Mastering Splunk

Getting started with monitoring

You install Splunk and add data (configure your inputs), and Splunk is already monitoring! Obviously, after your initial exposure to Splunk and as you pursue your Splunk mastership, you'll want to approach monitoring with proven practices in mind.

A proven startup methodology is outlined here:

• Requirements: Gather and understand what the requirements truly are. Your needs (the requirements) will determine how you add data to Splunk: can you use an app? What about forwarders? Is there an opportunity for knowledge creation?
• Test indexing: Create a test index and add just a few inputs.
• Preview the data: Use the Splunk data preview feature to actually view the data. Then, based on what you see, you might want to modify ...