Study Splunk

Searching on Splunk is quite simple. Just login to your Splunk Enterprise installation, navigate to App: Search & Reporting . It will bring you to a new web page which is basically our search head. Type in your query and you are done. All your events which matched your query will be presented on your screen, If you will notice below, the query which I have used have nothing much its just searching all the events from "idx_messages" index < remember we added a monitor on one of our remote host to forward the data to idx_messages index   >. Based on above search it resulted in 1068 events in last 7 days. Field names are case sensitive. Field values are not case sensitive, if used without single quotes. i.e. below queries with give us same results: index=idx_messages date_wday=monday  index=idx_messages date_wday=MONDAY index=idx_messages date_wday="MONDAY" But if I use below query it might not give me...

Walkthrough of Splunk Interface Accessible on port 8000 (default) Once installed, it will have some basic applications pre-installed. Contains a wide variety of hyperlinks/tabs to manage and play with you Splunk installation. If you need any sort of help, go to the help menu and there you can find couple of handy options like official documentation etc. Best part is, if you are stuck somewhere go to "Splunk Answers" and shoot your query. Splunk community is quite active and surely will help in getting your issue resolved.

Installing Splunk Universal Forwarder? Navigate to https://www.splunk.com/en_us/download/universal-forwarder.html Login to splunk.com if not done already. Choose  the OS for which you want to download the forwarder. In my case I will be using amazon linux, so I will choose a .rpm package. Download and save on the machine from which you want to send the logs to your Splunk enterprise installation. In my case its splunkforwarder-7.2.4-8a94541dcfac-linux-2.6-x86_64.rpm [splunk@ip tmp]$ sudo rpm -ivh splunkforwarder-7.2.4-8a94541dcfac-linux-2.6-x86_64.rpm [sudo] password for splunk: warning: splunkforwarder-7.2.4-8a94541dcfac-linux-2.6-x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID b3cd4420: NOKEY Preparing...                          ################################# [100%] Updating / installing...    1:splunkforwarder-7.2.4-8a94541dcfa################################# [100%] ...