Getting started with monitoring
You install Splunk and add data (configure your inputs), and Splunk is already monitoring! Obviously, after your initial exposure to Splunk and as you pursue your Splunk mastership, you'll want to approach monitoring with proven practices in mind.
A proven startup methodology is outlined here:
Requirements: Gather and understand what the requirements truly are. Your needs (the requirements) will determine how you add data to Splunk: can you use an app? What about forwarders? Is there an opportunity for knowledge creation?
Test indexing: Create a test index and add just a few inputs.
Preview the data: Use the Splunk data preview feature to actually view the data. Then, based on what you see, you might want to modify how Splunk indexes the data.
Search: Run some searches on the test data and evaluate the results. Are the results what you need?
Tweak events: If necessary, tweak the Splunk input and event processing configurations until events look the way you...
