topic Re: What do Splunk Ninjas think are the top three daily Splunk tasks in a large distributed environment? in Getting Data In

What do Splunk Ninjas think are the top three daily Splunk tasks in a large distributed environment?

brian1_tate — Thu, 17 Nov 2016 18:26:48 GMT

Hello all,

I am trying to build a workflow for our new Splunk product and want to know what top three regular daily tasks you may do in Splunk Enterprise. This includes anything in regards to ES administration as well and maintenance tasks.

If anyone has suggestions, I would certainly appreciate your feedback. This new environment has 5 indexers in a cluster, three search heads in a cluster and several heavy forwarders with a ton of data sent via forwarders. Comments anyone?

Re: What do Splunk Ninjas think are the top three daily Splunk tasks in a large distributed environment?

aaraneta_splunk — Thu, 17 Nov 2016 18:46:19 GMT

@brian1_tate - When you say "ES" are you referring to the app "Splunk Enterprise Security"? Because that is usually what "ES" refers to. Please clarify, thank you!

Re: What do Splunk Ninjas think are the top three daily Splunk tasks in a large distributed environment?

brian1_tate — Thu, 17 Nov 2016 19:53:55 GMT

That's correct but in general, I wanted to get people's feedback on what daily/weekly tasks they perform as I am transitioning from ArcSight to Splunk.

Re: What do Splunk Ninjas think are the top three daily Splunk tasks in a large distributed environment?

a212830 — Thu, 17 Nov 2016 20:01:06 GMT

Answer questions on why shouldn't we use ELK/open-source...

Re: What do Splunk Ninjas think are the top three daily Splunk tasks in a large distributed environment?

brian1_tate — Thu, 17 Nov 2016 22:59:13 GMT

That's not relevant here. All I'm looking for is general procedural steps for those that use Splunk Enterprise with ES as a SIEM. I have those for ArcSight but after working with a larger Splunk environment, frankly the largest I have ever encountered - one would have them or develop them. So in this case, I am developing them based upon my own experiences and based upon those that others may use in day to day operations.

If you just say, I use Splunk - best wishes in justification of your career...

Re: What do Splunk Ninjas think are the top three daily Splunk tasks in a large distributed environment?

a212830 — Fri, 18 Nov 2016 03:42:37 GMT

It's a joke. Lighten up Francis.

Re: What do Splunk Ninjas think are the top three daily Splunk tasks in a large distributed environment?

gjanders — Fri, 18 Nov 2016 07:19:55 GMT

So, most of what I do is set up alerts to advise me about potential issues, for ES this has included:

Sources no longer sending data ( | tstats max(_indextime) where ... or similar is very useful here)
Users exceeding there quota (disk quota, search quota), often this is harmless but sometimes I review the limits to see if they are appropriate.
Check for badly written/long running searches via the monitoring console (this one is more a manual task for now).

There would be many other potential things on a daily basis, one thing I do try to do is review the error logs...

Re: What do Splunk Ninjas think are the top three daily Splunk tasks in a large distributed environment?

klaxdal — Fri, 18 Nov 2016 14:13:20 GMT

Don't call me Francis .

https://www.youtube.com/watch?v=IMtvnAmfuf8

Re: What do Splunk Ninjas think are the top three daily Splunk tasks in a large distributed environment?

Richfez — Fri, 18 Nov 2016 14:20:15 GMT

Y'all need to put more smileys in your posts to help us old geezers know you were joking. Geez. 🙂

Plus I am cleaning up a duplicate comment and am slightly rearranging the remaining, since they were responses to one another.