Hi guys.
Today we're gonna start our session on Splunk Administration.
This course will mostly be focused on the entire administration
of Splunk and some associated functionalities,
some basic knowledge management types and as well some basic insight on Splunk.
So let's get started.
So, what is Splunk?
So, there is a lot of hubbub in the market recently on this Splunk. Splunk is turning out
to be one of the most efficient tool. It's being used by a lot of companies that falls
in Fortune 500. People have started giving some really good look at Splunk.
So what is it basically?
Why is it becoming so famous?
What's that a specialty of it?
So let's ask a very basic question.
What do you do when you need information about the state of a machine or software?
So you look at its log files? They tell you the state it is in and what is going on.
So what are these log files?
Basically log files are nothing but machine data.
So what splunk does is make machine data available to the IT infrastructure.
And it does it in a totally different way. So machine data is always relevant for better
way of running IT. It can be helpful in doing audits, making system more secure,
understand and respond to the behavior of customers maybe give a better service
and all this happens in real time.
So that is something wonderful right.
So doing all these things at the same time, one application providing the entire platform
and that too in the real time.
So that's a lot we are going for and leveraging this data,
this machine data has always been complicated.
So we had have these kind of handling of machine data previously with SQL, DBL
ETL or other schema based architectures. But Splunk does this very seamlessly in a different
way that we're going to find out. So Splunk is basically it's a non schema based,
it follows the non-schema based architecture where it had a collection of flat files from where
it takes the rich data, the meaningful data that is part of the machine data and present
it to you in a completely value add format either in form of dashboards or alert. So Splunk
difference is the platform for collecting, storing, correlating and analyzing machine
data. So be it physical or virtual or cloud environments.
So it does it in all of them.
So splunk can be basically defined as a Google for log files as you whenever you need an
information you basically what you do, you go to Google and it just type it in and it gives
you the data it gives you the result that the desired result.
So according to your connection 4G or 3G, it gives you the faster you want it.
Similarly Splunk is the Google for machine data.
So whenever you need a relevant details that is hiding in your machine data you go ahead
type it in Splunk search bar that will be part of the Splunk GUI,
Splunk web and it will present it to you with all the relevant details and b as
the 3G and 4G matters in place of your internet connection to connect to Google. The hardware
equipments would fit in the same category for Splunk architecture. The better your hardware.
better your specs are, the faster you will get the data, the more efficient your system will be
in handling it.
So that is what Splunk is about. So SPL language provide valuable insights.
So basically this SPL is Splunk programming language.
So it is basically what it does is, it's a collection of around 300 commands that will
be very handy, writing down these languages.
It can
write very simple searches from a very range of symbols searches to a very complicated pivot
as well using these SPL language.
So this SPL language, it makes finding the data and modifying it, articulating it
and correlating the results very easy.
So next is, it provides business insights and operational intelligence.
So what is basically business insight an operation intelligence that is like a business operation
that IT is running on.
So some insight or some intelligence into these operations and making it more efficient
and streamlining the process is always something that this I.T. industry looks for.
So what it does is, it gives you a better insight in the data and to run your IT operations.
Let's open web console.
Log in with main credentials..
Here I am logged in.
So let's go to the access control, users and authentication.
Yes.
So what is user and authentication is basically, how an individual access Splunk
and what are the rules
he has been exposed to handle Splunk.
So as you can see, I am opening Splunk with the admin access.
So there are several others, other layer of roles that you can take leverage of and there
are other different authentication methods as well.
So, I'll just give you overview of the authentication methods.
So the primary or the default one is the splunk native authentication that is internal
authentication splunk which is always on
which you can at any point of time you can roll back to that one
because it will by default be always on.
So apart from that, if you want any other external authentication, you have these two, the most
possibly used external authentication methods LDAP and SAML.
So there is a procedure to configure LDAP or SAML connection that with the settings
that would be provided to you.
So, there are various sources of this settings.
Similarly for SAML access as well you will have to fill up the form which will
enable the SAML authentication. So you can use this one or any of the other two.
Till now, you accessed Splunk.
So we are using the native control native authentication that is Splunk built in one ok.
Now the users.
So what are the users is basically their are multiple tiers of user that can access Splunk.
So now as you see we just have one admin access that has been created by me for my reference.
