Admin Table of Contents Page

Getting Started

• About The Getting Started Section
• Installation
• Start Splunk For The First Time
• Administration Basics
• Change Defaults
• Find And Index Data
• Add More Users
• Start Searching

How Splunk Works

• How Splunk Works

Configuring a Splunk Deployment

• About The Deployment Section
• Choose A Deployment Model
• Decide How Splunk Should Index Your Data
• Install Splunk On Every Host
• Configure The Receiving Servers
• Configure The Forwarding Servers
• Set Up The Deployment Server

Data Inputs

• How Input Configuration Works
• Configure Inputs Via SplunkWeb
• Configure Inputs Via The CLI
• Configure Inputs Via Inputsconf
• Index SNMP Events With Splunk
• Scripted Inputs
• Add Binary Files
• File Whitelisting Blacklisting

Hosts

• How Host Works
• Set Default Host For A Splunk Server
• Define Host Assignment For An Input
• Tag Hosts
• Extract Host Per Event

Source Types

• How Source Types Work
• Set Source Type For An Input
• Set A Source Type For A Source
• Train Splunk On A Sourcetype
• Create An Alias For A Source Type
• Rulebased Association Of Sourcetypes

Timestamp Recognition

• How Splunk Recognizes Timestamps
• Configure Splunk To Recognize A Timestamp
• Train Splunk To Recognize Timestamps
• How To Configure Timezone Offsets
• Tune Timestamping

Events

• How Events Work
• Large Events
• Multiline Events
• Mask Sensitive Data In An Event
• Character Set

Event Types

• How Event Types Work
• Save Event Types Via SplunkWeb
• Tag Event Types
• Configure Autodiscovery
• Configure Eventtypesconf

Meta Events

• How Meta Events Work
• Configure Meta Events

Fields

• How Fields Work
• Create Additional Search Fields
• Define Additional Extracted Fields
• Field Actions
• Define Extracted Fields In Meta Events

Segmentation

• How Segmentation Works
• Configure Segmentation
• Enable Custom Segmentation

Saved Searches and Alerts

• How Saved Searches Work
• Set Up Saved Searches
• Set Up Alerts
• Send SNMP Traps
• Send Syslog Events
• Form Searches

Authentication

• How Authentication Works
• SSL
• Set Up Users
• Set Up LDAP

Granular Access Control

• How Granular Access Control Works
• Configure Access Controls

Data Distribution

• How Data Distribution Works
• Enable Forwarding And Receiving
• Configure Outputsconf
• Set Up Routing
• Route Data To Thirdparty Systems
• Enable Cloning
• Set Up SSL
• Set Up Data Balancing
• Filtering And Routing
• Route Specific Events To An Alternate Index

Distributed Search

• How Distributed Search Works
• Enable Distributed Search Via SplunkWeb
• Enable Distributed Search Via The CLI
• Configuration Files For Distributed Search
• Users In A Distributed Search Setup
• Exclude Specific Splunk Servers From Distributed Searches

Deployment Server

• How The Deployment Server Works
• Configure A Splunk Deployment Server
• Configure Deployment Clients
• Configuration Changes After Initial Deployment
• Using Splunk With 3rd Party Configuration Management Systems

Index Management

• How Index Management Works
• Add Or Remove An Index
• Move An Index
• Disk Usage
• Set Retirement Policy
• Automate Archiving
• Restore Archived Data
• Export Event Data
• Use Separate Partitions For Splunks Datastore
• Use WORM Write Once Read Many Volumes For Splunks Datastore
• Delete Data From The Index

Bundles

• What Are Bundles
• How To Create A Bundle
• Configure Bundles
• Bundle Directory Structure
• Bundle Precedence
• Bundle Best Practice

SplunkBase

• Why Use SplunkBase
• Sharing Addons On SplunkBase
• Finding And Downloading Addons On SplunkBase
• Looking Up Events On SplunkBase
• Security And Privacy Considerations
• Control User Access To SplunkBase

Performance Tuning

• Performance Tuning Splunk
• Indexing Performance
• Search Performance
• Storage Efficiency
• CPU And Memory Footprint
• MultiCPU Servers
• 64bit Operating Systems
• Virtual Machines

Routine Maintenance

• System Backups
• Monitoring Splunk

How-To

• Make SplunkWeb Search Faster
• Harden A Splunk Server
• Secure Network Connections
• Restore A Failed Server
• Change Data Policy To Recover Space
• Anonymize Data Samples
• Public Server Setup
• Determine Daily Volume
• Set Up Autorefresh
• Upgrade Your License For More Data
• How To Use Splunk 2 Nagios
• Restore A Blocked License
• Customize The Builtin Help Module
• Configure GUI Timeout
• Configure The Get Started Module
• Disable SplunkWeb
• Configure OPSEC LEA Input
• Place Splunk Behind A Web Proxy
• Cancel Search
• Strip Syslog Headers Before Processing
• Reconstitute Logs
• Enable HTTPS

Troubleshooting

• Splunkd Is Down
• Splunk Logfiles
• License Issues
• Unable To Get A Properly Formatted Response From The Server
• Contact Support

Reference

• Splunk CLI
• Pretrained Source Types
• Configuration File List
• Accesscontrolsconf
• Alertactionsconf
• Authconf
• Deploymentconf
• Eventdiscovererconf
• Eventtypesconf
• Fieldactionsconf
• Indexesconf
• Inputsconf
• Literalsconf
• Metaeventsconf
• Outputsconf
• Prefsconf
• Propsconf
• Savedsearchesconf
• Segmentersconf
• Serverconf
• Transformsconf
• Userseedconf
• Webconf

* Use {{#topic:Display Name}} to assign within a bullet. Place topic tags below proper section name.