How to make sense of data

[michael_lee]

So we have various types of logs that Splunk collects. E.g. Windows events, web server logs, syslogs, cisco switches and the likes. How do you make sense of such a huge amount of data that comes from different devices to find what you want, with context? Do you use Enterprise Security ? Or do you craft your own search algorithms? thanks

[fdi01]

this link can help you:
http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/WhatisSplunkknowledge

[mdessus_splunk · Accepted solution]

Hi Michael,

It depends what you're looking for and your environment: you could just start with a few basic rules and dashboards (security or not) if you do not have much security background or are too busy. You might add ES later to have some more in depth view of your security, or add it at the beginning if you have enough people with security skills.
Keep in mind you should go step after steps, and that even with ES, you will need to adapt it to your company and threats.