By Splunk May 28, 2015
.conf2015 registration is open!
We’re excited to continue our series of .conf2014 #TBT highlights, especially as .conf2015: The 6th Annual Splunk Worldwide Users’ Conference in Las Vegas is quickly approaching. This week we revisit Andrew Duca’s presentation, because getting your data into Splunk is important!
Skill Level:
Good for All Skill Levels
Solution Area:
Splunk Admin
Splunk:
Splunk Enterprise
Presentation Overview:
It’s important to get data into Splunk right the first time. This session shows you how to get the ‘important’ things right, the first time, sometimes using .conf files. Some of those important things to get right include timestamp and timezone, host extractions (which host to extract), sourcetype, line-breaking and index. Splunk’s “schema-on-the-fly” allows flexibility in field extractions, but we need to index things properly to find the data. This presentation walks customers through getting different data sources — e.g., logs, data base, API calls (JIRA, SFDC), FIX data — into Splunk with the correct parsing rules.
For the full recording, check out Onboarding Data Into Splunk.
Be sure to register for .conf2015 today and be on the lookout for more of our #TBT .conf highlights as we get closer to .conf2015: The 6th Annual Splunk Worldwide Users’ Conference in Las Vegas in September.
Cheers!
RBH
----------------------------------------------------
Thanks!
Richard Brewer-Hay