Splunk.com | SplunkBase | Support

Documentation: 3.2.2

| Print Version Contents

How Splunk Works
- Overview of Splunk
Getting Started
- Start Splunk
- Administration basics
- Change defaults
- Find and index data
- Add more users
  - Splunk local users
- Start searching
Data Inputs
- How input configuration works
- Configure inputs via Splunk Web
  - Configuration
- Configure inputs via the CLI
  - Data input commands
  - Data input types
- Configure inputs via inputs.conf
- Configure inputs for Windows
- Scripted inputs
  - Configuration
  - Example
- Configure whitelist and blacklist rules
- Log file rotation
  - How log rotation works
- Strip syslog headers before processing
  - Configuration
  - Example
- Determine what files Splunk is tailing
  - Run listtails
- Index SNMP events with Splunk
- log4j
Data Distribution
- How data distribution works
- Enable forwarding and receiving
- Configure outputs.conf
  - Configuration
  - Example
- Set up routing
  - Configuration
  - Examples
- Filtering and routing
  - Configuration
  - Example
- Route specific events to an alternate index
  - Configuration
  - Example
- Set up SSL
  - Forwarder
  - Receiver
- Enable cloning
- Set up data balancing
  - Configuration
  - Example
- Route data to third-party systems
  - Configuration
  - Example
Indexing
- How indexing works
  - How events work
  - How segmentation works
- Configure event boundaries
  - Configuration
  - Examples
- Configure segmentation
- Enable custom segmentation
  - Configuration
  - Example
- Mask sensitive data in an event
  - Configuration
- Character set
  - Character set specification
- Dynamic metadata assignment
  - Configuration
  - Set values with a script
Timestamps
- How timestamp extraction works
  - Precedence rules for timestamp assignment
  - Configure timestamps
- Configure timestamp extraction in props.conf
- Configure timezone offsets
- Configure European date formats
  - Configure European date format in literals.conf
  - Use the timeformat modifier
- Configure positional timestamp extraction
  - Configure positional timestamp extraction in props.conf
- Tune timestamp extraction for better indexing performance
  - Adjust timestamp lookahead
  - Turn off the timestamp processor
- Train Splunk to recognize a timestamp
Fields
- How fields work
- Create indexed fields via configuration files
  - Configuration
  - Example
- Create extracted fields via configuration files
- Create extracted fields via Splunk Web
  - Configuration
- Field actions
  - Configuration
- Configure fields.conf
  - Configuration
- Configure multi-value fields
  - Configure multi-value fields in fields.conf
  - Example
Hosts
- How host works
- Set default host for a Splunk server
  - via Splunk Web
  - via configuration files
- Define host assignment for an input
  - Statically
  - Dynamically
- Tag hosts
  - via Splunk Web
  - Host tags vs host names
- Extract host per event
  - Configuration
  - Example
Source Types
- How source types work
- Set source type for an input
- Set source type for a source
  - via configuration files
- Train Splunk on a source type
  - via the CLI
- Create an alias for a source type
  - via Splunk Web
- Rule-based association of sourcetypes
  - Configuration
  - Examples
- Source type settings in props.conf
Event Types
- How event types work
- Save event types via Splunk Web
  - Configuration
- Configure eventtypes.conf
- Tag event types
  - Configuration
- Event type discovery
  - Configure event types
- Event type templates
  - Configuration
  - Example
- Dynamic event rendering
Transaction Types
- How transaction types work
  - Define transactions
  - Sample use cases
- Transaction types via configuration files
  - Configuration
  - Example
- Transaction search
  - Transactions and macro search
Search
- How search works
- Set up saved searches
  - via Splunk Web
- Set up saved searches via savedsearches.conf
  - Configuration
  - Example
- Set up alerts via Splunk Web
  - Set up an alert
  - Specify which fields to show
- Set up alerts via savedsearches.conf
- Customize alert options
  - Email options
  - Additional alert customizations
- Form searches
- Macro searches
  - Configure a macro search
- Live Tail
- Send syslog events
  - Configuration
  - Example
- Send SNMP traps
  - Configuration
Distributed Search
- How distributed search works
  - Known issues with distributed search
- Enable distributed search via Splunk Web
- Enable distributed search via the CLI
  - Configuration
- Configure distributed search via distsearch.conf
  - Configuration
  - Example
- Exclude specific Splunk servers from distributed searches
Security
- Security options
  - Authentication
  - Audit
- Enable HTTPS
  - Configuration
  - Certs
- SSL
  - Configuration
- Configure roles
  - Configuration
  - Example
- Set up LDAP
- Scripted authentication
  - Commands
  - Example
- File system change monitor
  - How the file system change monitor works
  - Configure the file system change monitor
- Audit events
- Audit event signing
  - How audit event signing works
  - Configure audit event signing
- Event hashing
- IT data signing
- Archive signing
Data Management
- How index management works
  - Data management
  - Configuration files for index management
- Add or remove an index
  - Create an index
  - Delete an index
- Remove (delete) data
- Move an index
  - Configuration
- Set retirement policy
