Things to do when you first install Splunk?

[lguinn2]

What are the things that you normally do as part of a Splunk server installation?

David Carasso published a nice list at http://www.innovato.com/splunk/GettingStarted.htm (and wrote a book too!)

But that list is about a lot of things besides a Splunk server set up.

I am not asking about forwarder setup here, although forwarders will probably be similar. I am looking for the things that you do to make sure that your Splunk server is "good" in the initial setup.

Thanks!

[dshpritz]

Review the Things I wish I knew wiki page and visit #splunk!

[lguinn2]

Thanks @dshpritz! I asked this question partly because I couldn't find this page!

I knew there were things out there, but my Google searches didn't turn up what I expected!

[lguinn2]

Please share your checklist!

[quanteq]

Hello Lisa,

Can a CSV file already uploaded be changed or edited? I would like to know the best approach to treat currency ($ and negative in parenthesis) that gets moved as a string into Splunk, besides these two options:
1. Convert currency to numeric before loaded into Splunk
2. Do the conversion in the search
Here is some sample data:
Contract_Date Amount Vendor_Id Contract_Services

"Sep 25, 2012","$9,843.00","CN99999","FS SERVICES"
"Sep 25, 2012","$4,631.16","CN99999","FS SERVICES"
"Sep 25, 2012","($52,479.99)","CN99999","FS SERVICES"

Thanks! Juan

[lguinn2]

Here is my personal list.

1. Create a user account to run Splunk.
2. Install Splunk and start it. Accept the license terms.
3. Install a license.
4. Stop Splunk.

5. Edit the following configuration files in $SPLUNK_HOME/etc/system/local

   inputs.conf
   server.conf
   web.conf   
   ui-prefs.conf
   

6. Download and install the following apps:

   Sideview Utils
   SOS
   SOS add-on 
   Timewrap
   Splunk Common Information Model
   Splunk Deployment Monitor
   Splunk DB Connect
   Anything else that seems useful at the time
   

7. For a development server, also install

   Splunk 6.x Dashboard Examples
   Splunk Web Framework Toolkit
   Splunk Dashboard Examples for 5+ (older)
   

8. Check indexes and inputs on all apps

9. Start Splunk

10. Set Splunk for bootstart (Linux)

[lguinn2]

Also, here is the ui-prefs.conf that I like

[search]
dispatch.earliest_time = -24h@h
dispatch.latest_time = now

[default]
dispatch.earliest_time = -24h@h
dispatch.latest_time = now

I got it from this very useful question-and-answer

How to set the default timerange in Splunk 6