Splunk SDK for Java now has maven support
Splunk SDK for Java now has maven support
What’s New In The Splunk App for VMware
Since the launch of the Splunk App for VMware, we’ve received some great feedback on how to use the data collected by the App. Today, we are excited to announce the general availability of the Splunk App for VMware v2.0 and with your help we’ve introduced some fantastic reports and visualizations. Here are some highlights:
Health reports: These reports provide a real-time view of the health of your VMware environments. You can quickly identify which VMs and hosts have system resources that are in a critical state, datastores that are under- or over-utilized, alarms that have been triggered from your environments and more. You can then logically navigate from these summary pages to detailed pages. And to do…
Hadoop and Splunk Use cases
Customer Examples – Using both Splunk and Hadoop
The Splunk and Hadoop communities can benefit from each other’s strengths. Below are several examples of customers that use both environments.
| Use Case | Description |
| 1 – Splunk then Hadoop | Splunk collects, visualizes, and analyzes the data and passes it to Hadoop for ETL and other batch processing |
| 2 – Hadoop then Splunk | Hadoop Collects the Data, and passes the results to Splunk for Visualization |
| 3 – Data flows in both directions | Splunk and Hadoop collect different artifacts and share the data that Hadoop needs |
…
You’re happier with fewer friends
Using the new Splunk Sentiment Analysis app I was able to correlate how positive tweets were, depending on how many people follow a twitter account. It’s a slight stretch, but essentially, are you happier with more friends?
index=twitter | sentiment twitter body | chart avg(sentiment) by actor.followersCount
It seems that people with smaller circles of friends are more positive. More friends equals more negativity, up until about 75 friends. Seems like a fairly good life lesson, but take it a grain of salt — spam twitter accounts may skew things.
Book Excerpt: Finding Specific Transactions
EXCERPT FROM “EXPLORING SPLUNK: SEARCH PROCESSING LANGUAGE (SPL) PRIMER AND COOKBOOK”. Kindle/iPad/PDF available for free, and hardcopy available for purchase at Amazon.
Problem
You need to find transactions with specific field values.
Solution
A general search for all transactions might look like this:
sourcetype=email_logs | transaction userid
Suppose, however, that we want to identify just those transactions where there is an event that has the field/value pairs to=root and from=msmith. You could use this search:
sourcetype=email_logs | transaction userid | search to=root from=msmith
The problem here is that you are retrieving all events from this sourcetype (potentially billions), building up all the transactions, and then throwing 99% of the data right in to the bit…
Splunk for Meaningful Use
I visited a Health Care customer recently to discuss their most important use cases for Splunk. They’ve taken a holistic approach to getting all of their application data into Splunk and it’s really paying off. A key use case for their many health care facilities helps them stay compliant to meet their meaningful use requirements.
Meaningful use of health information technology is an umbrella term for rules and regulations that hospitals and physicians must meet to qualify for federal incentive funding under the American Recovery and Reinvestment Act of 2009 (ARRA). One of the overarching goals is to use Electronic Health Record (EHR) technology to improve the quality, safety and efficiency of patient care. Bottom line, it’s important to…
Simplifying Big Data Analytics
Most analytics and data projects have started thinking of investing in big data initiatives. With so much buzz about big data, organizations have started investing or are thinking of investing in Hadoop While it is great to stay on top of trends, it often ends up being another investment where the full benefit and potential is simply not realized. The learning curve is too steep and the time to implement too high. Current analytics resources lack the strong programming skills required to conduct even simple analysis tasks and activities using Hadoop. In this post, I would like to focus on providing a better understanding of what types of analysis are better suited for Hadoop vs. non-Hadoop technologies in order to simplify…
Removing Duplicate Consecutive Events
EXCERPT FROM “EXPLORING SPLUNK: SEARCH PROCESSING LANGUAGE (SPL) PRIMER AND COOKBOOK”. Kindle/iPad/PDF available for free, and hardcopy available for purchase at Amazon.
Problem
You want to group all events with repeated occurrences of a value in order to remove noise from reports and alerts.
Solution
Suppose you have events as follows:
2012-07-22 11:45:23 code=239
2012-07-22 11:45:25 code=773
2012-07-22 11:45:26 code=-1
2012-07-22 11:45:27 code=-1
2012-07-22 11:45:28 code=-1
2012-07-22 11:45:29 code=292
2012-07-22 11:45:30 code=292
2012-07-22 11:45:32 code=-1
2012-07-22 11:45:33 code=444
2012-07-22 11:45:35 code=-1
2012-07-22 11:45:36 code=-1
Your goal is to get 7 events, one for each of the code values in a row: 239, 773, -1, 292, -1, 444, -1. You might be tempted
…
Splunk 2012 Revolution Awards—Winners!
When I was in Las Vegas last month for our Users’ Conference, I randomly threw twenty dollars into a pirate-themed penny slot machine. It was late at night, I might have had an adult beverage or two, and I was feeling lucky. Actually, I was resigned to losing my $20 and going to bed. To my surprise, after just a few minutes of randomly hitting buttons and playing all 30 lines like a Vegas VIP, I hit some kind of jackpot and walked away with $40. Vegas, I own you!
No doubt about it—everyone loves to feel like a winner! So, on Tuesday night during the Search Party, we distinguished the winners of this year’s Splunk Revolution Awards. The Revolution…
Transaction Searching: Unifying Field Names
EXCERPT FROM “EXPLORING SPLUNK: SEARCH PROCESSING LANGUAGE (SPL) PRIMER AND COOKBOOK”. Kindle/iPad/PDF available for free, and hardcopy available for purchase at Amazon.
Problem
You need to build transactions from multiple data sources that use different field names for the same identifier.
Solution
Typically, you can join transactions with common fields like:
... | transaction username
But when the username identifier is called different names (login, name, user, owner, and so on) in different data sources, you need to normalize the field names.
If sourcetype A only contains field_A and sourcetype B only contains field_B, create a new field called field_Z which is either field_A or field_B, depending on which is present in
…










