Splunk Operational Intelligence Cookbook电子书

Title Page

Copyright and Credits

Splunk Operational Intelligence Cookbook Third Edition

Packt Upsell

Why subscribe?

PacktPub.com

Contributors

About the authors

About the reviewer

Packt is searching for authors like you

Preface

Who this book is for

What this book covers

To get the most out of this book

Download the example code files

Conventions used

Sections

Getting ready

How to do it...

How it works...

There's more...

See also

Get in touch

Reviews

Play Time – Getting Data In

Introduction

Indexing files and directories

Getting ready

How to do it...

How it works...

There's more...

Adding a file or directory data input using the CLI

Adding a file or directory input using inputs.conf

One-time indexing of data files using the Splunk CLI

Indexing the Windows event logs

See also

Getting data through network ports

Getting ready

How to do it...

How it works...

There's more...

Adding a network input using the CLI

Adding a network input using inputs.conf

See also

Using scripted inputs

Getting ready

How to do it...

How it works...

See also

Using modular inputs

Getting ready

How to do it...

How it works...

There's more...

See also

Using the Universal Forwarder to gather data

Getting ready

How to do it...

How it works...

There's more...

Adding the receiving indexer via outputs.conf

Receiving data using the HTTP Event Collector

Getting ready

How to do it...

How it works...

Getting data from databases using DB Connect

Getting ready

How to do it...

How it works...

Loading the sample data for this book

Getting ready

How to do it...

How it works...

See also

Data onboarding – defining field extractions

Getting ready

How to do it...

How it works...

See also

Data onboarding - defining event types and tags

Getting ready

How to do it...

How it works...

There's more...

Adding event types and tags using eventtypes.conf and tags.conf

See also

Installing the Machine Learning Toolkit

Getting ready

How to do it...

How it works...

Diving into Data – Search and Report

Introduction

The Search Processing Language

Searching in Splunk

Boolean operators

Common commands

Time modifiers

Working with fields

Saving searches in Splunk

Making raw event data readable

Getting ready

How to do it...

How it works...

There's more...

Tabulating every field

Removing fields, then tabulating everything else

Finding the most accessed web pages

Getting ready

How to do it...

How it works...

There's more...

Searching for the top 10 accessed web pages

Searching for the most accessed pages by user

See also

Finding the most used web browsers

Getting ready

How to do it...

How it works...

There's more...

Searching for the web browser data for the most used OS types

See also

Identifying the top-referring websites

Getting ready

How to do it...

How it works...

There's more...

Searching for the top 10 using stats instead of top

See also

Charting web page response codes

Getting ready

How to do it...

How it works...

There's more...

Totaling success and error web page response codes

See also

Displaying web page response time statistics

Getting ready

How to do it...

How it works...

There's more...

Displaying web page response time by action

See also

Listing the top-viewed products

Getting ready

How to do it...

How it works...

There's more...

Searching for the percentage of cart additions from product views

See also

Charting the application's functional performance

Getting ready

How to do it...

How it works...

There's more...

See also

Charting the application's memory usage

Getting ready

How to do it...

How it works...

See also

Counting the total number of database connections

Getting ready

How to do it...

How it works...

See also

Dashboards and Visualizations - Make Data Shine

Introduction

About Splunk dashboards

Using dashboards for Operational Intelligence

Enriching data with visualizations

Available visualizations

Trellis layout

Best practices for visualizations

Creating an Operational Intelligence dashboard

Getting ready

How to do it...

How it works...

There's more...

Changing dashboard permissions

Using a pie chart to show the most accessed web pages

Getting ready

How to do it...

How it works...

There's more...

Searching for the top ten accessed web pages

See also

Displaying the unique number of visitors

Getting ready

How to do it...

How it works...

There's more...

Adding labels to a single value panel

Coloring the value based on ranges

Adding trends and sparklines to the values

See also

Using a gauge to display the number of errors

Getting ready

How to do it...

How it works...

There's more...

See also

Charting the number of method requests by type and host

Getting ready

How to do it...

How it works...

See also

Creating a timechart of method requests, views, and response times

Getting ready

How to do it...

