This book teaches you how to work with Splunk, a popular application for searching, monitoring, and analyzing machine-generated data. This product can index structured or unstructured textual machine-generated data and enables you to perform real-time and historical search, as well as reports and statistical analysis.
You will learn how to download and install Splunk on your Windows or Linux system. You will learn how to collect logs from a local or remote computers, and how to search them using a web-based interface. You will also find out how to create alerts and reports based on the Splunk searches. Here is a list of topics covered in this book:
- Chapter 1 - Introduction - we will describe what Splunk is and what are some of its common features. We will describe how you can install Splunk on Windows and Linux.
- Chapter 2 - First steps - we will show you how you can acccess Splunk Web using your web browser. We will describe some common Splunk's data sources, what an index in Splunk is, and how to add data to Splunk.
- Chapter 3 - Searching overview - we will describe how you can search the data Splunk indexed. We will explain the basic search rules and how to work with Splunk search commands.
- Chapter 4 - Windows logs - we will explain how you can add Windows logs to Splunk from a local machine. We will describe how you can collect host information, such as CPU and memory usage.
- Chapter 5 - Universal forwarders - we will describe universal forwarders, which are dedicated, lightweight version of Splunk that contain only the essential components needed to send data. We will describe how to install and set up forwarders on remote Linux and Windows hosts and send data to Splunk.
- Chapter 6 - Alerting and reporting - we will describe how you can create Splunk alerts. We will also describe how to create and share Splunk reports.
