Splunk Best Practices

Design, implement, and publish custom Splunk applications by following best practices About This Book • This is the most up-to-date guide on the market and will help you finish your tasks faster, easier, and more efficiently. • Highly practical guide that addresses common and not-so-common pain points in Splunk. • Want to explore shortcuts to perform tasks more efficiently with Splunk? This is the book for you! Who This Book Is For This book is for administrators, developers, and search ninjas who have been using Splunk for some time. A comprehensive coverage makes this book great for Splunk veterans and newbies alike. What You Will Learn • Use Splunk effectively to gather, analyze, and report on operational data throughout your environment • Expedite your reporting, and be empowered to present data in a meaningful way • Create robust searches, reports, and charts using Splunk • Modularize your programs for better reusability. • Build your own Splunk apps and learn why they are important • Learn how to integrate with enterprise systems • Summarize data for longer term trending, reporting, and analysis In Detail This book will give you an edge over others through insights that will help you in day-to-day instances. When you're working with data from various sources in Splunk and performing analysis on this data, it can be a bit tricky. With this book, you will learn the best practices of working with Splunk. You'll learn about tools and techniques that will ease your life with Splunk, and will ultimately save you time. In some cases, it will adjust your thinking of what Splunk is, and what it can and cannot do. To start with, you'll get to know the best practices to get data into Splunk, analyze data, and package apps for distribution. Next, you'll discover the best practices in logging, operations, knowledge management, searching, and reporting. To finish off, we will teach you how to troubleshoot Splunk searches, as well as deployment, testing, and development with Splunk. Style and approach If you're stuck or want to find a better way to work with Splunk environment, this book will come handy. This easy-to-follow, insightful book contains step-by-step instructions and examples and scenarios that you will connect to.

About the Author :
Travis Marlette has been working with Splunk since Splunk 4.0, and has over 7 years of statistical and analytical experience leveraging both Splunk and other technologies. He cut his teeth in the securities and equities division of the finance industry, routing stock market data and performing transactional analysis on stock market trading, as well as reporting security metrics for SEC and other federal audits. His specialty is in IT operational intelligence, which consists of the lions share of many major companies. Being able to report on security, system-specific, and propriety application metrics is always a challenge for any company and with the increase of IT in the modern day, having a specialist like this will become more and more prominent. Working in finance, Travis has experience of working to integrate Splunk with some of the newest and most complex technologies, such as: • SAS • HIVE • TerraData (Data Warehouse) • Oozie • EMC (Xtreme IO) • Datameer • ZFS • Compass • Cisco (Security/Network) • Platfora • Juniper (Security and Network) • IBM Web Sphere • Cisco Call Manager • Java Management Systems (JVM) • Cisco UCS • IBM MQ Series • FireEye • Microsoft Active Directory • Snort • Microsoft Exchange • F5 • Microsoft – OS • MapR (Hadoop) • Microsoft SQL • YARN (Hadoop) • Microsoft SCOM • NoSQL • Linux (Red Hat / Cent OS) • Oracle • MySQL • Nagios • LDAP • TACACS+ • ADS • Kerberos • Gigamon • Telecom Inventory Management • Riverbed Suite • Endace • Service Now • JIRA • Confluence Travis is has been certified for a series of Microsoft, Juniper, Cisco, Splunk, and network security certifications. His knowledge and experience is truly his most valued currency, and this is demonstrated by every organization that has worked with him to reach their goals. He has worked with Splunk installations that ingest 80 to 150 GB daily, as well as 6 TB daily, and provided value with each of the installations he's created to the companies that he's worked with. In addition he also knows when a project sponsor or manager requires more information about Splunk and helps them understand what Splunk is, and how it can best bring value to their organization without over-committing. According to Travis, "Splunk is not a 'crystal ball'that's made of unicorn tears, and bottled rainbows, granting wishes and immediate gratification to the person who possesses it. It's an IT platform that requires good resources supporting it, and is limited only by the knowledge and imagination of those resources". With the right resources, that's a good limitation for a company to have. Splunk acts as a 'Rosetta Stone' of sorts for machines. It takes thousands of machines, speaking totally different languages all at the same time, and translates that into something a human can understand. This by itself, is powerful. His passion for innovating new solutions and overcoming challenges leveraging Splunk and other data science tools have been exercised and visualized every day each of his roles. Those roles are cross industry, ranging from Bank of New York and Barclay's Capital, to the Federal Government. Thus far, he and the teams he has worked with have taken each of these organizations further than they have ever been on their Splunk journey. While he continues to bring visibility, add value, consolidate tools, share work, perform predictions, and implement cost savings, he is also are often mentioned as the most resourceful, reliable, and goofy person in the organization. Travis says “A new Splunk implementation is like asking your older brother to turn on a fire hose so you can get a drink of water. Once it's on, just remember to breathe.”