What is Splunk?
Splunk Enterprise Software (“Splunk”) is a powerful tool for searching and exploring data.
Splunk is often used by system administrators, network administrators, and security gurus, but its use is not restricted to these audiences. There is a great deal of business value hidden away in corporate data that Splunk can liberate.
Who uses Splunk?
Splunk is a powerful platform for analyzing machine data, data that machines emit in great volumes but which is seldom used effectively. Machine data is already important in the world of technology and is becoming increasingly important in the world of business.
It’s used by:
- Security offices
- Marketing departments
- System administrators
- Network administrators
- Application development teams
- Application support teams
How does it work?
- Splunk begins with indexing, which means gathering all the data from diverse locations and combining it into centralized indexes.
- Using the indexes, Splunk can quickly search the logs from all servers and hone in on when the problem occurred.
- Splunk can then drill down into the time period when the problem first occurred to determine its root cause. Alerts can then be created to head the issue off in the future.
Splunk provides one repository, data indexing, search & visualization for your data.
What are the potential Splunk data sources?
During indexing, Splunk can read machine data from any number of sources. The most common input sources are:
- files: Splunk can monitor specific files or directories. If data is added to a file or a new file is added to a monitored directory, Splunk reads that data.
- the network: Splunk can listen on TCP or UDP ports, reading any data sent.
- scripted inputs: Splunk can read the machine data output by programs
or scripts, such as a Unix® command or a custom script that monitors sensors.
Technically speaking, retrieved events from your indexes are called “events.” If those events are transformed or summarized so that there is no longer a one-tone mapping with events on disk, they are properly called “results.”
Announcements at the Splunk 2015 Conference in a slide
SPL (Search Processing Language)
The Search Processing Language encompasses all the search commands and their functions, arguments and clauses. Search commands tell Splunk Enterprise what to do to the events you retrieved from the indexes. For example, you need to use a command to filter unwanted information, extract more information, evaluate new fields, calculate statistics, reorder your results, or create a chart.
Some search commands have functions and arguments associated with them. Use these functions and their arguments to specify how the commands act on your results and/or which fields they act upon. For example, use functions to format the data in a chart, describe what kind of statistics to calculate, and specify what fields to evaluate. Some commands also use clauses to specify how to group your search results.
There are four broad categorizations for all the search commands: distributable streaming, stateful streaming, transforming, generating.
Where can I find more information?
Reference Guide http://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf
Educational Videos http://www.splunk.com/view/education-videos/SP-CAAAGB6
Splunk Blogs http://blogs.splunk.com/
Splunk Wiki http://wiki.splunk.com/Special:SplunkSearch/wiki?q=your-query
Certification and education http://www.splunk.com/view/education/SP-CAAAAH9