封面
版权信息
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Chapter 1. The Splunk Interface
Logging into Splunk
The home app
The top bar
The search & reporting app
Using the time picker
Using the field picker
The settings section
Summary
Chapter 2. Understanding Search
Using search terms effectively
Boolean and grouping operators
Clicking to modify your search
Using fields to search
Using wildcards efficiently
All about time
Making searches faster
Sharing results with others
Search job settings
Saving searches for reuse
Creating alerts from searches
Summary
Chapter 3. Tables Charts and Fields
About the pipe symbol
Using top to show common field values
Using stats to aggregate values
Using chart to turn data
Using timechart to show values over time
Working with fields
Summary
Chapter 4. Data Models and Pivots
What is a data model?
What does a data model search?
Creating a data model
Lookup attributes
What is a pivot?
A quick example
Sparklines
Summary
Chapter 5. Simple XML Dashboards
The purpose of dashboards
Using wizards to build dashboards
Converting the panel to a report
Back to the dashboard
Editing XML directly
UI examples app
Building forms
Features replaced
Autorun dashboard
Scheduling the generation of dashboards
Summary
Chapter 6. Advanced Search Examples
Using subsearches to find loosely related events
Using transaction
Determining concurrency
Calculating events per slice of time
Rebuilding top
Acceleration
Summary
Chapter 7. Extending Search
Using tags to simplify search
Using event types to categorize results
Using lookups to enrich data
Using macros to reuse logic
Creating workflow actions
Using external commands
Summary
Chapter 8. Working with Apps
Defining an app
Included apps
Installing apps
Building your first app
Editing navigation
Customizing the appearance of your app
Object permissions
The app directory structure
Summary
Chapter 9. Building Advanced Dashboards
Reasons for working with advanced XML
Reasons for not working with advanced XML
The development process
The advanced XML structure
Converting simple XML to advanced XML
Module logic flow
Understanding layoutPanel
Reusing a query
Using intentions
Creating a custom drilldown
Third-party add-ons
Chapter 10. Summary Indexes and CSV Files
Understanding summary indexes
When to use a summary index
When not to use a summary index
Populating summary indexes with saved searches
Using summary index events in a query
Using sistats sitop and sitimechart
How latency affects summary queries
How and when to backfill summary data
Reducing summary index size
Calculating top for a large time frame
Using CSV files to store transient data
Summary
Chapter 11. Configuring Splunk
Locating Splunk configuration files
The structure of a Splunk configuration file
The configuration merging logic
An overview of Splunk .conf files
User interface resources
Summary
Chapter 12. Advanced Deployments
Planning your installation
Splunk instance types
Common data sources
Sizing indexers
Planning redundancy
Working with multiple indexes
Deploying the Splunk binary
Using apps to organize configuration
Configuration distribution
Using LDAP for authentication
Using Single Sign On
Load balancers and Splunk
Multiple search heads
Summary
Chapter 13. Extending Splunk
Writing a scripted input to gather data
Using Splunk from the command line
Querying Splunk via REST
Writing commands
Writing a scripted lookup to enrich data
Writing an event renderer
Writing a scripted alert action to process results
Hunk
Summary
Index
更新时间：2021-07-16 13:35:25
完结共142章
倒序