Upload File

splunk p30x: become a lean, mean, splunkin’ …...or other commitment. splunk undertakes no...

  • Home
  • Documents
  • Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any
29
© 2018 SPLUNK INC. © 2018 SPLUNK INC. Splunk P30X: Become a lean, mean, Splunkin’ machine in 30 days! Session ID: 1611 Alan Ivarson – Splunk Staff Cloud Architect Matt Portnoy – Splunk Senior Systems Engineer October 2018 | Version 3.0

Upload: others

Post on 21-May-2020

11 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

© 2018 SPLUNK INC.

Splunk P30X: Become a lean, mean, Splunkin’ machine in 30 days! Session ID: 1611

Alan Ivarson – Splunk Staff Cloud Architect

Matt Portnoy – Splunk Senior Systems Engineer

October 2018 | Version 3.0

Page 2: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

During the course of this presentation, we may make forward-looking statements regarding future events or

the expected performance of the company. We caution you that such statements reflect our current

expectations and estimates based on factors currently known to us and that actual events or results could

differ materially. For important factors that may cause actual results to differ from those contained in our

forward-looking statements, please review our filings with the SEC.

The forward-looking statements made in this presentation are being made as of the time and date of its live

presentation. If reviewed after its live presentation, this presentation may not contain current or accurate

information. We do not assume any obligation to update any forward-looking statements we may make. In

addition, any information about our roadmap outlines our general product direction and is subject to change

at any time without notice. It is for informational purposes only and shall not be incorporated into any contract

or other commitment. Splunk undertakes no obligation either to develop the features or functionality

described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in

the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2018 Splunk Inc. All rights reserved.

Forward-Looking Statements

THIS SLIDE IS REQUIRED FOR ALL 3RD PARTY PRESENTATIONS.

Presentations to Third-Parties (i.e., non-Splunkers)

• When presenting to third parties, this slide must be

included immediately after the title slide.

• Only share confidential information on a “need-to-know”

basis and make sure the audience members are bound

by non-disclosure or confidentiality agreements.

• Before disclosing any customer or other third party

names, logos or use cases, confirm with Marketing that

we have the right consents.

• Don’t bash the competition. If making comparisons

between Splunk and our competitors, stick to the facts.

• Make sure all statements are not overstated and are

supported by facts.

Confidential Information

• If the presentation contains confidential information, a

confidentiality notice must appear on every slide.

Please contact [email protected] for help

implementing this notice: Confidential information. Do

not distribute.

• Examples of confidential information: financial results,

strategic business and marketing plans, product

launches and roadmaps, customer lists and use cases.

NOTICE FROM SPLUNK LEGAL

mailto:[email protected]
Page 3: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

ALAN IVARSON

Staff Cloud Architect

Page 4: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

MATT PORTNOY

Senior Sales Engineer

Page 5: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

© 2018 SPLUNK INC.

Results

Page 6: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

© 2018 SPLUNK INC.

The 30 Day Plan

Sunday Monday Tuesday Wednesday Thursday Friday Saturday

Splunk Install and

Profile Configuration

Initial Config and

Data Onboarding

Apps, Add-ons,

and Sourcetype

planning

Data Onboarding

– Network

Sourcetypes

Data Onboarding –

Windows Data

Search and

Reporting – Basic

Search

Alerts Dashboards Loading Apps and

Add-ons

Search and

Reporting –

Searching II

Splunk

Fundamentals I

Class –

Modules1 - 6

Splunk

Fundamentals I

Class –

Modules 7 - 12

Knowledge

Objects

Apps and

Add-ons - II

Apps and

Add-ons - III

Splunk your Car

Dashboards - II Alerts - II Search and

Reporting –

Searching III

Create a Simple

App

Dashboards - III Splunk Your

Thermostat

Review

Fundamentals I

material

Splunk Core

Certified User

Test

Your Journey to Become a Lean, Mean, Splunkin’ Machine

Page 7: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

QuickStart

Everything you need to get started

Page 8: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

Get a Splunk.com Account

Page 9: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

New Account OR Login

Page 10: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

www.splunk.com/download

Page 11: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

Demo

Page 12: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

Warm Up!

Page 13: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

Settings, Add Data

Page 14: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

Upload

Page 15: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

Upload tutorialdata.zip file

Page 16: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

Input settings according to documentation

Page 17: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

Validate Settings

Page 18: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

Demo

Page 19: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

Exercise Set #1

Page 20: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

Demo

Page 21: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

Exercise Set #2

Page 22: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

The Splunk Data Onboarding

Mainframe

Data

Scripted or

Modular Inputs Forwarders

Syslog

TCP/UDP

IoT

Devices

Network

Wire Data

Platform for Operational Intelligence

Relational

Databases Mobile

DB Connect Splunk App

for Stream

Shell Scripts

and APIs

Syslog hosts

and network

devices

HTTP Event

Collector

Unix, Linux, Mac,

and Windows

Hosts,

web logs,

file monitoring

HEC and

Web logs

3rd party

and File

monitoring

Page 23: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

Demo

Page 24: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

Level Up and

Cool Down!

