TIPS & TRICKS

Splunk Base 2.0

Two-dot-oh is out the door! I’m excited to announce that the new Splunk Base represents a big step forward in fostering collaborative troubleshooting, with the introduction of our Splunk-fortified wiki system. I usually don’t get giddy over my projects, but I have to say that there are some very cool features. This sentiment is starting to be echoed by many others, like CNet and Computerworld.

First on the list is the integrated forum system. The main wiki engine is used to parse forum posts, meaning that you can use the wiki words, and all the wiki syntax in any forum post. Additionally, like all objects in Splunk Base, the discussions can be tagged, which then link them to other simliarly tagged wiki entries, event types, and source types. Splunk Base also makes creating new forums a snap. If you want a new forum dedicated to Python Twisted troubleshooting, you create a wiki word like forum:PythonTwisted from any wiki page. Splunk Base will ask for a description, and then you’ll have a new forum ready to go!

Things start to get interesting when you start to use the inline typing feature in the wiki engine. In short, any text that you place inside a <code> block is checked against all the event types that Splunk knows about. If a match occurs, the type and related tags are automatically appended to the entry. A typical scenario is this: you have an error message that you need help with; you post it to the Splunk Base forums; the inline typing recognizes it and links to the event type wiki page with an explanation of the error message; done. Without waiting for a reply from another user, you have a solution, a list of related error event types and wiki descriptions.

Just like Amazon is thriving off of the so called “long tail”, I believe Splunk Base can do the same with aggregating bits of troubleshooting information for a wide range of applications. The combination of the wiki, dynamic forums, and Splunk typing information seems perfectly suited to fostering an active community of troubleshooters.

Splunk
Posted by

Splunk

Join the Discussion