Splunk Operational Intelligence Cookbook Third Edition

▶Book Description
Splunk makes it easy for you to take control of your data, and with Splunk Operational Cookbook, you can be confident that you are taking advantage of the Big Data revolution and driving your business with the cutting edge of operational intelligence and business analytics.

With more than 80 recipes that demonstrate all of Splunk’s features, not only will you find quick solutions to common problems, but you’ll also learn a wide range of strategies and uncover new ideas that will make you rethink what operational intelligence means to you and your organization.

You’ll discover recipes on data processing, searching and reporting, dashboards, and visualizations to make data shareable, communicable, and most importantly meaningful. You’ll also find step-by-step demonstrations that walk you through building an operational intelligence application containing vital features essential to understanding data and to help you successfully integrate a data-driven way of thinking in your organization.

Throughout the book, you’ll dive deeper into Splunk, explore data models and pivots to extend your intelligence capabilities, and perform advanced searching with machine learning to explore your data in even more sophisticated ways. Splunk is changing the business landscape, so make sure you’re taking advantage of it.

▶What You Will Learn
⦁ Learn how to use Splunk to gather, analyze, and report on data
⦁ Create dashboards and visualizations that make data meaningful
⦁ Build an intelligent application with extensive functionalities
⦁ Enrich operational data with lookups and workflows
⦁ Model and accelerate data and perform pivot-based reporting
⦁ Apply ML algorithms for forecasting and anomaly detection
⦁ Summarize data for long term trending, reporting, and analysis
⦁ Integrate advanced JavaScript charts and leverage Splunk's API

▶Key Features
⦁ Tackle any problems related to searching and analyzing your data with Splunk
⦁ Get the latest information and business insights on Splunk 7.x
⦁ Explore the all new machine learning toolkit in Splunk 7.x

▶Who This Book Is For
This book is intended for data professionals who are looking to leverage the Splunk Enterprise platform as a valuable operational intelligence tool. The recipes provided in this book will appeal to individuals from all facets of business, IT, security, product, marketing, and many more! Even the existing users of Splunk who want to upgrade and get up and running with Splunk 7.x will find this book to be of great value.

▶What this book covers
⦁ Chapter 1, Play Time –. Getting Data In, introduces you to the many ways in which you can get data into Splunk, whether it is collecting data locally from files and directories, receiving it through TCP/UDP port inputs, directly from a Universal Forwarder, or simply utilizing Scripted and Modular Inputs. Regardless of how Operational Intelligence is approached, the right data at the right time is pivotal to success; this chapter will play a key role in highlighting what data to consider and how to efficiently and effectively get that data into Splunk. It will also introduce the data sets that will be used throughout this book and where to obtain samples that can be used to follow each of the recipes as they are written.

⦁ Chapter 2, Diving into Data –. Search and Report, introduces you to the first set of recipes in the book. Leveraging the data now available as a result of the previous chapter, the information and recipes will guide you through searching event data using Splunk's SPL (Search Processing Language); applying field extractions; grouping common events based on field values; and then building basic reports using the table, top, chart, and stats commands.

⦁ Chapter 3, Dashboards and Visualizations –. Make Data Shine, guides you through building visualizations based on reports that can now be created as a result of this chapter. The information and recipes provided in this chapter will empower you to take their data, and reports, and bring it to life through the powerful visualizations provided by Splunk. Visualizations introduced will include single values, charts (bar, pie, line, and area), scatter charts, and gauges.

⦁ Chapter 4, Building an Operational Intelligence Application, builds on the understanding of visualizations that you gained as a result of the previous chapter to now introduce the concept of dashboards. Dashboards provide a powerful way to bring visualizations together and provide the holistic visibility required to fully capture the operational intelligence that is most important. The information and recipes provided in this chapter will outline the purpose of dashboards, how to properly utilize dashboards, using the dashboard editor to build a dashboard, building a form for searching event data and much more.

⦁ Chapter 5, Extending Intelligence –. Datasets, Modeling and Pivoting, covers powerful features found in Splunk Enterprise, the ability to create datasets and the pivot tool. The information and recipes provided in this chapter will introduce you to the concept of Splunk Datasets. You will build data models, use the pivot tool and write accelerated searches to quickly create intelligence driven reports and visualizations.

⦁ Chapter 6, Diving Deeper –. Advanced Searching, Machine Learning and Predictive Analytics, helps you harness the ability to converge data from different sources and understand or build relationships between the events. By now you will have an understanding of how to derive operational intelligence from data by using some of Splunk's most common features. The information and recipes provided in this chapter will take you deeper into the data by introducing the Machine Learning Toolkit, transactions, subsearching, concurrency, associations, and more advanced search commands.

⦁ Chapter 7, Enriching Data –. Lookups and Workflows, enables you to apply this functionality to further enhance their understanding of the data being analyzed. As illustrated in the preceding chapters, event data, whether from a single tier or multi-tier web application stack, can provide a wealth of operational intelligence and awareness. That intelligence can be further enriched through the use of lookups and workflow actions.The information and recipes provided in this chapter will introduce the concept of lookups and workflow actions for the purpose of augmenting the data being analyzed.

⦁ Chapter 8, Being Proactive –. Creating Alerts, guides you through creating alerts based on the knowledge gained from previous chapters. A key asset to complete operational intelligence and awareness is the ability to be proactive through scheduled or real-time alerts. The information and recipes provided in this chapter will introduce you to this concept, the benefits of proactive alerts and provide context of when alerts are best applied.

⦁ Chapter 9, Speed Up Intelligence –. Data Summarization, provides you with a short introduction to common situations where summary indexing can be leveraged to speed up reports or preserve focused statistics over long periods of time. With big data being just that, big, it can sometimes be very time consuming searching massive sets of data or costly to store the data for long periods of time. The information and recipes provided in this chapter will introduce you to the concept of summary indexing for the purposes of accelerating reports and speeding up the time it takes to unlock business insight.

⦁ Chapter 10, Above and Beyond –. Customization, Web Framework, HTTP Event Collector, REST API, and SDKs, introduces you to four very powerful features of Splunk. These features provide the ability to create a very rich and powerful interactive experience with Splunk. This will open you up to the possibilities beyond core Splunk Enterprise and show you a method to create your own operational intelligence application including powerful visualizations. It will also provide a recipe for querying Splunk's REST API and a basic Python application leveraging Splunk's SDK to execute a search.