Documentation: 3.3
|  Print Version Contents
This page last updated: 08/05/08 04:08pm

Overview of Splunk

Splunk is search software for any type of data. Learn more about how Splunk works by reading through this introductory page. You'll find many links here for installing, configuring and customizing your Splunk installation.

Configuration options

Splunk has several options for configuration: a web interface (known as Splunk Web), a command line interface (known as the CLI) and its configuration files. Most of Splunk's configuration can be accomplished by using the Admin page of Splunk Web, and the CLI. Configure advanced settings through configuration files.

Installation and upgrade

Installing Splunk is easy and fast. These instructions show you how to install, upgrade, or back up an existing copy of Splunk.

  • Installation
    • Installation instructions for all supported platforms are found in the Installation Manual
    • On *nix platforms, use a tarball or RPM file.
    • On Mac, use a tarball or DMG file.
    • On Windows, download the .exe file and install. Instructions for Windows installation are located here.
  • Upgrade
    • There are a lot of new features available in 3.3. You may want to consider an upgrade if you are running an earlier version.
    • Upgrade instructions are here.

Important: It's a good idea to back up your current instance before you upgrade.

Data inputs

Splunk is capable of receiving data in a variety of ways. Configure your Splunk data inputs via:

Read on for a brief description of each input type.

  • Monitor
    • Use monitor to stream live data into Splunk.
    • Monitor works for continuous inputs from files or directories.
  • Upload
    • Upload a file directly to Splunk Web.
    • Files can be local to the workstation or on the Splunk server.
  • Network ports
    • Splunk supports UDP and TCP connections.
    • Configure syslog on UDP 514.
    • Use TCP connections for log4j.
  • Distributed
    • One Splunk Server can receive data from any number of other Splunk Servers via data distribution (description below).
    • This port is configurable, but defaults to 9998.
  • Scripted inputs
    • Use scripted inputs to receive the outputs of command-line tools (such as vmstat, iostat, netstat, top, etc.) or other programs.
    • Learn more about scripted inputs.

Note: For a more in-depth description of inputs, read how input configuration works.

Windows

Splunk for Windows comes with its own set of configuration files for setting up Windows-specific inputs, including Windows registry and WMI. Read more about configuring Windows inputs.

Distributed data

Configure distributed inputs and outputs across your network. Send data between one Splunk instance and another, or third party software. For an overview on all the available configuration options, see How data distribution works.

  • Forwarding and receiving
    • A Splunk Server in forwarding mode can send data to one or more Splunk instances.
    • Any Splunk Server can receive data from one or more Splunk instances.
    • Learn more about forwarding and receiving.
  • 3rd party systems
    • Splunk can also forward raw data to any other system or software.
    • You can set up Splunk to send or receive data from 3rd party systems. Learn how.

Indexing

Splunk takes all data from inputs and sends it to an indexing pipeline. Data is then broken up into separate events via segmentation rules. Most data is segmented and timestamped correctly. However, you may wish to configure Splunk to index your data in particular ways. Learn more about how indexing works.

Here are some things you might want to consider:

Configuration for indexing is set mostly through props.conf and transforms.conf.

Fields

Fields are a useful aspect of Splunk's search interface. You can use Splunk's built-in fields that are enabled by default. Here's a list of Splunk's default fields, including links to more in-depth documentation:

  • Source
    • The source field specifies the path to the original data input.
    • It is set automatically, but can be tagged.
  • Host
    • Host is the label for the device that originated the event.
    • Read more about host.
  • Source type
    • A source type refers to any common format of data produced by a group of sources, such as weblogic or syslog.
    • Learn more about source types.
  • Event types
    • Event types are groups of common events.
    • Learn more about event types.

You can also create your own fields. Custom fields are useful for:

To learn more about creating custom fields, see how fields work.

