2. 2
Safe Harbor Statement
During the course of this presentation,we may make forward looking statements regarding future events
or the expected performance of the company. We caution you that such statements reflect our current
expectations and estimates based on factors currently known to us and that actual events or results could
differ materially. For important factors that may cause actual results to differ from those contained in our
forward-looking statements, please review our filings with the SEC. The forward-looking statements
made in this presentation are being made as of the time and date of its live presentation. If reviewed
after its live presentation, this presentation may not contain current or accurate information. We do not
assume any obligation to update any forward looking statements we may make. In addition, any
information about our roadmap outlines our general product direction and is subject to change at any
time without notice. It is for informational purposes only and shall not be incorporated into any contract
or other commitment. Splunk undertakes no obligation either to develop the features or functionality
described orto includeany suchfeatureor functionalityina futurerelease.
3. 3
Agenda
What’s new in 6.1
– New features and capabilities
Data Models and Pivot
– Analyze data without using search commands
Harness the power of search
– The 5 search commands that can solve most problems
6. 6
Mission-critical Availability
New Clustering Features
• Location aware replication
• Search Head Affinity
MISSION
CRITICAL
ENTERPRISE
REPLICATION
Portland
Datacenter
New York
Datacenter
7. 7
Load and Preview Structured Data
Data Preview with
Structured Inputs
• Easily onboard structured
data
• Preview the fields before
indexing
• Configure from the GUI
Adjust configurations in the UI
• Delimiters, Headers, Time Stamp
Preview results before committing
MISSION
CRITICAL
ENTERPRISE
10. 14
More Actionable Alerting
Customized Alerts
• Add tokens to the alerts
from the search results
• Select preferred format and
delivery of results
Customize Recipients
Customize Message
Select Delivery Method
EMBEDDING
OPERATIONAL
INTELLIGENCE
11. 15
Visualization in Splunk
iframe
Visualization in non-Splunk UI
Add Splunk Insights to Business Apps
Embedded Reporting
• Embed scheduled reports
into web applications
• Share with users who don’t
have access to Splunk
• 1-line copy/paste to embed
in external application
EMBEDDING
OPERATIONAL
INTELLIGENCE
15. 19
Model, Report, and Accelerate
Build complex reports without the
search language
Provides more meaningful representation
of underlying raw machine data
Pivot
Data
Model
Acceleration technology delivers up to
1000x faster analytics over Splunk 5
Analytics
Store
16. 20
Creating a Data Model
Basic Steps
1. Have a use for a Data
Model
2. Write a base search
3. Select the fields to include
17. 27
Data Model Acceleration
• Automatically collected and
maintained
• Stored on the indexers
• Must share the Data Model
• Cost is additional disk space
Makes reporting crazy fast
18. 28
Pivot
• Drag-and-drop interface
• No need to understand
underlying data
• Click to visualize
Select fields from
data model
Time window
All chart types available in the chart toolbox
Save report
to share
Build Reports without SPL
20. 36
search and filter | munge | report | cleanup
Search Processing Language
sourcetype=access*
| eval KB=bytes/1024
| stats sum(MB) dc(clientip)
| rename sum(MB) AS "Total MB" dc(clientip) AS "Unique Customers"
21. 37
Five Commands that will Solve Most Data Questions
eval - Modify or Create New Fields and Values
stats - Calculate Statistics Based on Field Values
eventstats - Add Summary Statistics to Search Results
streamstats - Cumulative Statistics for Each Event
transaction - Group Related Events Spanning Time
25. 43
stats – Calculate Statistics Based on Field Values
Examples
• Calculate stats and rename
sourcetype=access*
| eval KB=bytes/1024
| stats sum(KB) AS “Total KB”
• Multiple statistics
sourcetype=access*
| eval KB=bytes/1024
| stats sum(KB) avg(KB)
• By another field
sourcetype=access*
| eval KB=bytes/1024
| stats sum(KB) avg(KB) by clientip
26. 44
stats – Calculate Statistics Based on Field Values
Examples
• Calculate stats and rename
sourcetype=access*
| eval KB=bytes/1024
| stats sum(KB) as “Total KB”
• Multiple statistics
sourcetype=access*
| eval KB=bytes/1024
| stats sum(KB) avg(KB)
• By another field
sourcetype=access*
| eval KB=bytes/1024
| stats sum(KB) avg(KB) by clientip
27. 45
stats – Calculate Statistics Based on Field Values
Examples
• Calculate statistics
sourcetype=access*
| eval KB=bytes/1024
| stats sum(KB) AS "Total KB”
• Multiple statistics
sourcetype=access*
| eval KB=bytes/1024
| stats avg(KB) sum(KB)
• By another field
sourcetype=access*
| eval KB=bytes/1024
| stats sum(KB) avg(KB) by clientip
28. 47
eventstats – Add Summary Statistics to Search Results
