed decisions at the pace of their business.
- #11: All of this is accomplished with: No backend database No custom connectors Without filtering data – no need to filter data for questions that you have now, index all your data to support questions that you’ll have in the future. Without knowing the questions before hand. While Providing a quick time to value With agile reporting and analytics All in real-time
- #13: Splunk has an active community: There is also an emerging ecosystem of new companies building apps on top of the Splunk Enterprise platform. These companies are taking advantage of open APIs and new platform capabilities to create an entirely new generation of applications. How many of you have used Splunk Answers? Our technical support is consistently rated as industry leading and Splunk Answers has answers to thousands of questions. It’s the go to place for your questions – and answers. You can participate in meet-ups and User Groups or you can contribute to our forums. You can also attend local SplunkLive events to hear how your peers are using machine data.