topic Re: Is this feasible to do in Splunk? in Splunk Search

Is this feasible to do in Splunk?

alanxu — Mon, 29 Jun 2015 21:26:24 GMT

Hello,
I am new to Splunk and I am using it for work. What I have is a raw log of data that tells me dates, when scripts begin and finish, and other information. Its really messy so I created a bash script to filter through it to get the necessary information and output it to another file. My next step is to use that outputted file and create tables and graphs in Splunk. Can anyone break down the steps I need to take? I watched a few tutorial videos.

Also I am suppose to have an alert for special cases.

Thanks

Re: Is this feasible to do in Splunk?

ChrisG — Mon, 29 Jun 2015 21:36:54 GMT

For the basic steps of get data in, search, report, make dashboards, have you worked your way through the Search Tutorial?

For instructions about getting the data from your file into Splunk Enterprise, see Monitor files and directories in the Getting Data In manual.

For alerts, it depends what you want to do. But see the Alerting Manual for more information.

Re: Is this feasible to do in Splunk?

alanxu — Mon, 29 Jun 2015 21:49:11 GMT

I got my massaged log file in
I saw reports are just saved searches
Dashboards are made from reports?

I am just wondering if my project is even possible using Splunk.

Re: Is this feasible to do in Splunk?

ChrisG — Mon, 29 Jun 2015 21:55:40 GMT

Dashboards are made from reports, yes. Did you go through the tutorial? It shows you how. Based on the small amount of information you have provided, your project should be possible. If you want more detailed help from the community, I suggest making a new Answers posting and including samples of your data and searches, along with specific questions about where you are getting stuck.

Re: Is this feasible to do in Splunk?

alanxu — Mon, 29 Jun 2015 21:59:18 GMT

Soudnds good Chris thank you I will keep playing around this week and will probably post a question in a few days.