Search

Splunk's search interface is useful for tracking down different aspects of your data. Here are a few things you can do with your searches:

  • Search commands.
    • Splunk has a powerful search language.
    • Craft simple to sophisticated searches.
  • Save searches.
    • Any search can be saved and run at any time.
    • Save searches with variables to fill in at search time, including:
  • LiveTail
    • Run a search to watch data as it's indexed.
    • Read more about Live Tail.
  • Alerts
    • Schedule Splunk to send search results via email or RSS.
  • Summary indexing
    • Save the output of any search to a special index.
  • Transactions
    • Search for transactions that occur across events, such as email threads, store purchases

For a more detailed overview of search, see how search works.

Distributed search

In a distributed set up, you may want to search across multiple instances of Splunk. Enable distributed search to federate searches across your entire Splunk deployment. Read more about how distributed search works.

Security

Secure your Splunk server with the following security configuration options. Here's a brief overview of the available features. For a more detailed overview, see security options.

Authentication

Splunk includes several authentication options, including:

Audit

Use the following options to enable separate auditing configurations:

  • File system monitor
    • The file system change monitor watches any designated file system and sends an event if files or directories are affected in any way.
    • By default, Splunk monitors its own $SPLUNK_HOME/etc/ directory for configuration changes.
  • Audit events
    • Events generated by the file system change monitor as well as user activity within Splunk.
    • Audit events are stored in a separate index, _audit.
  • Audit event signing
    • Set up cryptographic signing for audit events.
  • IT data signing
    • Enable cryptographic signing for all your events as they enter Splunk.
  • Archive signing
    • Sign your data as it is archived.
  • Event decorations
    • Mark your audit events with icons so they're more noticeable.

Data management

Splunk servers often index large amounts of data each day. You may want to enable advanced settings to handle the following data management scenarios.

Note: Many data management settings are enabled on a per-index basis, using indexes.conf. To learn more about indexes, see how indexes work.

Deployment server

In a distributed set up, enable one or more Splunk instances as deployment servers. A deployment server pushes out configuration changes to other Splunk instances.

For a complete overview of all deployment options, read the Deployment manual. For instructions on configuring and enabling the deployment server and clients, read the Admin manual section on the deployment server.

Performance tuning

The following options help you tune Splunk's performance for your environment. Depending on your system and requirements, you may want to change one or more of the following settings:

  • Indexing
    • Change various configurations to speed up Splunk's intake of data.
  • Search
    • Settings for faster return of search results.
  • Storage efficiency
    • Cut down on the space of your Splunk index.
  • CPU and memory footprint
    • Tune Splunk's CPU usage and memory settings.
  • Backup
    • Back up your Splunk install.
    • Note: It is a good idea to backup Splunk before performing any migrations or upgrades.

A more in-depth overview of performance tuning options is available here.

Configuration files

Many of Splunk's advanced configurations and customizations are available only through configuration files. Create configurations by copying files into a custom application directory. Learn more about application directories and configuring application directories.

Applications

Applications are directories of configuration files with specific purposes. Configure your own applications by following these instructions.

You can also share your configuration file directories as applications with the Splunk community on SplunkBase.

Customization

Pimp your Splunk! Everybody's data is a little bit different. Maybe you want to set custom configurations for the system you're running Splunk on. Here are options for personalizing your Splunk instance.

Splunk Web appearance

Change various aspects of Splunk Web's appearance:

  • Dashboards
    • Configure user settings and dashboards via prefs.conf.
  • Decorations
  • Literals
    • Change the externalized strings in Splunk Web via literals.conf.
  • Skinning
    • Change the way your web interface looks.
    • Read the Developer's Guide for help with skinning Splunk.

Extend Splunk

Splunk includes a REST API. Read the Developer's Guide to learn more about the REST API. To configure additional REST endpoints, use restmap.conf.

Troubleshooting

If there's something you need help with, even after reading the documentation, contact Splunk support.

If there's a feature you don't see here that you want included, file an enhancement request with Splunk support.

We're always interested in your feedback.

Start    |    Next: Start Splunk

Comments

  1. The default username is "admin" and the password is "changeme."
    Posted by daevansjr on Jul 02 2008, 12:56pm

Log in to comment.