Examples
• Overlay Average
sourcetype=access*
| eventstats avg(bytes) AS avg_bytes
| timechart latest(avg_bytes) avg(bytes)
• Moving Average
sourcetype=access*
| eventstats avg(bytes) AS avg_bytes by date_hour
| timechart latest(avg_bytes) avg(bytes)
• By created field
sourcetype=access*
| eval http_response = if(status == 200, "OK", "Error”)
| eventstats avg(bytes) AS avg_bytes by http_response
| timechart latest(avg_bytes) avg(bytes) by http_response
29. 48
Examples
• Overlay Average
sourcetype=access*
| eventstats avg(bytes) AS avg_bytes
| timechart latest(avg_bytes) avg(bytes)
• Moving Average
sourcetype=access*
| eventstats avg(bytes) AS avg_bytes by date_hour
| timechart latest(avg_bytes) avg(bytes)
• By created field
sourcetype=access*
| eval http_response = if(status == 200, "OK", "Error”)
| eventstats avg(bytes) AS avg_bytes by http_response
| timechart latest(avg_bytes) avg(bytes) by http_response
eventstats – Add Summary Statistics to Search Results
30. 49
Examples
• Overlay Average
sourcetype=access*
| eventstats avg(bytes) AS avg_bytes
| timechart latest(avg_bytes) avg(bytes)
• Moving Average
sourcetype=access*
| eventstats avg(bytes) AS avg_bytes by date_hour
| timechart latest(avg_bytes) avg(bytes)
• By created field
sourcetype=access*
| eval http_response = if(status == 200, "OK", "Error”)
| eventstats avg(bytes) AS avg_bytes by http_response
| timechart latest(avg_bytes) avg(bytes) by http_response
eventstats – Add Summary Statistics to Search Results
31. 51
streamstats – Cumulative Statistics for Each Event
Examples
• Cumulative Sum
sourcetype=access*
| reverse
| streamstats sum(bytes) as bytes_total
| timechart max(bytes_total)
• Cumulative Sum by Field
sourcetype=access*
| reverse
| streamstats sum(bytes) as bytes_total by status
| timechart max(bytes_total) by status
• Moving Average
sourcetype=access*
| timechart avg(bytes) as avg_bytes
| streamstats avg(avg_bytes) AS moving_avg_bytes window=10
| timechart latest(moving_avg_bytes) latest(avg_bytes)
32. 52
Examples
• Cumulative Sum
sourcetype=access*
| timechart sum(bytes) as bytes
| streamstats sum(bytes) as cumulative_bytes
| timechart max(cumulative_bytes)
• Cumulative Sum by Field
sourcetype=access*
| reverse
| streamstats sum(bytes) as bytes_total by status
| timechart max(bytes_total) by status
• Moving Average
sourcetype=access*
| timechart avg(bytes) as avg_bytes
| streamstats avg(avg_bytes) AS moving_avg_bytes window=10
| timechart latest(moving_avg_bytes) latest(avg_bytes)
streamstats – Cumulative Statistics for Each Event
33. 53
Examples
• Cumulative Sum
sourcetype=access*
| timechart sum(bytes) as bytes
| streamstats sum(bytes) as cumulative_bytes
| timechart max(cumulative_bytes)
• Cumulative Sum by Field
sourcetype=access*
| reverse
| streamstats sum(bytes) as bytes_total by status
| timechart max(bytes_total) by status
• Moving Average
sourcetype=access*
| timechart avg(bytes) as avg_bytes
| streamstats avg(avg_bytes) AS moving_avg_bytes
window=10
| timechart latest(moving_avg_bytes) latest(avg_bytes)
streamstats – Cumulative Statistics for Each Event
34. 55
transaction – Group Related Events Spanning Time
Examples
• Group by Session ID
sourcetype=access*
| transaction JSESSIONID
• Calculate Session Durations
sourcetype=access*
| transaction JSESSIONID
| stats min(duration) max(duration) avg(duration)
• Stats is Better
sourcetype=access*
| stats min(_time) AS earliest max(_time) AS latest by JSESSIONID
| eval duration=latest-earliest
| stats min(duration) max(duration) avg(duration)
35. 56
Examples
• Group by Session ID
sourcetype=access*
| transaction JSESSIONID
• Calculate Session Durations
sourcetype=access*
| transaction JSESSIONID
| stats min(duration) max(duration) avg(duration)
• Stats is Better
sourcetype=access*
| stats min(_time) AS earliest max(_time) AS latest by JSESSIONID
| eval duration=latest-earliest
| stats min(duration) max(duration) avg(duration)
transaction – Group Related Events Spanning Time
36. 57
Examples
• Group by Session ID
sourcetype=access*
| transaction JSESSIONID
• Calculate Session Durations
sourcetype=access*
| transaction JSESSIONID
| stats min(duration) max(duration) avg(duration)
• Stats is Better
sourcetype=access*
| stats min(_time) AS earliest max(_time) AS latest by JSESSIONID
| eval duration=latest-earliest
| stats min(duration) max(duration) avg(duration)
transaction – Group Related Events Spanning Time
37. 58
Learn Them Well and Become a Ninja
eval - Modify or Create New Fields and Values
stats - Calculate Statistics Based on Field Values
eventstats - Add Summary Statistics to Search Results
streamstats - Cumulative Statistics for Each Event
transaction - Group Related Events Spanning Time
See many more examples and neat tricks at docs.splunk.com and answers.splunk.com
The Enhanced Dashboard Editor makes it easier to build advanced dashboards, adding visualizations and charts – all without Advanced XML.
