Splunk Operational Intelligence Cookbook

封面

版权信息

Packt Upsell

Why subscribe?

PacktPub.com

Contributors

About the authors

About the reviewer

Packt is searching for authors like you

Preface

Who this book is for

What this book covers

To get the most out of this book

Download the example code files

Conventions used

Sections

Getting ready

How to do it...

How it works...

There's more...

See also

Get in touch

Reviews

Play Time – Getting Data In

Introduction

Indexing files and directories

Getting ready

How to do it...

How it works...

There's more...

Adding a file or directory data input using the CLI

Adding a file or directory input using inputs.conf

One-time indexing of data files using the Splunk CLI

Indexing the Windows event logs

See also

Getting data through network ports

Getting ready

How to do it...

How it works...

There's more...

Adding a network input using the CLI

Adding a network input using inputs.conf

See also

Using scripted inputs

Getting ready

How to do it...

How it works...

See also

Using modular inputs

Getting ready

How to do it...

How it works...

There's more...

See also

Using the Universal Forwarder to gather data

Getting ready

How to do it...

How it works...

There's more...

Adding the receiving indexer via outputs.conf

Receiving data using the HTTP Event Collector

Getting ready

How to do it...

How it works...

Getting data from databases using DB Connect

Getting ready

How to do it...

How it works...

Loading the sample data for this book

Getting ready

How to do it...

How it works...

See also

Data onboarding – defining field extractions

Getting ready

How to do it...

How it works...

See also

Data onboarding - defining event types and tags

Getting ready

How to do it...

How it works...

There's more...

Adding event types and tags using eventtypes.conf and tags.conf

See also

Installing the Machine Learning Toolkit

Getting ready

How to do it...

How it works...

Diving into Data – Search and Report

Introduction

The Search Processing Language

Searching in Splunk

Boolean operators

Common commands

Time modifiers

Working with fields

Saving searches in Splunk

Making raw event data readable

Getting ready