Splunk Search

Is this feasible to do in Splunk?

alanxu
Communicator

Hello,
I am new to Splunk and I am using it for work. What I have is a raw log of data that tells me dates, when scripts begin and finish, and other information. Its really messy so I created a bash script to filter through it to get the necessary information and output it to another file. My next step is to use that outputted file and create tables and graphs in Splunk. Can anyone break down the steps I need to take? I watched a few tutorial videos.

Also I am suppose to have an alert for special cases.

Thanks

Tags (3)
0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

For the basic steps of get data in, search, report, make dashboards, have you worked your way through the Search Tutorial?

For instructions about getting the data from your file into Splunk Enterprise, see Monitor files and directories in the Getting Data In manual.

For alerts, it depends what you want to do. But see the Alerting Manual for more information.

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

For the basic steps of get data in, search, report, make dashboards, have you worked your way through the Search Tutorial?

For instructions about getting the data from your file into Splunk Enterprise, see Monitor files and directories in the Getting Data In manual.

For alerts, it depends what you want to do. But see the Alerting Manual for more information.

alanxu
Communicator

I got my massaged log file in
I saw reports are just saved searches
Dashboards are made from reports?

I am just wondering if my project is even possible using Splunk.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Dashboards are made from reports, yes. Did you go through the tutorial? It shows you how. Based on the small amount of information you have provided, your project should be possible. If you want more detailed help from the community, I suggest making a new Answers posting and including samples of your data and searches, along with specific questions about where you are getting stuck.

alanxu
Communicator

Soudnds good Chris thank you I will keep playing around this week and will probably post a question in a few days.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...