Admin Table of Contents Page

About the Splunk Admin Manual

• What's in the Admin Manual

How Splunk Works

• Overview Of Splunk

Getting Started

• Start Splunk
• Administration Basics
• Change Defaults
• Find And Index Data
• Add More Users
• Start Searching

Data Inputs

• How Input Configuration Works
• Files And Directories
• Network Ports
• Encrypted Inputs
• FIFO
• Scripted Inputs
• Whitelist And Blacklist Rules
• Crawl
• Windows Inputs
• Windows Management Interface WMI Input
• Windows Registry Input

Data Distribution

• How Data Distribution Works
• Enable Forwarding And Receiving
• Configure Target Groups In Outputsconf
• Set Up Routing
• Route Specific Events To Different Queues
• Route Specific Events To An Alternate Index
• Set Up SSL
• Enable Cloning
• Set Up Data Balancing
• Route Data To Thirdparty Systems

Indexing

• How Indexing Works
• Index Multiline Events
• Configure Segmentation
• Configure Custom Segmentation For A Host Source Or Source Type
• Mask Sensitive Data In An Event
• Configure Character Set Encoding
• Dynamic Metadata Assignment

Timestamps

• How Splunk Extracts Timestamps
• Configure Timestamp Extraction
• Apply Timezone Offsets
• Recognize European Date Format
• Configure Positional Timestamp Extraction
• Tune Timestamp Extraction For Better Indexing Performance
• Train Splunk To Recognize A Timestamp

Fields

• How Fields Work
• Create Fields Via Splunk Web
• Create Fields Via Configuration Files
• Create Indexed Fields Via Configuration Files
• Field Actions
• Configure Fieldsconf
• Configure Multivalue Fields
• Configure Tags
• Automatic Headerbased Field Extraction

Hosts

• How Host Works
• Set Default Host For A Splunk Server
• Define Host Assignment For An Input
• Tag Hosts
• Extract Host Per Event

Source Types

• How Source Types Work
• Rulebased Association Of Source Types
• Set Source Type For An Input
• Set Source Type For A Source
• Train Splunk To Recognize A Source Type
• Source Type Settings In Propsconf
• Configure A Source Type Alias

Event Types

• How Event Types Work
• Save Event Types Via Splunk Web
• Configure Eventtypesconf
• Tag Event Types
• Event Type Discovery
• Event Type Templates
• Dynamic Event Rendering

Transaction Types

• How Transactions Work
• Transaction Types Via Configuration Files
• Transaction Search

Search

• How Search Works
• Set Up Saved Searches Via Splunk Web
• Set Up Saved Searches Via Savedsearchesconf
• Create A Form Search
• Macro Searches
• Manually Configure Summary Indexing
• Live Tail

Distributed Search

• How Distributed Search Works
• Enable Distributed Search Via Splunk Web
• Enable Distributed Search Via The CLI
• Configure Distributed Search Via Distsearchconf
• Exclude Specific Splunk Servers From Distributed Searches

Alerts

• How Alerts Work
• Set Up Alerts Via Splunk Web
• Set Up Alerts Via Savedsearchesconf
• Scripted Alerts
• Customize Alert Options
• Send SNMP Traps

Security

• Security Options
• Enable HTTPS
• SSL
• Configure Roles
• Set Up LDAP
• Scripted Authentication
• File System Change Monitor
• Audit Events
• Audit Event Signing
• Event Hashing
• IT Data Signing
• Archive Signing

Data Management

• Splunk Data Management
• Create An Index
• Remove Delete Data
• Export Event Data
• Move An Index
• Set A Retirement And Archiving Policy
• Automate Archiving
• Restore Archived Data
• Back Up Your Data
• Disk Usage
• Use Separate Partitions For Splunks Datastore
• Use WORM Write Once Read Many Volumes For Splunks Datastore

Deployment Server

• How The Deployment Server Works
• Configure A Splunk Deployment Server
• Configure Server Classes
• Configure Deployment Clients
• Sync The Server And Client

Performance Tuning

• Performance Tuning Splunk
• Indexing Performance
• Search Performance
• Storage Efficiency
• CPU And Memory Footprint
• MultiCPU Servers
• 64bit Operating Systems

Configuration Files

• How Do Configuration Files Work
• Configure Application Directories
• Configuration File List

Applications

• About Applications
• About Splunks Application Manager
• Install Splunk Applications

Reference

• Pretrained Source Types
• Splunk Log Files
• Work With Metricslog
• Log File Rotation
• Determine What Files Splunk Is Monitoring
• Index SNMP Events With Splunk
• Log4j
• Strip Syslog Headers Before Processing
• Wildcards
• Alertactionsconf
• Appconf
• Auditconf
• Authenticationconf
• Authorizeconf
• Commandsconf
• Crawlconf
• Decorationsconf
• Deploymentconf
• Distsearchconf
• Eventdiscovererconf
• Eventtypesconf
• Fieldactionsconf
• Fieldsconf
• Indexesconf
• Inputsconf
• Limitsconf
• Literalsconf
• Multikvconf
• Outputsconf
• Prefsconf
• Propsconf
• Regmonfiltersconf
• Restmapconf
• Savedsearchesconf
• Segmentersconf
• Serverconf
• Setupconf
• Sourceclassifierconf
• Sourcetypesconf
• Streamsconf
• Stringsconf
• Sysmonconf
• Tagsconf
• Transactiontypesconf
• Transformsconf
• Userseedconf
• Webconf
• Wmiconf

Troubleshooting

• Contact Support
• Splunkd Is Down
• License Issues
• Anonymize Data Samples
• Unable To Get A Properly Formatted Response From The Server
• Command Line Tools

* Use {{#topic:Display Name}} to assign within a bullet. Place topic tags below proper section name.