Data Analytics Using Splunk 9.x

Make the most of Splunk 9.x to build insightful reports and dashboards with a detailed walk-through of its extensive features and capabilities

Key Features

• Be well-versed with the Splunk 9. x architecture, installation, onboarding, and indexing data features
• Create advanced visualizations using the Splunk search processing language
• Explore advanced Splunk administration techniques, including clustering, data modeling, and container management

Book Description

Splunk 9 improves on the existing Splunk tool to include important features such as federated search, observability, performance improvements, and dashboarding. This book helps you to make the best use of the impressive and new features to prepare a Splunk installation that can be employed in the data analysis process.

Starting with an introduction to the different Splunk components, such as indexers, search heads, and forwarders, this Splunk book takes you through the step-by-step installation and configuration instructions for basic Splunk components using Amazon Web Services (AWS) instances. You’ll import the BOTS v1 dataset into a search head and begin exploring data using the Splunk Search Processing Language (SPL), covering various types of Splunk commands, lookups, and macros. After that, you’ll create tables, charts, and dashboards using Splunk’s new Dashboard Studio, and then advance to work with clustering, container management, data models, federated search, bucket merging, and more.

By the end of the book, you’ll not only have learned everything about the latest features of Splunk 9 but also have a solid understanding of the performance tuning techniques in the latest version.

What you will learn

• Install and configure the Splunk 9 environment
• Create advanced dashboards using the flexible layout options in Dashboard Studio
• Understand the Splunk licensing models
• Create tables and make use of the various types of charts available in Splunk 9.x
• Explore the new configuration management features
• Implement the performance improvements introduced in Splunk 9.x
• Integrate Splunk with Kubernetes for optimizing CI/CD management

Who this book is for

The book is for data analysts, Splunk users, and administrators who want to become well-versed in the data analytics services offered by Splunk 9. You need to have a basic understanding of Splunk fundamentals to get the most out of this book.

Table of Contents

1. Introduction to Splunk and its Core Components
2. Setting Up the Splunk Environment
3. Onboarding and Normalizing Data
4. Introduction to SPL
5. Reporting Commands, Lookups, and Macros
6. Creating Tables and Charts Using SPL
7. Creating Dynamic Dashboards
8. Licensing, Indexing, and Buckets
9. Clustering and Advanced Administration
10. Data Models, Acceleration, and Other Ways to Improve Performance
11. Multisite Splunk Deployments and Federated Search
12. Container Management

Dr. Nadine Shillingford is a certified Splunk Architect with 10 years of security consulting experience. She has installed, managed, and configured large-scale and large-volume Splunk deployments in the healthcare, retail, insurance, and federal spaces. In addition, Dr. Shillingford has teaching experience at the undergraduate and graduate levels. Dr. Shillingford holds a Ph.D. in computer science from the University of Notre Dame. She is an artist and the mother of a teenage daughter.