So similarly an admin can give access to multiple other users.
So how the access is being given is you add a username of according and in line with
the requester I.D. or requester name, the full name, the email ID is a generic thing.
Time zone obviously which time zone you want the user to be in because
whatever the search the user would be doing will fall into that time zone.
Obviously, the user can go ahead and change the time zones as and when required.
But this is a default on that you will set up. Also the default apps, so once the user
logs in which app would he see, as we log in and we see the search and reporting app that is there
by default, ok. Now, obviously the search homepage
because nothing has been set up. So these are the three
options that we have as of now. The splunk management consults with the DMC, the search and
launches. Any of these app if you want to readily get access to one's logged in.
So this would be set up here.
So, a lot of organization there will be multiple application added applications that are used.
Suppose an app for the dashboard and then maybe the organization wants that wants to
log into the Splunk, they want to see the dashboard. So those things can be done from here.
Now, the parties assigning roles.
So these are the prime roles that are available in Splunk that admin role, the highest privilege
role which can do almost anything.
So this is the highest amount of access that can be given to user, can delete ok.
This is the special role that had been curved-out out of admin that is can delete.
So even an admin cannot delete an index because index is a very sensitive thing.
Once you delete an index, there's no going back.
So all your data is lost.
So, delete command used in Splunk is a very prime come on and it cannot be given to even an
admin unless requested or he's responsible enough.
So from a business point of view, can delete is an added role that is given to the arguments.
admins who needs to delete indexes.
So this is the role. Power- Power users have is like a general user but with some extra activity
access, they can create and share the knowledge objects as in the alerts,
the dashboards and reports and also their reports
would be given a preference. They can view an edit report which is shared with them.
So these are the some of the main uses of the power users.
Where as a normal splunk user won't have such access.
They might be able to create the knowledge objects locally but it won't be possible for
them to share them.
And also the number of concurrent searches for all the roles are different.
So how many users doing badly on many searches would also depend on what all actors each
of them get out of this plan system run as a general rule for this plan system uses.
Now you can always get multiple rules the same person.
Suppose you want to give users maybe a can delete in a rule to.
Select to do that so you can't do these two and you can go ahead.
So these two has been I looked at it as a selected group so this way rules can be added.
Also you can create a new rule so completely suppose you have created this with these two
available rules you are creating a completely new general fluid and maybe you need to give
it to multiple people maybe not one we face.
So you create a new rule along with the user a new role would be created which you extend
the new log and you went see appear in the level rules section.
So on checking this box you will get the next day to do that.
And that is that password with some generic password that you will be getting and it will
be sharing it with the user.
So this is how basically you create and use it for Splunk active authentication as planned.
Indication that the user would use and accordingly.
Andrea.
Also rules as we have seen in the U.S. until we can add rules such as a protection all
together that you can go ahead and add new rules.
So you have a role in mind.
Brittany suppose it's for the security users would you give it a security personnel then
give the default again which app you want the user to be in.
When he logs into the system it restrict such items.
So what does that mean.
He can search and can answer it.
So those items can be restricted you can use the boolean items such as and or.
And you can always mention that these are that these are the places.
This is the host of do this whole step that he should not be accessing.
So these here you basically restrict and use it to some specific portion of this plan.
So you can customize you are basically customizing the axis of the user.
Restrict search time range with a set of minus one.
So set the maximum time window for soldiers for this rule.
So it basically means that Suppose for example that this is 60 to restrict the rule so it
is the one with the most recent specified in the search.
That also said this was did not explicitly make that window inside that minus one to
unset window for this rule and be overridden by important rules.
So basically here what you're are doing is you can declare the maximum window for searches
for this rule.
So how big this user can search both for 60 minutes maybe for one or two are the window
searches and that has been given access to this user.
You can send it to zero for unlimited access but it's given minus 1 means that the window
for this rule to unsettle the window for this rule to Suzanne might not be having anyone
assigned to a.
It is a very literal view of what can be done and what all are being done in this blank
user Apple's said this session was mostly about taxes.
Thank you.
I'm sure you enjoyed learning from this video.
Please like the video and if you have any doubts regarding this video please comment
us in the comments section.
And don't forget to subscribe to our channel for more such informative videos to look out
for other related videos in our playlist.
For more information visit our Web site.
Now keep learning with intel about.