A Hands-On Guide to Splunk Enterprise Security

You will understand Splunk’s user interface -UI. You will be able to navigate UI features on your own: Navigating Splunk web: Splunk home, Splunk bar, Splunk web, getting date into Splunk, how to specify data inputs, where Splunk stores data, getting tutorial data into Splunk, using Splunk search, search actions, and modes, search results tools, events, what are fields, extracted fields, find and select fields, run more targeted searches, use the search language, learn with search assistant. You can start using the Splunk’s basic transforming commands, can create reports and dashboards, you will know how to save and share reports and also can create alerts after completing these sections. How Splunk Works: Stages in the Data PipelineSplunk is a distributed system that ingests, processes and indexes log data. Splunk processes data in three stages: Data Input Splunk ingests the raw data stream from the source, breaks it into 64K blocks, and adds metadata keys, including hostname, source, character encoding, and the index the data should be stored in. Data Storage Splunk parses log data, by breaking it into lines, identifying timestamps, creating individual events and annotating them with metadata keys. It then transforms event data using transformation rules defined by the operator. Finally, Splunk writes the parsed events to disk, pointing to them from an index file which enables fast search across huge data volumes. Data Search at this stage Splunk enables users to query, view and use the event data. Based on the users reporting needs, it creates objects like reports, dashboards and alerts. Hands-on practical videos on Enterprise Splunk Security: ES1, ES2, ES3 & ES4 will help you master Splunk!