What this book covers

Chapter 1, The Splunk Interface, walks you through the most common elements in the Splunk interface.

Chapter 2, Understanding Search, dives into the nuts and bolts of how searching works so that you can make efficient searches to populate cool reports.

Chapter 3, Tables, Charts, and Fields, starts using fields for more than searches; we'll build tables and graphs. Then we'll learn how to make our own fields.

Chapter 4, Data Models and Pivots, covers data models and pivots, the pivot editor, pivot elements and filters, and sparklines.

Chapter 5, Simple XML Dashboards, demonstrates simple XML dashboards; their purpose; using wizards to build, schedule the generation of, and edit XML directly; and building forms.

Chapter 6, Extending Search, uses more advanced features of Splunk to help extend the search language and enrich data at search time.

Chapter 7, Working with Apps, explores what makes up a Splunk app, as well as the latest self-service app management (originally introduced in version 6.6) updated in version 7.0.

Chapter 8, Building Advanced Dashboards, covers module nesting, layoutPanel, intentions, and an alternative to intentions with SideView Utils.

Chapter 9, Summary Indexes and CSV Files, explores the use of summary indexes and the commands surrounding them.

Chapter 10, Configuring Splunk, overviews how configurations work and gives a commentary on the most common aspects of Splunk configuration. 

Chapter 11, Play Time – Getting Data In, introduces you to the many ways in which you can get data into Splunk. This chapter will play a key role in highlighting what data to consider and how to efficiently and effectively get that data into Splunk. 

Chapter 12, Building an Operational Intelligence Application, builds on the understanding of visualizations that you gained as a result of the previous chapter to now introduce the concept of dashboards. 

Chapter 13, Diving Deeper – Advanced Searching, Machine Learning and Predictive Analytics, helps you harness the ability to converge data from different sources and understand or build relationships between the events.

Chapter 14, Speed Up Intelligence – Data Summarization, provides you with a short introduction to common situations where summary indexing can be leveraged to speed up reports or preserve focused statistics over long periods of time. 

Chapter 15, Above and Beyond – Customization, Web Framework, HTTP Event Collector, REST API, and SDKs, introduces you to four very powerful features of Splunk. These features provide the ability to create a very rich and powerful interactive experience with Splunk.