We are Listening…
At Splunk, we are committed to providing the best product and customer service. Feedback from our customers helps us identify areas in which we are doing well, and areas of opportunity for improvement.
A number of our customers should have received a Customer Satisfaction survey email today. The short survey should take less than 10 minutes to complete. The response is anonymous and will remain confidential. We will use the data to improve our products and services.
We truly appreciate your participation and look forward hearing from you.
Meet your Splunk Hackathon builders: Splunk App for Varnish
Dale Neufeld {team name: “Mighty Canadian Beaver”, spirit animal: “Mighty Canadian Beaver”} was one of the awesome app builders that participated in Splunk’s first App Builder Contest at .conf2012.
Neufeld built a Splunk App for Varnish. Varnish is an HTTP accelerator designed for content-heavy dynamic web sites.
The Splunk for Varnish App provides the ability to monitor Varnish servers and consists of a Ruby script to gather data from Varnish as scripted input, Dashboards and macros to enable monitoring and investigation of Varnish servers.
When demoing his app, Neufeld commented that he had been meaning to spend a little time putting together a Varnish App for his production Splunk deployment and thought the Hackathon
…
Simple Correlation in Splunk
As I promised at .conf, I’m going to start posting a series on writing effective correlation searches, in the hopes that I will get better at doing so.
First, framework. Alberto Cairo’s The Functional Art has a good summation of DIKW (Data, Information, Knowledge, Wisdom) Hierarchies. In short, we’re going to structure our search in a way that lets us gather Data, structure Information, and return Knowledge. This is what I called the correlation three-step in my .conf talk on Technology Add-ons: Gather a pool of Data, structure or extract Information for testing, test to acquire Knowledge. Hopefully that will lead to Wisdom, but any gaps are left as an exercise for the reader.
In order to keep it…
In the Cloud at .conf12
Attending .conf for the first time this year, I was reminded of the lyrics from Elvis’s song Viva Las Vegas
” How I wish that there were more
Than the twenty-four hours in the day
Cause even if there were forty more
I wouldn’t sleep a minute away”
I didn’t want .conf12 to end. Hearing our customers talk about their usage of Splunk, meeting some of you face-to-face and learning all that’s going on in Splunk put me in a high trance – one that I’ve not quite experienced in Vegas before.
Speaking specifically about virtualization – we had multiple sessions – for VMware, for Citrix solutions such as XenDesktop, XenApp,
Save the World with Splunk
I was excited and honored to presented a session titled “Save the World with Splunk” at .conf 2012 on September 12, 2012 in Las Vegas, NV. Thanks to the rad Splunk Media Studio team, my talk is now available online for anyone that was unable to catch it the first time around. w00t!
Talk is 35m and here is a short synopsis:
You know Splunk can help you save the day, but did you know Splunk could potentially save the world? We think it’s possible–watch this session to discover how. First we’ll showcase what folks have already done–optimizing the supply chain for delivering aid after an earthquake or monitoring flood water levels to coordinate evacuations. We’ll look at…
Splunk Book Excerpt: Finding Metrics That Fell by 10% in an Hour
EXCERPT FROM “EXPLORING SPLUNK: SEARCH PROCESSING LANGUAGE (SPL) PRIMER AND COOKBOOK”. Kindle/iPad/PDF available for free, and hardcopy available for purchase at Amazon.
Problem
You want to know about metrics that have dropped by 10% in the last hour. This could mean fewer customers, fewer web page views, fewer data packets, and the like.
Solution
To see a drop over the past hour, we’ll need to look at results for at least the past two hours. We’ll look at two hours of events, calculate a separate metric for each hour, and then determine how much the metric has changed between those two hours. The
…
OData for Splunk
OData users? If so, read on…
Now available on Splunkbase, we have a new app – OData for Splunk that allows you to access your data in Splunk from applications like Excel and Tableau where you can build dashboards and other report visualizations outside of the Splunk’s web interface.
This app provides OData endpoints to your Saved Searches. Using this endpoints, you can pull data from Splunk into Excel, Tableau or any other applications that support Open Data Protocol.
This application is currently in beta, and works with Splunk 5.0 and above. If you would like access, please contact us at DevInfo.
Splunk(x) at .conf
I was thrilled to be a part of this year’s worldwide user’s conference showcasing what we’ve done with Splunk(x) and hinting about where we’re going with it. I had the privilege of presenting a session and a Splunkbase lab on how we use Splunk within Splunk. We showcased several of the dashboards I presented in my last blog post on Splunking the Enterprise (which was far too long ago) and highlighted how we’re using SalesForce.com data mashed against our machine data.
Splunk Book Excerpt: Grouping Events
EXCERPT FROM “EXPLORING SPLUNK: SEARCH PROCESSING LANGUAGE (SPL) PRIMER AND COOKBOOK”. Kindle/iPad/PDF available for free, and hardcopy available for purchase at Amazon.
Grouping Events
There are several ways to group events. The most common approach uses either the transaction or stats command. But when should you use transaction and when should you use stats?
The rule of thumb: If you can use stats, use stats. It’s faster than transaction, especially in a distributed environment. With that speed, however, comes some limitations. You can only group events with stats if they have at least one common field value and if you require no other constraints. Typically, the raw event text is discarded.
Like
…
Visualizing Big Data with Splunk
To all .conf attendees, thank you for attending my presentation today. It was really heart-warming to see the strong support from you. The room reached full-occupancy within minutes!
To those that missed this session, there will be an encore session to talk about the internals of the concept viz app. We’ll look at the design and then dive straight into the codes:
Visualizing your Big Data
Castellana 1
Thursday, Sept 13, 2012
11:45am -12:15 pm
See you tomorrow and we’ll see how far your BIG data take you in your journey!
Follow me at @nicholaskey or http://blogs.splunk.com/author/nkey
