Bare Bones Splunk


This isn't a question, rather just a place to drop a PDF I put together that I titled "Bare Bones Splunk"


I've seen a lot of people try and get started with Splunk, but then get stuck right after getting Splunk Enterprise installed on their local machine. It can be daunting to log into Splunk for the first time and know what the heck you should do.  A person can get through the install to the What Happens Next page, and be pretty overwhelmed with what to do next:

  • Learn SPL and search? 
  • What should they search? 
  • How should they start getting their data in? 
  • What sort of data should I start getting in? 
  • What dashboard should I build?

They've started...but need that ah-ha example to see how this tool will fit into their existing environment and workflow.

The attached Bare_Bones_Splunk.pdf file guides the reader from the point of install to using the data already being indexed in index=_internal to replicate a few common use cases of Splunk:

  • Monitor a web server
  • Monitor an application server
  • Monitor security incidents

The examples are really simple, and the resulting dashboard created in the tutorial is a poor example of something your boss might want (or observant is your boss - do they just want a few graphs with nice colors?).  But, this will give someone a really quick intro to Splunk without having to do anything other than install (and then maybe they will be ready to tackle a broader introduction, like the Search Tutorial)

Labels (1)

Ultra Champion

Nice document @_JP ... thanks for sharing. 


the trouble with newbies is that, they want one person to hold their hands and walk with them together.(literally). 

If we say "I can only show you the door, you only should decide and walk thru it(the great Morpheus)", still they want us to walk with them (holding their hands). !!!

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...