How it works...

There's more...

Method requests, views, and response times by host

See also

Using a scatter chart to identify discrete requests by size and response time

Getting ready

How to do it...

How it works...

There's more...

Using time series data points with a scatter chart

See also

Creating an area chart of the application's functional statistics

Getting ready

How to do it...

How it works...

See also

Using metrics data and a trellis layout to monitor physical environment operating conditions

Getting ready

How to do it...

How it works...

See also

Using a bar chart to show the average amount spent by category

Getting ready

How to do it...

How it works...

See also

Creating a line chart of item views and purchases over time

Getting ready

How to do it...

How it works...

See also

Building an Operational Intelligence Application

Introduction

Creating an Operational Intelligence application

Getting ready

How to do it...

How it works...

There's more...

Creating an application from another application

Downloading and installing a Splunk app

See also

Adding dashboards and reports

Getting ready

How to do it...

How it works...

There's more...

Changing permissions of saved reports

See also

Organizing the dashboards more efficiently

Getting ready

How to do it...

How it works...

There's more...

Modifying the Simple XML directly

See also

Dynamically drilling down on activity reports

Getting ready

How to do it...

How it works...

There's more...

Disabling the drilldown feature in tables and charts

See also

Creating a form for searching web activity

Getting ready

How to do it...

How it works...

There's more...

Adding a Submit button to your form

See also

Linking web page activity reports to the form

Getting ready

How to do it...

How it works...

There's more...

Adding an overlay to the Sessions Over Time chart

See also

Displaying a geographical map of visitors

Getting ready

How to do it...

How it works...

There's more...

Adding a map panel using Simple XML

Mapping different distributions by area

See also

Highlighting average product price

Getting ready

How to do it...

How it works...

See also

Scheduling the PDF delivery of a dashboard

Getting ready

How to do it...

How it works...

See also

Extending Intelligence – Datasets, Modeling and Pivoting

Introduction

Creating a data model for web access logs

Getting ready

How to do it...

How it works...

There's more...

Viewing datasets using the dataset listing page

Searching datasets using the search interface

See also

Creating a data model for application logs

Getting ready

How to do it...

How it works...

See also

Accelerating data models

Getting ready

How to do it...

How it works...

There's more...

Viewing data model and acceleration summary information

Advanced configuration of data model acceleration

See also

Pivoting total sales transactions

Getting ready

How to do it...

How it works...

There's more...

Searching datasets using the pivot command

Searching accelerated datasets using the tstats command

See also

Pivoting purchases by geographic location

Getting ready

How to do it...

How it works...

See also

Pivoting slowest responding web pages

Getting ready

How to do it...

How it works...

See also

Pivot charting top error codes

Getting ready

How to do it...

How it works...

See also

Diving Deeper – Advanced Searching, Machine Learning and Predictive Analytics

Introduction

Identifying and grouping transactions

Converging data sources

Identifying relationships between fields

Predicting future values

Discovering anomalous values

Leveraging machine learning

Calculating the average session time on a website

Getting ready

How to do it...

How it works...

There's more...

Starts with a website visit, ends with a checkout

Defining maximum pause, span, and events in a transaction

See also

Calculating the average execution time for multi-tier web requests

Getting ready

How to do it...

How it works...

There's more...

Calculating the average execution time without using a join

See also

Displaying the maximum concurrent checkouts

Getting ready

How to do it...

How it works...

See also

Analyzing the relationship of web requests

Getting ready

How to do it...

How it works...

There's more...

Analyzing relationships of DB actions to memory utilization

See also

Predicting website traffic volumes

Getting ready

How to do it...

How it works...

There's more...

Create and apply a machine learning model of traffic over time

Predicting the total number of items purchased

Predicting the average response time of function calls

See also

Finding abnormally-sized web requests

Getting ready

How to do it...

How it works...

There's more...

The anomalies command

The anomalousvalue command

The anomalydetection command

The cluster command

See also

Identifying potential session spoofing

Getting ready

How to do it...

How it works...

There's more...