  - Remove files beyond a certain size
  - Remove files beyond a certain age
- Automate archiving
  - Use Splunk's index aging policy to archive
- Restore archived data
  - Restore with resurrect
  - Restore a copied index archive
- Export event data
  - via the CLI
  - via Splunk Web
- Disk usage
  - Set minimum free disk space
  - Set database size
- Use separate partitions for Splunk's datastore
  - Set up separate partitions
- Use WORM (Write Once Read Many) volumes for Splunk's datastore
  - Set up a WORM datastore
Deployment Server
- How the deployment server works
  - Communication between deployment server and client
  - Configuration files for deployment server
- Configure a Splunk Deployment Server
  - Configuration
  - Example
- Configure server classes
  - Configuration
  - Example
- Configure deployment clients
- Sync the server and client
  - Configuration changes
Performance Tuning
- Performance tuning Splunk
- Indexing performance
- Search performance
- Cache report results
- Storage efficiency
- CPU and memory footprint
  - Improve CPU usage
  - Improve memory usage
- Multi-CPU servers
  - indexes.conf
- 64-bit operating systems
  - indexes.conf
- Splunk backup options
  - Back up configurations
  - Back up your entire installation
Configuration Files
- How do configuration files work?
  - Configuration file directory structure
  - Configuration file precedence
- Configure bundle directories
  - Make a bundle directory
  - Bundle best practice
- Configuration file list
Applications
- How applications work
- Install Splunk applications
Reference
- Splunk Command Line Interface (CLI)
  - CLI commands
  - auth and uri parameters
  - Note for Mac users
- Splunk logfiles
  - Internal logs
  - debug
  - log.cfg
- Pre-trained source types
  - Automatically recognized source types
  - Pre-trained source types
- alert_actions.conf
  - alert_actions.conf.spec
  - alert_actions.conf.example
- audit.conf
  - audit.conf.spec
  - audit.conf.example
- authentication.conf
  - authentication.conf.spec
  - authentication.conf.example
- authorize.conf
  - authorize.conf.spec
  - authorize.conf.example
- decorations.conf
  - decorations.conf.spec
  - decorations.conf.example
- deployment.conf
  - deployment.conf.spec
  - deployment.conf.example
- distsearch.conf
  - distsearch.conf.spec
  - distsearch.conf.example
- eventdiscoverer.conf
  - eventdiscoverer.conf.spec
  - eventdiscoverer.conf.example
- eventtypes.conf
  - eventtypes.conf.spec
  - eventtypes.conf.example
- fields.conf
  - fields.conf.spec
  - fields.conf.example
- field_actions.conf
  - field_actions.conf.spec
  - field_actions.conf.example
- indexes.conf
  - indexes.conf.spec
  - indexes.conf.example
- inputs.conf
  - inputs.conf.spec
  - inputs.conf.example
- literals.conf
  - literals.conf.spec
  - literals.conf.spec
- multikv.conf
  - multikv.conf.spec
  - Example
- outputs.conf
  - outputs.conf.spec
  - outputs.conf.example
- prefs.conf
  - prefs.conf.spec
  - prefs.conf.example
  - prefs.conf.example
- props.conf
  - props.conf.spec
- props.conf (cont)
  - props.conf.spec, continued
  - props.conf.example
- restmap.conf
  - restmap.conf.spec
  - restmap.conf.spec
- savedsearches.conf
  - savedsearches.conf.spec
  - savedsearches.conf.example
- segmenters.conf
  - segmenters.conf.spec
  - segmenters.conf.example
- server.conf
  - server.conf.spec
  - server.conf.example
- source-classifier.conf
  - Configuration
  - Example
- sourcetypes.conf
  - Configuration
  - Example
- streams.conf
  - streams.conf.example
- transactiontypes.conf
  - transactiontypes.conf.spec
  - transactiontypes.conf.example
- transforms.conf
  - transforms.conf.spec
  - transforms.conf.example
- user-seed.conf
  - user-seed.conf.spec
  - user-seed.conf.example
- web.conf
  - web.conf.spec
  - web.conf.example
Troubleshooting
- Contact Support
- Splunkd is down
  - Splunkd may need a few more seconds to come up
  - Your license file contains line-breaks or other hidden characters
- License issues
- Anonymize data samples
  - Simple method
  - Advanced method
- Unable to get a properly formatted response from the server
- Command line tools
  - btool
  - classify
  - exporttool
  - gzdumper
  - listtails
  - locktest
  - locktool
  - parsetest
  - pcregextest
  - regextest
  - searchtest
  - signtool
  - tsidxprobe

This page last updated: 04/16/08 02:04pm

Event type templates

Create an event type based on a field via eventtypes.conf. For example:

[$NAME %$FIELD%]
$SEARCH_QUERY

Event type templates works a lot like macro searches: %$FIELD% gets filled in at search time with field=foo or field=bar, etc -- whatever the search query yields for that event type's field.

Configuration

When setting the name in eventtypes.conf, follow these specifications:

[$EVENTTYPE]

Header for the event type
$EVENTTYPE is the name of your event type.
You can have any number of event types, each represented by a stanza and any number of the following attribute/value pairs.
- NOTE: If the name of the event type includes field names surrounded by the percent character (e.g. "%$FIELD%") then the value of $FIELD is substituted into the event type name for that event.

Example

[cisco-%code%]
cisco

If "code=432", this event type becomes "cisco-432".

Previous: Event type discovery | Next: Dynamic event rendering

Comments

No comments have been submitted.

Log in to comment.