Onboarding and Normalizing Data

Splunk refers to the process of configuring new data sources as onboarding. Onboarding can be accomplished using the Splunk Graphical User Interface (GUI) (commonly known as Splunk Web) and Splunk Command Line Interface (CLI) commands, as well as by editing configuration files. The term normalizing data refers to the action of ensuring that the data is Splunk meets a Common Information Model (CIM). This is a very important step in using Splunk. In this chapter, we will explore the way data is onboarded and how we can extract fields. First, we will explore the way data is onboarded in the default inputs.conf file in the Splunk Add-on for Microsoft Windows. Then, we will use Splunk Web and configuration files to extract fields. Finally, we will explore event types and tags in the add-ons and apps that we installed in Chapter 2, Setting Up the Splunk Environment. We will create new event types and tags. We will also be executing simple Search Processing...