Creating logic for urgency

See also

Detecting outliers in server response times

Getting ready

How to do it...

How it works...

Forecasting weekly sales

Getting ready

How to do it...

How it works...

Summary

Enriching Data – Lookups and Workflows

Introduction

Lookups

Workflows

DB Connect

Looking up product code descriptions

Getting ready

How to do it...

How it works...

There's more...

Manually adding the lookup to Splunk

See also

Flagging suspect IP addresses

Getting ready

How to do it...

How it works...

There's more...

Modifying an existing saved search to populate a lookup table

See also

Creating a session state table

Getting ready

How to do it...

How it works...

There's more...

Use the Splunk KV store to maintain the session state table

See also

Adding hostnames to IP addresses

Getting ready

How to do it...

How it works...

There's more...

Enabling automatic external field lookups

See also

Searching ARIN for a given IP address

Getting ready

How to do it...

How it works...

There's more...

Limiting workflow actions by event types

See also

Triggering a Google search for a given error

Getting ready

How to do it...

How it works...

There's more...

Triggering a Google search from the chart drilldown options

See also

Generating a chat notification for application errors

Getting ready

How to do it...

How it works...

There's more...

Adding a workflow action manually in Splunk

See also

Looking up inventory from an external database

Getting ready

How to do it...

How it works...

There's more...

Using DB Connect for direct external DB lookups

See also

Being Proactive – Creating Alerts

Introduction

About Splunk alerts

Types of alert

Alert Trigger Conditions

Alert Trigger Actions

Alerting on abnormal web page response times

Getting ready

How to do it...

How it works...

There's more...

Viewing alerts in Splunk's Triggered Alert view

See also

Alerting on errors during checkout in real time

Getting ready

How to do it...

How it works...

There's more...

Building alerts via a configuration file

Editing alert configuration attributes using Advanced edit

Identify the real-time searches that are running

See also

Alerting on abnormal user behavior

Getting ready

How to do it...

How it works...

There's more...

Alerting on abnormal user purchases without checkouts

See also

Alerting on failure and triggering a chat notification

Getting ready

How to do it...

How it works...

There's more...

See also

Alerting when predicted sales exceed inventory

Getting ready

How to do it...

How it works...

See also

Generating alert events for high sensor readings

Getting ready

How to do it...

How it works...

There's more...

Speeding Up Intelligence – Data Summarization

Introduction

Data summarization

Data summarization methods

About summary indexing

How summary indexing helps

About report acceleration

The simplicity of report acceleration

Calculating an hourly count of sessions versus completed transactions

Getting ready

How to do it...

How it works...

There's more...

Generating the summary more frequently

Avoiding summary index overlaps and gaps

See also

Backfilling the number of purchases by city

Getting ready

How to do it...

How it works...

There's more...

Backfilling a summary index from within a search directly

See also

Displaying the maximum number of concurrent sessions over time

Getting ready

How to do it...

How it works...

There's more...

Viewing the status of an accelerated report and how

See also

Above and Beyond – Customization, Web Framework, HTTP Event Collector, REST API, and SDKs

Introduction

Web framework

REST API

Software development kits (SDKs)

HTTP Event Collector (HEC)

Customizing the application navigation

Getting ready

How to do it...

How it works...

There's more...

Adding a Sankey diagram of web hits

Getting ready

How to do it...

How it works...

There's more...

Changing the Sankey diagram options

See also

Developing a tag cloud of purchases by country

Getting ready

How to do it...

How it works...

There's More...

See also

Adding Cell Icons to Highlight Average Product Price

Getting ready

How to do it...

How it works...

See also

Remotely querying Splunk's REST API for unique page views

Getting ready

How to do it...

How it works...

There's more...

Authenticating with a session token

See also

Creating a Python application to return unique IP addresses

Getting ready

How to do it...

How it works...

There's more...

Paginating the results of your search

See also

Creating a custom search command to format product names

Getting ready

How to do it...

How it works...

See also

Collecting data from remote scanning devices

Getting ready

How to do it...

How it works...

See also

Other Books You May Enjoy

Leave a review - let other readers know what you think