Splunk @ Amazon Startup - Austin, TX - 9/11/2008

The IT Search CompanyMichael Wilde, Director, SplunkPowered Associates

Imagine using the Internet without a search engine

The IT Search Company

Now imagine trying to find information buried in terabytes of data inside your data center

Splunk lets you search your entire IT infrastructure from one place in real time

Why Search?

Our IT infrastructures are too complex, dynamic, service oriented, virtualized and

mission critical. Existing management approaches haven’t kept up.

Search is scalable, versatile and keeps up with change. It turns

the data you already have into actionable information.

>Last 60 minutes

Search your IT infrastructure

OperationsTroubleshoot problems

>J2EE exception Last 60 minutes

SecurityInvestigate attacks

Last 24 hours

fail* password sshd

ComplianceReporting and Controls

file modify | chart by sourceLast 7 days

Business IntelligenceAnalyze transactions

transaction fields=useridLast 7 days

Business IntelligenceAnalyze transactions

transaction fields=useridLast 7 days

• Time search with interactive results

• Keyword search with quoted strings, wild cards, booleans and nesting

• Targeted field search

- Host, sources, events

- Custom fields

• Summary and statistical search

• Transaction search

• Right click integration with other applications

Search

• Save any search and run it on a schedule to create an alert

• Alerts can trigger notifications and/or actions based on the search results

• Notifications can be sent via email, SMS, RSS or SNMP and integrated with other management consoles

• Actions can trigger scripts to perform activities like restarting a server

Report• One click reports from search results

• Any field can be used to plot series

• Flexible chart outputs and formats

• Interactive charts provide one click drill down

• Select multiple fields to plot several series together

• Save knowledge to share with other users and groups- Searches- Alerts- Reports- Dashboards- Types, Tags, Actions

• Package knowledge as an application and share with other installations

Visualize• Connect visualization apps to the

Splunk API

• Feed business intelligence and reporting applications with IT data using the Splunk API

• Create dynamic visualizations of data with using one of the Splunk SDKs- Flash- Python- C, C++- Java- .Net

Challenges solved with cloud computing

Running a Developers Camp

• First Splunk Developers Camp (August 4, 2008)

• 65 onsite, 298 watching live via Splunk.TV

• Give dev’s a place to work they can self administer, but how?

DevCamp - the Fabulatr

• Users don’t need AWS accounts

• Easy starting/stopping of EC2 instances

• Emails the instructions & SSH key

• Free, Open SourceKord Campbell, Chief Evangelist

• Users don’t need AWS accounts

• Easy starting/stopping of EC2 instances

• Emails the instructions & SSH key

• Free, Open SourceKord Campbell, Chief Evangelist

Get it @Google Code

Sales Engineering

• Proofs of Concept (customer testing)

• Joint work with support

• A place to play

• Splunk Live Demos

Sales Engineering

• A place to play

Sales Engineering

• A place to play

Splunk Loves

•EC2 - running instances

Splunk Loves

•S3 - storing images

Splunk Loves

•EBS - wicked laaarge disk storage & snapshotting

Splunk Loves

• Rightscale

Splunk Loves

• Rightscale

Splunk Loves

• Rightscale

•Rightscale

powered

Resources for You

download.splunk.com

rightscale.com

EC2 Fabulatr code.google.com/p/fabulatr

Questions

Splunk @ Amazon Startup - Austin, TX - 9/11/2008

Business

Transcript of Splunk @ Amazon Startup - Austin, TX - 9/11/2008

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

SPLUNK Capabilities Overview - GTRI · Overview GTRI is the only ELITE Splunk integrator with certified Splunk architects and engineers on staff. In addition to ... SPLUNK-Overview

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Splunk For IT Operational Intelligenceuploads.integrity360.com/1425903243-Splunk-for-IT-Operations.pdf · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper

Splunk User Group - Austin - Kickoff Meeting

Splunk in Rakuten: Splunk as a Service for all

Splunk Cloud Product Briefwinncom.com.ua/wp-content/uploads/2018/07/splunk-Log_Flow.pdf · Extend Benefits With Splunk Apps Splunk Cloud includes support for premium solutions such

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers.

Netﬁlter Iptables for Splunk Documentation - Read … · Netﬁlter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

THE SPLUNK GUIDE TO OPERATIONAL …...Splunk Guide to Operational Intelligence 2 The Splunk Approach Splunk Enterprise is the first enterprise-class platform that collects and indexes

Industrial Data Internet of Things splunk (REST API, SDKs) splunk . TESCO splunk 500 Y—Jt1-3— 41328 . SHANON 1/5 splunk . htt . (500MB/B) s lunk splunk . Created Date:

SheSays Austin Talk // From the Ad World to a Startup

Islands*of*Splunk* - .conf2017 | The 8th Annual Splunk ... · Background*! Splunk*administrators*are*increasingly*required*to*provision*Splunk* as*aservice*oﬀering*to*mulJple*customers*

stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Fortscale Splunk Integrationinfo.fortscale.com/hubfs/UEBA Content/Fortscale Splunk Integration.pdf · Fortscale Splunk Integration ... Fortscale digests access and authentication

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

TimeACerTime*–** ComparingTimeRangesinSplunk* · AboutMe! SplunkSeniorInstructorsince2009! FrequentcontributortoSplunkAnswers! LoveSplunksearchlanguagepuzzles*

IslandsofSplunk* - .conf2017 | The 8th Annual Splunk ... · Background! SplunkadministratorsareincreasinglyrequiredtoprovisionSplunk* asaserviceoﬀeringtomulJplecustomers