Advanced Splunk

This chapter will serve as a brief overview and reference for several important topics and skills that any Splunk administrator will want to have in their toolkit. While Splunk is inherently stable and reliable, there will be times when you have to troubleshoot problems; this chapter covers the most useful Splunk logs and tools for determining what's working and what isn't. Then, we'll segue into using the Monitoring Console to keep tabs on Splunk health, as well as providing examples of searches that can be built for monitoring disk and index usage versus configured capacity, search performance, and several other factors that an administrator will be interested in. As a finale for this chapter, and book, the reader will be introduced to the essential concepts and references for taking Splunk to the next level—using API endpoints and the Splunk...