Preface

I started working with Splunk in late 2013 when I joined the security team of a healthcare company. They were getting ready to migrate from a home-grown Security Information and Event Management (SIEM) system to Splunk. As part of the preparation, we did the Splunk Knowledge Manager, Admin, and Enterprise Security courses. They were very interesting, and I looked forward to working with the tool. Fast forward 9 years, and I have used Splunk on multiple contracts. The use cases have ranged from security, healthcare, retail, and education. I have incorporated Splunk into the courses that I teach. I became a member of SplunkTrust. So when the publishers approached me with the proposal to write a book on Splunk, I accepted.

This book is an introduction to Splunk. I will guide you through the main components of Splunk. You will learn about indexes, indexing, and indexers. You learn about search heads and clusters. You will get an introduction to the Splunk Search Processing Language (SPL) using logs and use cases from the BOTS dataset. Are you ready?