topic Re: mastering splunk in Knowledge Management

mastering splunk

sarah89 — Thu, 05 Apr 2012 09:38:03 GMT

i'm new in this

i want to know how much time of learning how to use splunk and it's fontionalities

thk's

Re: mastering splunk

MarioM — Thu, 05 Apr 2012 09:53:03 GMT

here Splunk Tutorial is a good place to start and it will get you through most of splunk features.

Re: mastering splunk

MHibbin — Thu, 05 Apr 2012 13:30:15 GMT

@Sarah89,

You should start looking through the docs provided by MarioM. It also helps to give yourself a task whilst learning (e.g. Want to monitor disk space), this way you can follow the process from start to finish. For example, on Linux installation this could be:

Data: Create a simple bash script that calls the command "df -m"
Inputs: Set this up as a scripted input in Splunk to run every 30 seconds
Searching: Craft a search to show free space for each filesystem
Reports: Plot it in a pie chart (e.g. Free space over Capacity)
Dashboard: Add the pie chart to a dashboard.
Alerts: Create an alert, to notify you when a device reaches 80% utilisation

You should also jump on the IRC chat channel "#splunk" (link: http://www.splunk.com/view/SP-CAAACDF). As there many helpful and friendly users there. So you'll be able to get a quick answer to simple queries.

Hope this helps

MHibbin

Re: mastering splunk

sarah89 — Thu, 05 Apr 2012 15:47:28 GMT

thk's your answer, i started with the manual user and i finished it

and now i'm using distributed deployment manual for deploying topologies, and forwarders
it's very interessting

Re: mastering splunk

MHibbin — Thu, 05 Apr 2012 15:57:15 GMT

cool, good luck! it's fairly simple once you've done it a few times (i think!)

Re: mastering splunk

araitz — Thu, 05 Apr 2012 16:21:16 GMT

For the search language, don't forget the search cheat sheet and PDF reference:

http://www.innovato.com/splunk/

http://www.innovato.com/splunk/RefCard.pdf

Re: mastering splunk

MHibbin — Thu, 05 Apr 2012 16:26:30 GMT

or better yet (from the splunk docs) =p

http://dev.splunk.com/web_assets/developers/pdf/splunk_reference.pdf

http://docs.splunk.com/images/a/a3/Splunk_4.x_cheatsheet.pdf

Re: mastering splunk

MHibbin — Thu, 05 Apr 2012 16:29:03 GMT

it should probably also be noted... Splunk is such a vast and "deep" platform that you can never truly "master" it. I'm sure even some of the Splunk "veterans" do not know everything in the world of Splunk.

Re: mastering splunk

sarah89 — Sun, 08 Apr 2012 10:47:21 GMT

well thk's a lot for your answers

Re: mastering splunk

sarah89 — Sun, 08 Apr 2012 10:49:30 GMT

for forwading can someone explain the basic procedure to me ,using universal forwarding

ps: i followed all the steps mentioned on distributed deployement manual ,but it doesn't seem to work

please can someone help

Re: mastering splunk

MarioM — Sun, 08 Apr 2012 11:01:27 GMT

create a new question with details of what you have done and paste your conf file.
As well as an extract of your \splunkforwarder\var\log\splunk\splunkd.log

Re: mastering splunk

sarah89 — Sun, 08 Apr 2012 11:13:59 GMT

ok ,i will do this