Index: The repository for data. When the Splunk platform indexes raw data, it transforms
the data into searchable events.
Indexer : A Splunk Enterprise instance that indexes data, transforming raw data
into events and placing the results into an index. It also searches the indexed data in response
to search requests.
Search head : is the component used for interacting with Splunk. It provides a graphical user interface
to users for performing various operations. You can search and query the data stored in the Indexer by
entering search words and you will get the expected result.
A Splunk search head cluster is a group of Splunk Enterprise search heads that serves as a central
resource for searching. As the central source for searching, the cluster is a group of networked searched
heads that share configurations, apps, search artifacts, and job scheduling.
Telnet : a network protocol that allows a user on one computer to log into another computer that is part of the
same network.
Server:- A server is simply a computer that listens for incoming requests.
Though there are machines made and optimized for this particular purpose,
any computer that is connected to a network can act as a server. In fact, you
will often use your very own computer as server when developing apps.
What are the clients?
The clients are anything that send requests to the back-end. They are often
browsers that make requests for the HTML and JavaScript code that they will
execute to display websites to the end user. However, there are many different
kinds of clients: they might be a mobile application, an application running on
another server, or even a web enabled smart appliance.
Nati Tasew, [10/10/2022 12:33 PM]
2nd Week Assignment
————————————
Using Splunk Technology Add on for Data Onboarding:-
1. Download Splunk_TA_windows from
https://splunkbase.splunk.com/app/742.
2. Install the above downloaded file as new app using "install app from file"
option in local splunk instance.
3. Navigate to the splunk installed directory (mostly it should be c:\Program
Files\splunk) and go inside etc\apps\Splunk_TA_windows\default directory.
4. Edit the inputs.conf file to enable [WinEventLog:Security] and route data to
windows index
5. Before step 4, create index Windows using settings->Indexes option.
6. Check the data in Splunk by searching index=Windows
Onboard xml data and parse it, use LINE_BREAKER , MUST_BREAK_AFTER
1. Onboard below xml data using Add Data-> upload option
2. Apply event breaking properties so that every book is a new event.
Regards,
Nitesh Sharma
Data Parsing Formate:
Timestamp : 2017-08-08 22:38:24
Logging_Priority : 331
Log_Level : INFO
Connection_factory : [XYZXYZ]
Thread_Number : (httpXYSGHFA 10.100.1234.12-1234-81)
Application_Message : 22:38:24,331 INFO [APP_INVOKE_MSG] APP Response [
ID_123SDFBH//-1/NO,RULE.ID:1:1=below minimum value (0) ]
Data integration tools are software-based tools that ingest, consolidate, transform, and transfer data
from its originating source to a destination, performing mappings, and data cleansing. The tools you
add have the potential to simplify your process.
ETL tools enable data integration strategies by allowing companies to gather data from multiple
data sources and consolidate it into a single, centralized location. ETL tools also make it possible for
different types of data to work together.
Data warehousing is a technology that aggregates structured data from one or more sources so that
it can be compared and analyzed for greater business intelligence
Data Warehousing integrates data and information collected from various sources into one
comprehensive database. For example, a data warehouse might combine customer information from an
organization's point-of-sale systems, its mailing lists, website, and comment cards.