Splunk 1

SPLUNK
Splunk is a powerful platform for searching, analyzing and monitoring and reporting the
enterprise data. It receives important machine data and then converts it into powerful
operational intelligence by giving data using alerts, graphs, dashboards and charts etc.
Indexing
Splunk Enterprise indexes the data that makes up your IT infrastructure. You can source
data from websites, applications, servers, databases, operating systems, and more. The
maximum indexing volume of your Splunk instance depends on your Splunk Enterprise license.
Search
Search is the primary way users navigate their data in Splunk Enterprise. You can save a
search as a report and use it to power dashboard panels. Searches provide insight from your
data, such as:
 Retrieving events from an index

 Calculating metrics
 Searching for specific conditions within a rolling time window
 Identifying patterns in your data
 Predicting future trends
Alerts
Alerts notify you when search results for both historical and real-time searches meet
configured conditions. You can configure alerts to trigger actions like sending alert information
to designated email addresses, posting alert information to an RSS feed, and running a custom
script, such as one that posts an alert event to syslog.
Dashboards
Dashboards contain panels of modules like search boxes, fields, charts, and so on.
Dashboard panels are usually connected to saved searches or pivots. They display the results of
completed searches and data from real-time searches that run in the background.
Pivot
Pivot refers to the table, chart, or data visualization you create using the Pivot Editor.
The Pivot Editor lets users map attributes defined by data model objects to a table, chart, or
data visualization without having to write the searches in the Search Processing Language
(SPL) to generate them. Pivots can be saved as reports and added to dashboards.
Reports
Splunk Enterprise allows you to save searches and pivots as reports, and then add
reports to dashboards as dashboard panels. Run reports on an ad hoc basis, schedule them to
run on a regular interval, or set a scheduled report to generate alerts when the result meets
conditions.
Data model
Data models encode specialized domain knowledge about one or more sets of indexed
data. They enable Pivot Editor users to create reports and dashboards without designing the
searches that generate them.
Splunk has four important components:
 Indexer – It indexes the machine data

 Search Head – Provides GUI for searching
 Forwarder – Refers to Splunk instances that forward data to the remote indexers
 Deployment Server –Manages the Splunk components like indexer, forwarder, and
search head in computing environment.
Indexer: (Indexer)
An indexer indexes incoming data that it usually receives from a group of forwarders.
The indexer transforms the data into events and stores the events in an index. The indexer
also searches the indexed data in response to search requests from a search head.
To ensure high data availability and protect against data loss, or just to simplify the
management of multiple indexers, you can deploy multiple indexers in indexer clusters.
Search head: (Search management)

A search head interacts with users, directs search requests to a set of indexers, and
merges the results back to the user.
To ensure high availability and simplify horizontal scaling, you can deploy multiple search
heads in search head clusters.
Forwarder: (Data input)

A forwarder consumes data and then forwards the data onwards, usually to an
indexer. Forwarders usually require minimal resources, allowing them to reside lightly on
the machine generating the data.
Splunk has two types of Splunk forwarder which are as follows:
1. Universal Forwarders – It performs processing on the incoming data before forwarding

it to the indexer.
2. Heavy Forwarders – It parses the data before forwarding them to the indexer works as
an intermediate forwarder, remote collector
Alerts in Splunk:
An alert is an action that a saved search triggers on regular intervals set over a time
range, based on the results of the search. When the alerts are triggered, various actions occur
consequently. For instance, sending an email when a search to the predefined list of people is
triggered.
Three types of alerts:
1. Pre-result alerts: Most commonly used alert type and runs in real-time for an all- time
span. These alerts are designed such that whenever a search returns a result, they are
triggered.
2. Scheduled alerts: The second most common- scheduled results are set up to evaluate
the results of a historical search result running over a set time range on a regular
schedule. You can define a time range, schedule and the trigger condition to an alert.
3. Rolling-window alerts: These are the hybrid of pre-result and scheduled alerts. Similar
to the former, these are based on real-time search but do not trigger each time the
search returns a matching result. It examines all events in real-time mapping within the
rolling window and triggers the time that specific condition by that event in the
window is met, like the scheduled alert is triggered on a scheduled search.
Common port numbers in Splunk:
Service Port Number
Splunk Management Port 8089
Splunk Index Replication Port 8080
KV store 8191
Splunk Web Port 8000
Splunk Indexing Port 9997
Splunk network port 514
Features:
 Powerful search
 Fraud and cyber threat detection analysis
 Information Assurance and security analysis
 Monitor and ensure compliance issues
 Collects and indexes log and machine data from any source
Benefits:
 Enhance incident response and investigations using security data

 Collect, aggregate, de-duplicate, and prioritize threat intelligence from multiple sources
 Detect and reduce internal and external cyber threats
 Solve a wide range of security uses cases
 Increase detection capabilities and optimize incident response
 We can import and export the data in to Splunk. (csv, other files (xml, Raw data)).

Splunk 1

Uploaded by

Copyright:

Available Formats

Splunk 1

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Splunk 1

Uploaded by

Copyright:

Available Formats

SPLUNK

 Retrieving events from an index

 Indexer – It indexes the machine data

Search head: (Search management)

Forwarder: (Data input)

Splunk has two types of Splunk forwarder which are as follows:

1. Universal Forwarders – It performs processing on the incoming data before forwarding

Common port numbers in Splunk:

Service Port Number

Splunk Management Port 8089

Splunk Index Replication Port 8080

Splunk Web Port 8000

Splunk Indexing Port 9997

Splunk network port 514

 Enhance incident response and investigations using security data

You might also like