Make the most of Splunk 9.x to build insightful reports and dashboards with a detailed walk-through of its extensive features and capabilities

Key Features:

• Be well-versed with the Splunk 9. x architecture, installation, onboarding, and indexing data features
• Create advanced visualizations using the Splunk search processing language
• Explore advanced Splunk administration techniques, including clustering, data modeling, and container management

Book Description:

Splunk 9 improves on the existing Splunk tool to include important features such as federated search, observability, performance improvements, and dashboarding. This book helps you to make the best use of the impressive and new features to prepare a Splunk installation that can be employed in the data analysis process.

Starting with an introduction to the different Splunk components, such as indexers, search heads, and forwarders, this Splunk book takes you through the step-by-step installation and configuration instructions for basic Splunk components using Amazon Web Services (AWS) instances. You'll import the BOTS v1 dataset into a search head and begin exploring data using the Splunk Search Processing Language (SPL), covering various types of Splunk commands, lookups, and macros. After that, you'll create tables, charts, and dashboards using Splunk's new Dashboard Studio, and then advance to work with clustering, container management, data models, federated search, bucket merging, and more.

By the end of the book, you'll not only have learned everything about the latest features of Splunk 9 but also have a solid understanding of the performance tuning techniques in the latest version.

What You Will Learn:

• Install and configure the Splunk 9 environment
• Create advanced dashboards using the flexible layout options in Dashboard Studio
• Understand the Splunk licensing models
• Create tables and make use of the various types of charts available in Splunk 9.x
• Explore the new configuration management features
• Implement the performance improvements introduced in Splunk 9.x
• Integrate Splunk with Kubernetes for optimizing CI/CD management

Who this book is for:

The book is for data analysts, Splunk users, and administrators who want to become well-versed in the data analytics services offered by Splunk 9. You need to have a basic understanding of Splunk fundamentals to get the most out of this book.

Table of Contents

Part 1: Getting Started with Splunk

Chapter 1: Introduction to Splunk and its Core Components

Chapter 2: Setting Up the Splunk Environment

Chapter 3: Onboarding and Normalizing Data

Part 2: Visualizing Data with Splunk

Chapter 4: Introduction to SPL

Chapter 5: Reporting Commands, Lookups, and Macros

Chapter 6: Creating Tables and Charts Using SPL

Chapter 7: Creating Dynamic Dashboards

Part 3: Advanced Topics in Splunk

Chapter 8: Licensing, Indexing, and Buckets

Chapter 9: Clustering and Advanced Administration

Chapter 10: Data Models, Acceleration, and Other Ways to Improve Performance

Chapter 11: Multisite Splunk Deployments and Federated Search

Chapter 12: Container Management

About the Author

Dr. Nadine Shillingford is a certified Splunk Architect with 10 years of security consulting experience. She has installed, managed, and configured large-scale and large-volume Splunk deployments in the healthcare, retail, insurance, and federal spaces. In addition, Dr. Shillingford has teaching experience at the undergraduate and graduate levels. Dr. Shillingford holds a Ph.D. in computer science from the University of Notre Dame.