What’s next after you master this?

Page 25: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

© 2018 SPLUNK INC.

Next Steps

▶ Deployment Server

▶ Distributed Architecture

▶ Certifications

• Splunk Core Certified User

• Splunk Core Certified Power User

• Splunk Enterprise Certified Admin

• Splunk Enterprise Certified Architect (advanced)

Page 26: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

© 2018 SPLUNK INC.

References

▶ Splunk Documentation (link)

▶ Additional Sites

• Go Splunk

• Splunk Answers

• REGEX101.com

• Blog(s)

▶ Reference document (link)

▶ Tutorial Data Exercise (link)

▶ SPL reference sheets (link)

▶ Dashboarding reference sheet (link)

▶ On-line book (link)

▶ The 30 day plan (link)

GO TO http://bit.ly/1611goodies

Page 27: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

© 2018 SPLUNK INC. CONFIDENTIAL INFORMATION. DO NOT DISTRIBUTE.

© 2018 SPLUNK INC.

The 30 Day Plan

Sunday Monday Tuesday Wednesday Thursday Friday Saturday

Splunk Install and

Profile Configuration

Initial Config and

Data Onboarding

Apps, Add-ons,

and Sourcetype

planning

Data Onboarding

– Network

Sourcetypes

Data Onboarding –

Windows Data

Search and

Reporting – Basic

Search

Alerts Dashboards Loading Apps and

Add-ons

Search and

Reporting –

Searching II

Splunk

Fundamentals I

Class –

Modules1 - 6

Splunk

Fundamentals I

Class –

Modules 7 - 12

Knowledge

Objects

Apps and

Add-ons - II

Apps and

Add-ons - III

Splunk your Car

Dashboards - II Alerts - II Search and

Reporting –

Searching III

Create a Simple

App

Dashboards - III Splunk Your

Thermostat

Review

Fundamentals I

material

Splunk Core

Certified User

Test

Your Journey to Become a Lean, Mean, Splunkin’ Machine

Page 28: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

Q&A Alan Ivarson | Splunk Staff Cloud Architect

Matt Portnoy | Splunk Senior Sales Engineer

Page 29: Splunk P30X: Become a lean, mean, Splunkin’ …...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any

© 2018 SPLUNK INC.

Don't forget to rate this session

in the .conf18 mobile app

Thanks!


Exciting, To-Be-Announced Platform Session...or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature

Splunk Electrifiednot be incorporated into any contract or other commitment.Splunk undertakes no obligation either to develop the features or functionalities described or to include

Splunk user group - automating Splunk with Ansible

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Fortscale Splunk Integrationinfo.fortscale.com/hubfs/UEBA Content/Fortscale Splunk Integration.pdf · Fortscale Splunk Integration ... Fortscale digests access and authentication

データ分析プラットフォーム「Splunk」 - Panasonicdl.it-sol.jpn.panasonic.com/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Marianne*Faro* Daniel*Koops** GijsWobben - SplunkConf · PDF fileincorporated*into*any*contractor*other*commitment.*Splunk*undertakes*no*obligaon*either*to*develop* ... 9/21/2016 10:13:10

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

FLASHSTACK CI FOR SPLUNK REFERENCE ARCHITECTURE or new to Splunk, you want to design a solution that will not go through peaks and valleys of performance and scale as Splunk takes

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk App for StreamMany Solutions, One Goal. Some history •Splunk acquires Cloudmeter, December 2013 •Renamed Splunk App for Stream •Released with Splunk 6.0 (August, 2014)

Splunk Enterprise Product Brief - Deutsche Messe AG...You can deploy Splunk Enterprise on-premises or in the cloud, use it as a SaaS service via Splunk Cloud, or in any combination

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Splunk in Rakuten: Splunk as a Service for all

Splunk For IT Operational Intelligenceuploads.integrity360.com/1425903243-Splunk-for-IT-Operations.pdf · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper

Full*Stack** Splunk*Development or* “How*to*Build*a Splunk ... · Agenda! Team* Idea Implementaons* Architecture* Challenges* Final*SoluIon* Tips’n’Tricks Future* 3

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Splunk Enterprise Product Brief · 2020-01-07 · You can deploy Splunk Enterprise on-premises or in the cloud, use it as a SaaS service via Splunk Cloud, or in any combination you

Splunk conf2014 - Splunk for Data Science

Leveraging*Splunk*AnalyDcs*For*Business* … · incorporated*into*any*contractor*other*commitment.*Splunk*undertakes*no*obligaon*either*to ... ANALYTICS* DIGITAL* MARKETING ... New*Advanced*Visualizaon*OpDons*In

SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk for Security - exportbg_ca/documents/web...Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

Netfilter Iptables for Splunk Documentation - Read the Docs · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users

Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers

Applications with Building Splunk UI and · Splunk undertakes no obligation either to develop the features or functionalities described or to include any such feature or functionality

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

2016-04-18 Fight against Phishing with Splunk - · PDF fileSplunk undertakes no obligation either to develop the featuresor functionality ... 2016-04-18 Fight against Phishing with