Consider this a draft. I’ll update it as I have time, but I’m posting now because it may help someone. Updated 2019-04-07: Some improvements thanks to Red Hat support. I am also trying to collect the knowledge and experience of other SplunkTrust and Splunk community people in order to document this more completely. Many thanks […]
Splunk
Things which are Splunk related
RHEL 7 UDP metrics into splunk metrics index
We were discussing this on splunk-usergroups slack, and I said I should post it here and vraptor and dawnrise urged me to do so quickly — so here I am. (Thanks vraptor and dawnrise!) First up, a script to use the nstat tool to grab some kernel UDP metrics and write them out in a […]
Quick Hit – disabling SSLv3 in Splunk
Update 20141015 – Splunk’s official advisory has been released. Update 20141016 – Changed from a specific TLS1.2 cipher to the generic “TLSv1.2” suite. Hat tip to @techxicologist. If you’ve not seen that SSLv3 is irreparably broken, go read about it, then grab a strong drink and come back. Splunk (as of release 6.1) does not […]
Splunk .conf 2014 slides and notes
This week I had the pleasure of speaking at Splunk .conf 2014. George Starcher and I spoke on configuring Splunk’s various SSL options, with the goal of providing a cookbook with SSL configurations appropriate for moving from a POC/trial install into production. Other that some audio problems (sorry!), I thought the session went very well. […]
Splunk – bucket lexicons and segmentation
About Segmentation Event segmentation is an operation key to how Splunk processes your data as it is being both indexed and searched. At index time, the segmentation configuration determines what rules Splunk uses to extract segments (or tokens) from the raw event and store them as entries in the lexicon. Understanding the relationship between what’s […]
Effect of kernel filesystem caching on Splunk performance
Unlike a traditional relational DBMS, Splunk does not use an in-process buffering or caching mechanism. That is to say, there is not such thing as an SGA for your Oracle types, and the DB/2 DBAs may be disappointed to find there’s no bufferpool. Instead, Splunk counts on the operating system’s native caching for files in […]