Admin Table of Contents Page

How Splunk Works

• Overview Of Splunk

Getting Started

• Start Splunk
• Administration Basics
• Change Defaults
• Find And Index Data
• Add More Users
• Start Searching

Data Inputs

• How Input Configuration Works
• Configure Inputs Via Splunk Web
• Configure Inputs Via The CLI
• Configure Inputs Via Inputsconf
• Configure Inputs For Windows
• Scripted Inputs
• Configure Whitelist And Blacklist Rules
• Log File Rotation
• Strip Syslog Headers Before Processing
• Determine What Files Splunk Is Tailing
• Index SNMP Events With Splunk
• Log4j

Data Distribution

• How Data Distribution Works
• Enable Forwarding And Receiving
• Configure Outputsconf
• Set Up Routing
• Filtering And Routing
• Route Specific Events To An Alternate Index
• Set Up SSL
• Enable Cloning
• Set Up Data Balancing
• Route Data To Thirdparty Systems

Indexing

• How Indexing Works
• Configure Event Boundaries
• Configure Segmentation
• Enable Custom Segmentation
• Mask Sensitive Data In An Event
• Character Set
• Dynamic Metadata Assignment

Timestamps

• How Timestamp Extraction Works
• Configure Timestamp Extraction
• Configure Timezone Offsets
• Configure European Date Formats
• Configure Positional Timestamp Extraction
• Tune Timestamp Extraction For Better Indexing Performance
• Train Splunk To Recognize A Timestamp

Fields

• How Fields Work
• Create Indexed Fields Via Configuration Files
• Create Extracted Fields Via Configuration Files
• Create Extracted Fields Via Splunk Web
• Field Actions
• Configure Fieldsconf
• Configure Multivalue Fields

Hosts

• How Host Works
• Set Default Host For A Splunk Server
• Define Host Assignment For An Input
• Tag Hosts
• Extract Host Per Event

Source Types

• How Source Types Work
• Set Source Type For An Input
• Set Source Type For A Source
• Train Splunk On A Source Type
• Create An Alias For A Source Type
• Rulebased Association Of Sourcetypes
• Source Type Settings In Propsconf

Event Types

• How Event Types Work
• Save Event Types Via Splunk Web
• Configure Eventtypesconf
• Tag Event Types
• Event Type Discovery
• Event Type Templates
• Dynamic Event Rendering

Transaction Types

• How Transaction Types Work
• Transaction Types Via Configuration Files
• Transaction Search

Search

• How Search Works
• Set Up Saved Searches
• Set Up Saved Searches Via Savedsearchesconf
• Set Up Alerts Via Splunk Web
• Set Up Alerts Via Savedsearchesconf
• Customize Alert Options
• Form Searches
• Macro Searches
• Live Tail
• Send Syslog Events
• Send SNMP Traps

Distributed Search

• How Distributed Search Works
• Enable Distributed Search Via Splunk Web
• Enable Distributed Search Via The CLI
• Configure Distributed Search Via Distsearchconf
• Exclude Specific Splunk Servers From Distributed Searches

Security

• Security Options
• Enable HTTPS
• SSL
• Configure Roles
• Set Up LDAP
• Scripted Authentication
• File System Change Monitor
• Audit Events
• Audit Event Signing
• Event Hashing
• IT Data Signing
• Archive Signing

Data Management

• How Index Management Works
• Add Or Remove An Index
• Remove Delete Data
• Move An Index
• Set Retirement Policy
• Automate Archiving
• Restore Archived Data
• Export Event Data
• Disk Usage
• Use Separate Partitions For Splunks Datastore
• Use WORM Write Once Read Many Volumes For Splunks Datastore

Deployment Server

• How The Deployment Server Works
• Configure A Splunk Deployment Server
• Configure Server Classes
• Configure Deployment Clients
• Sync The Server And Client

Performance Tuning

• Performance Tuning Splunk
• Indexing Performance
• Search Performance
• Cache Report Results
• Storage Efficiency
• CPU And Memory Footprint
• MultiCPU Servers
• 64bit Operating Systems
• Splunk Backup Options

Configuration Files

• How Do Configuration Files Work
• Configure Bundle Directories
• Configuration File List

Applications

• How Applications Work
• Install Splunk Applications

Reference

• Splunk Logfiles
• Pretrained Source Types
• Alertactionsconf
• Auditconf
• Authenticationconf
• Authorizeconf
• Decorationsconf
• Deploymentconf
• Distsearchconf
• Eventdiscovererconf
• Eventtypesconf
• Fieldsconf
• Fieldactionsconf
• Indexesconf
• Inputsconf
• Literalsconf
• Multikvconf
• Outputsconf
• Prefsconf
• Propsconf
• Propsconf Cont
• Restmapconf
• Savedsearchesconf
• Segmentersconf
• Serverconf
• Sourceclassifierconf
• Sourcetypesconf
• Streamsconf
• Transactiontypesconf
• Transformsconf
• Userseedconf
• Webconf

Troubleshooting

• Contact Support
• Splunkd Is Down
• License Issues
• Anonymize Data Samples
• Unable To Get A Properly Formatted Response From The Server
• Command Line Tools

* Use {{#topic:Display Name}} to assign within a bullet. Place topic tags below proper section name.