You can now easily add new inputs and panels to drive a richer experience and create advanced visualizations all in the the UI – without any coding.
With Contextual Drill-down a primary panel can drive the charts, tables and visualizations on the rest of a dashboard.
Splunk 6.1 delivers new controls to deliver an even more focused analytics experience with the machine data in Splunk Enterprise.
Chart Overlay: Improves data analysis by providing the ability to overlay one chart on top of another.
Pan and Zoom Controls: Enables more focused analytics by providing the ability in selecting a range of interest on a chart and zoom in for deeper analysis.
Alerts are triggered when certain conditions are met – a feature Splunk Enterprise has had for sometime.
Now with Splunk Enterprise 6.1 you can deliver alerts with embedded machine data context. This includes fields and values from the result set that triggered the alert as well as the search artifacts such as the time range the search ran over.
You can also choose what you include or exclude in the email.
Alerts are triggered when certain conditions are met – a feature Splunk Enterprise has had for sometime.
Now with Splunk Enterprise 6.1 you can deliver alerts with embedded machine data context. This includes fields and values from the result set that triggered the alert as well as the search artifacts such as the time range the search ran over.
You can also choose what you include or exclude in the email.
Embedded Reports, enables any Splunk report or table to be embedded in third-party business application such as salesforce.com, WordPress, Wiki or Microsoft® SharePoint
With Embedded Reports users are connected to the critical insights using tools they are already familiar with – all without having access to Splunk.
Simply copy the iframe code provided by Splunk and paste it into your webpage. The authentication is handled in the URL.
For more information, or to try out the features yourself. Check out the overview app which explains each of the features and includes code samples and examples where applicable.
This section should take ~10 minutes
Data Model – A data model is just like a map of the underlying data. It defines meaningful relationships in the data
Pivot – is an interface to analyze data without using the splunk search language
Analytics Store – is an option that can be applied to Data Models to make Pivot searches extremely fast. Think of it like our 3rd generation acceleration technology.
Let’s dig into each of these features
Note: Chart is just stats visualized. Timechart is just stats by _time visualized.
sourcetype=access*
| eval KB=bytes/1024
| stats sum(KB) AS "Sum of KB"
sourcetype=access*
| stats values(useragent) avg(bytes) max(bytes) by clientip
sourcetype=access*
| stats values(useragent) avg(bytes) max(bytes) by clientip
Eventstats let’s you add statistics about the entire search results and makes the statistics available as fields on each event.
<Walk through the examples with a demo. Hidden slides are available as backup>
Eventstats let’s you add statistics about the entire search results and makes the statistics available as fields on each event.
Let’s use eventstats to create a timechart of the average bytes on top of the overall average.
index=* sourcetype=access*
| eventstats avg(bytes) AS avg_bytes
| timechart latest(avg_bytes) avg(bytes)
We can turn this into a moving average simply by adding “by date_hour” to calculate the average per hour instead of the overall average.
index=* sourcetype=access*
| eventstats avg(bytes) AS avg_bytes by date_hour
| timechart latest(avg_bytes) avg(bytes)
Decrease the threshold of similarity and see the change in results
sourcetype=access* | cluster field=bc_uri showcount=t t=0.1| table cluster_count bc_uri _raw | sort -cluster_count
