final_ctm89127_burch_splunk_your splunk sandbox

YourSplunkSandboxWhileyougetsettled…

1

LoadFeedback:DownloadLatestSlides:https://splunk.box.com/v/burch-

sandboxoraskaneighborwithflashdrive

RelatedBlog:Search:blogs.splunk.com yoursplunk

sandboxhttp://blogs.splunk.com/2016/03/22/your-splunk-

sandbox

Copyright©2016Splunk Inc.

BurchSalesEngineer@Splunk

YourSplunkSandbox

Disclaimer

3

Duringthecourseofthispresentation,wemaymakeforwardlookingstatementsregardingfutureeventsortheexpectedperformanceofthecompany.Wecautionyouthatsuchstatementsreflectourcurrentexpectationsandestimatesbasedonfactorscurrentlyknowntousandthatactualeventsorresultscoulddiffermaterially.Forimportantfactorsthatmaycauseactualresultstodifferfromthose

containedinourforward-lookingstatements,pleasereviewourfilingswiththeSEC.Theforward-lookingstatementsmadeinthethispresentationarebeingmadeasofthetimeanddateofitslivepresentation.Ifreviewedafteritslivepresentation,thispresentationmaynotcontaincurrentoraccurateinformation.Wedonotassumeanyobligationtoupdateanyforwardlookingstatementswemaymake.Inaddition,anyinformationaboutourroadmapoutlinesourgeneralproductdirectionandissubjecttochangeatanytimewithoutnotice.Itisforinformationalpurposesonlyandshallnot,beincorporatedintoanycontractorothercommitment.Splunkundertakesnoobligationeithertodevelopthefeaturesor

functionalitydescribedortoincludeanysuchfeatureorfunctionalityinafuturerelease.

What’saBurch?

4

• SeniorSalesEngineerinBoston• Education• CS@BostonUniversity• MBA@NortheasternUniversity

• SplunkCustomer• Middlewarefor8years(+splunk)• SplunkAdminfor1.5years(splunk4.3+)

• Certs:Knowledge,Admin,Architect• @SplunksinceDec14• Splunkbaseapps

Burch’sGoal

5

Hesitatenomore

Burch’sGoal

6

AgendaStage1:BuildStage2:Play?Stage4:