adam's notes

Intro to Splunk

Splunk Apps

Apps are preconfigured environments that sit on top of the Splunk instance.

  • workspaces built to solve a specific use case
  • defined by a user with administrator role
  • hundreds of apps are available on Splunk Base
  • can create custom app

Roles

  • 3 default roles in Splunk Enterprise:
    • Admin
      • can install apps
      • ingest data
      • create knowledge objects for all users
    • Power
      • can create and share knowledge objects with all users of an app
      • perform real time searches
    • User
      • can only see their own knowledge objects and those shared with them
  • Splunk Cloud default roles:
    • sc_admin
    • power
    • user
    • cloud specific roles:
      • can_delete
      • token_auth
      • apps
  • by default, a search job will remain active for 10 minutes
  • shared search job will remain active for 7 days
    • readable by everyone
  • returned events are shown in reverse chronological order
    • newest events first
  • the timestamp shown in the event is based off the timezone set in your user account

Search Modes

  • Fast Mode
    • cuts down on field info returned
    • field discovery is disabled
  • Smart Mode
    • default mode
    • toggle behaviors based on the search
  • Verbose Mode
    • returns as much field and event data as possible

Search Terms

  • 3 Booleans
    • OR
    • AND
    • NOT
  • if no boolean, then AND is implied
    • e.g., term1 term2 = term1 AND term2
  • Order of operations:
    1. NOT
    2. OR
    3. AND
  • use parentheses to control order of evaluation
  • use \ for character escape

What are Commands?

  • Splunk’s search language is built from 5 components:
    1. Search terms
      • the terms searched for
    2. Commands
      • tell Splunk what to do with the search results
      • e.g., creating charts, computing statistics, and formatting
    3. Functions
      • Explain how to chart, compute, and evaluate results
    4. Arguments
      • variables applied to the function
    5. Clauses
      • Explain how results are grouped or defined

Transforming commands are commands that create statistics and visualizations.

Example

index=network sourcetype=cisco_wsa_squid usage=Violation
| stats count(usage) as Visits
  • Search terms: index=network sourcetype=cisco_wsa_squid usage=Violation
  • Command: stats
  • Function: count
  • Argument: usage
  • Clause: as
  • Pipe | passes the output of first result as input to command

Filtering

  • Most powerful filters to use in order:
    1. Time
    2. index
    3. source
    4. host
    5. sourcetype

Searching Best Practices

  • inclusion is generally better than exclusion
    • e.g., access denied is better than NOT "access granted"
  • Use OR or IN operators instead of wildcards
    • e.g.,
      • user=admin OR user=administrator
      • user IN (admin, administrator)
      • are both better than: user=admin*
  • Apply filtering commands as early as possible in the search
    • filtering early limits the number of events
    • makes manipulation of data faster

Knowledge Objects

Knowledge objects are tools that help users discover and analyze data.

  • grouped into 5 categories:
    1. Data interpretation
      • Fields
      • Field Extractions
      • Calculated Fields
    2. Data classification
      • Event Types
      • Transactions
    3. Data enrichment
      • Lookups
      • Workflow Actions
    4. Data normalization
      • Tags
      • Field Aliases
    5. Data models
      • Hierarchically structured Datasets
  • uses:
    • can be shared across users based on permissions
    • can be saved and used by multiple users in multiple apps
    • can be used in a search
  • created by Knowledge Managers
    • responsibilities
      • oversee knowledge object creation
      • implement naming conventions
      • normalize event data
      • create data models

Creating Reports

Reports are searches that can be saved and shared.

  • Save As > Report
    • Title, Description, Content, Time Range Picker
  • Should define a naming convention for reports
  • Access reports from the Reports tab
  • By default, a report is only shown for the creator
    • need to give access to others: Reports > Edit > Display For > App > select permissions
  • Can schedule a report to run at timed intervals
    • Reports > Edit > Edit Schedule
    • Can add a trigger action

Creating Dashboards

  • Can save a search visualization to a dashboard
    • Save As > Existing Dashboard/New Dashboard
  • 2 frameworks for building dashboards:
    • Classic Dashboards
    • Dashboard Studio
  • On a Dashboard, you can add a Panel
    • allows adding a new visualization from scratch without returning to search page
    • or add existing visualization

Graph View

Backlinks