Operational Intelligence

Splunk Knowledge... Share it Through Documentation

Posted by Naveed Krabbe on Tuesday, July 5, 2016 - 10:33 Best Practices, Operational Intelligence Splunk, Documentation, Content Creation

Anyone who has worked in professional services knows that technical documentation is always requested for any type of content delivery. Of course the importance of documentation extends far beyond the consulting realm, as it is always a good practice for organizations to document their technical content. In today's blog I will attempt to write a non-technical blog about documenting technical Splunk content.

So what should be included in Splunk content documentation? Here is a breakdown, by heading, of the information that I have found to be very key in any Splunk content and use...

REST Easy with the Splunk REST API

Posted by Neena Bhutiani on Tuesday, June 7, 2016 - 10:32 Function1, Operational Intelligence Splunk

The REST API in Splunk is something that we can use in so many different ways. In this blog, I am going to go through some commands that I made to create a dashboard that could be useful for a team.

There are so many useful searches you can use within the REST API, from configurations, configurations, inputs, lookup, searches.

For my client, we wanted to be able to see permission users had, active users, top all users, and what authentication system was being used. The REST API was perfect for this!

So we wanted when the user logged on to...

On one condition...

Posted by Elizabeth Makepeace on Tuesday, May 24, 2016 - 10:47 Operational Intelligence XML, conditions, Splunk, tokens

I have found that I love creating xml code and seeing all the different capabilities it has within Splunk. While at a client recently, the client wanted to have two separate sets of dashboard inputs on one dashboard. To accomplish this, I turned to some more complex features of simple xml by creating what “appears” to be two separate dashboards; however, it’s actually just one. In creating this, my main focus areas were using “tokens” and “depends”.

I started with my Universal Input of Linux or Windows. This will be what my user sees when the dashboard initially loads.

...

Converting McAfee EPO ipv4x to a Readable IP Address

Posted by Krishan Patel on Tuesday, May 17, 2016 - 10:02 Operational Intelligence Splunk, IP conversion, McAfee, EPO

^{http://www.bennadel.com/blog/1830-converting-ip-addresses-to-and-from-in...}

My current Splunk deployment is ingesting custom McAfee EPO data through Splunk Enterprise Security (ES). We are developing many use cases around this data that require us to alert/output an IP address. Currently, the McAfee EPO provides an IP address in integer form (i.e. 2130706433) and not in string/readable form (i.e. 127.0.0.1). In order to make the IP...

Moving? Don’t leave anything behind...

Posted by Rupak Pandya on Tuesday, May 10, 2016 - 11:51 Operational Intelligence Knowledge Objects, Splunk 6.3, Splunk 6.x, REST API, Lookups, macros, saved searches, event types, data models

My client was creeping up on their massive Splunk infrastructure migration to all new hardware and they wanted a quick and simple way to be sure that the knowledge objects in their environment were migrated successfully and nothing important was left behind.

I suggested a solution that would utilize the various REST API searches that are available to gather this information and present it in a simple way.

We came up with a list of the knowledge objects and other important items they had in their environment. We ended up starting with the...

Monitoring Frozen Data Storage in Splunk

Posted by Anshu Rastogi on Tuesday, April 26, 2016 - 12:09 Operational Intelligence Splunk, Operational Intelligence, Big data, Script, Bash, Frozen Data, Archived Data, Scripted Input, Event Format

Frozen Wasteland

In this post, I'd like to visit the "Siberia" of Splunk data or frozen (archived) storage. For all other types of data besides frozen, you can get insight on your Splunk data at the index and bucket level by using the "dbinspect" command or apps like "Fire Brigade." However, because frozen data "lives" outside of the world of Splunk, there's no way to get insight on that data via Splunk. Therefore, I will outline a solution for creating a scripted input to send metrics to Splunk which can then be used for reporting.

Create the...

read more

How to generate 1 TB of data for Splunk Performance Testing

Posted by Donald Wong on Tuesday, April 12, 2016 - 09:25 Operational Intelligence Splunk, Operational Intelligence, Performance Testing, Big data

HOW TO GENERATE 1 TB OF DATA FOR SPLUNK PERFORMANCE TESTING

INTRODUCTION

Splunk, a leader in Event Management provides insight into your business’s machine-generated log data. Splunk enables you to make sense of your business, make smart decisions and initiate corrective actions.

Processing Big Data is by no means a small feat. The ability to scale Splunk to accommodate and grow with your business is key to providing reliable and accurate information. Splunk provides insight into your...

read more

Data Model Acceleration Enforcement

Posted by Kevin Chu on Tuesday, March 29, 2016 - 09:16 Operational Intelligence data model, acceleration, Enterprise Security, Splunk

Data Model Acceleration Enforcement

We have seen a few customers run into the following "gotcha" regarding data model acceleration. Whether it be for temporary or permanent reasons, a user disables acceleration on a data model, which myesteriously is re-enabled after a restart. To counter this, a feature called Data Model Acceleration Enforcement allows administrators to lock acceleration. This feature is found under "Setting" > "Data Models." Here’s how it works:

Through the user interface:

I will be using one of the default...

read more

Automating File Transfer: Using Bash Scripts to Place Reports on Remote Servers

Posted by Krishan Patel on Tuesday, March 15, 2016 - 09:49 Operational Intelligence Splunk, file transfer, auth-key, scripting

While working with Splunk, I’ve come across unique requests that are specific to an organization. In some cases, Splunk customers within an organization do not have Splunk access to run their own saved searches and reports. This requires the Splunk team to create the saved search, generate the report, and send the report to the Splunk customer. Splunk can send a report by email after the search is ran, but this option is not practical if a search runs multiple times a day. A better option would be to place the report on a server, accessible to the customer, every time the saved search is...

read more

Be Nice To Your Users ... And Your Lookups!

Posted by Naveed Krabbe on Wednesday, March 9, 2016 - 10:08 Cool Tools, Operational Intelligence Splunk, Lookups, editor, User Friendly

Introduction

In today's blog I will describe a method that we recently used at a customer site in order to solve a problem for a portion of their Splunk user base. This group does consist of frequent and avid users of Splunk, however they have a fairly low permission level and for the most part, are not the most tech-savvy. Their use of Splunk is limited to only one app and the pre-built dashboards within it.

The requirement for this user group was as follows: They wanted a lookup table where they could enter some notes for specific product ids. They also wanted this...

read more