topic Re: Things to do when you first install Splunk? in Getting Data In

Things to do when you first install Splunk?

lguinn2 — Sat, 17 May 2014 01:23:02 GMT

What are the things that you normally do as part of a Splunk server installation?

David Carasso published a nice list at http://www.innovato.com/splunk/GettingStarted.htm (and wrote a book too!)

But that list is about a lot of things besides a Splunk server set up.

I am not asking about forwarder setup here, although forwarders will probably be similar. I am looking for the things that you do to make sure that your Splunk server is "good" in the initial setup.

Thanks!

Re: Things to do when you first install Splunk?

lguinn2 — Sat, 17 May 2014 01:31:32 GMT

Here is my personal list.

Create a user account to run Splunk.
Install Splunk and start it. Accept the license terms.
Install a license.
Stop Splunk.
Edit the following configuration files in $SPLUNK_HOME/etc/system/local
```
inputs.conf
server.conf
web.conf   
ui-prefs.conf
```

Download and install the following apps:

Sideview Utils
SOS
SOS add-on 
Timewrap
Splunk Common Information Model
Splunk Deployment Monitor
Splunk DB Connect
Anything else that seems useful at the time

For a development server, also install

Splunk 6.x Dashboard Examples
Splunk Web Framework Toolkit
Splunk Dashboard Examples for 5+ (older)

Check indexes and inputs on all apps
Start Splunk
Set Splunk for bootstart (Linux)

Re: Things to do when you first install Splunk?

lguinn2 — Sat, 17 May 2014 01:33:19 GMT

Also, here is the ui-prefs.conf that I like

[search]
dispatch.earliest_time = -24h@h
dispatch.latest_time = now

[default]
dispatch.earliest_time = -24h@h
dispatch.latest_time = now

I got it from this very useful question-and-answer

How to set the default timerange in Splunk 6

Re: Things to do when you first install Splunk?

lguinn2 — Sat, 17 May 2014 01:36:03 GMT

Please share your checklist!

Re: Things to do when you first install Splunk?

dshpritz — Sat, 17 May 2014 05:34:18 GMT

Review the Things I wish I knew wiki page and visit #splunk!

Re: Things to do when you first install Splunk?

lguinn2 — Sun, 18 May 2014 22:59:14 GMT

Thanks @dshpritz! I asked this question partly because I couldn't find this page!

I knew there were things out there, but my Google searches didn't turn up what I expected!

Re: Things to do when you first install Splunk?

quanteq — Mon, 28 Sep 2020 19:04:16 GMT

Hello Lisa,

Can a CSV file already uploaded be changed or edited? I would like to know the best approach to treat currency ($ and negative in parenthesis) that gets moved as a string into Splunk, besides these two options:
1. Convert currency to numeric before loaded into Splunk
2. Do the conversion in the search
Here is some sample data:
Contract_Date Amount Vendor_Id Contract_Services

"Sep 25, 2012","$9,843.00","CN99999","FS SERVICES"
"Sep 25, 2012","$4,631.16","CN99999","FS SERVICES"
"Sep 25, 2012","($52,479.99)","CN99999","FS SERVICES"

Thanks! Juan