splunk entreprise

[rimsassi]

I'm discovering Splunk enterprise to build an application to perform correlations and detect incidents that affect web applications and endpoints.

Can you please guide me on the steps I should take?

what are your recommendations?

[dauren_akilbeko]

I would recommend first pass Splunk Fundamentals 1, which is free. Then check Splunk Lantern and Splunk Developer Program. 

[rimsassi]

I already passed  Splunk Fundamentals 1. I'll check the others, thanks

[scelikok · Accepted solution]

Hi @rimsassi,

You can check below links;

• Splunk Cheat Sheet: https://www.splunk.com/pdfs/solution-guides/splunk-quick-reference-guide.pdf
• Community Forum: https://community.splunk.com/
• Free Splunk eBook: http://www.splunk.com/web_assets/v5/book/Exploring_Splunk.pdf
• Free Splunk Course: http://www.splunk.com/view/SP-CAAAHSM
• Splunk Education Videos: http://www.splunk.com/view/education-videos/SP-CAAAGB6
• Splunk Docs: http://docs.splunk.com/Documentation/Splunk
• Splunk Wiki: https://wiki.splunk.com/Main_Page
• Splunk Apps: https://splunkbase.splunk.com/
• Splunk YouTube Channel: https://www.youtube.com/channel/UCjwOFZzLPnji1EstaVyyvAw

[rimsassi]

Okay! Thank u

[richgalloway]

It sounds like you want us to tell you how to build every security dashboard that was ever created.  Or perhaps you want the equivalent of Splunk Enterprise Security.  Either way, the question is far too broad.  If you have trouble with Splunk and have specific questions, then please post them.

1. In the meantime, here are some steps:
2. Take the free Splunk Fundamentals 1 class at splunk.com
3. Get your data into Splunk.  See https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Getstartedwithgettingdatain
4. Search for the onboarded data.  The free class above will tell you how.
5. When you have a search that does something useful or produces a helpful KPI, save it to a dashboard.  Click the Save As link in the search window to do that.

[rimsassi]

I'm new at Splunk, I'm trying to find my way around, but it's just too much documentation so I needed some guidelines to start. Thanks for your help.