Getting to Know Splunk: The Hands-On Administration Guide

Define and manage events in Splunk, including how data is indexed into events, each with timestamp, host, source, and sourcetype, with support for multi-line events and timezone-aware searches.

Use search to navigate and analyze data in Splunk, generating alerts, tables, reports, and dashboards, while saving searches for reuse across Windows security event logs.

Learn how to save searches as reports in Splunk, schedule them to run or trigger alerts, and automate monitoring with visualizations like DNS messages.

Learn how an index serves as the container on disk where Splunk stores data, turning raw data into searchable events and enabling access control through segregating data into separate indexes.

Wrap up terminology by applying learned concepts to data onboarding in your Splunk instance, building on what you covered in the previous section.

Learn to onboard data into a Splunk instance by starting with existing logs, researching data sources, and using test environments to validate indexing, retention, and access before production.

When there isn’t an app, work in Splunk with data that conforms to Splunk and existing apps. If data doesn’t conform, expect custom work for client environments and custom apps.

Deploy syslog-ng as a dedicated syslog receiver, have Splunk read structured files by source and host, and avoid direct UDP/TCP inputs on indexers to prevent data loss.

Learn to normalize firewall data using Splunk's common information model to achieve consistent field names like DEST and SRC across products, enabling reliable searches.

Discover Splunk fields: selected, interesting (20% of events), and all fields, default index, source type, and host guiding searches. Use CIDR notation, wildcards, and case-sensitive field names to filter events.

Explore advanced Splunk search concepts using SPL, focusing on the chart command to count by destination port, compare charts and tables, and visualize Linux netfilter port activity over 24 hours.

Master relative time syntax in Splunk to define dynamic search ranges with offset and snap-to units. Use earliest and latest, last hour, and last 15 minutes for recurring, repeatable queries.

Learn to build Splunk dashboards that visualize logs with panels from reports and saved searches, add charts and maps, and troubleshoot via underlying searches.

Master hands-on Splunk administration by learning to work with Splunk, admin Splunk, and bring on data, while exploring additional Splunk classes that go into more detail on these topics.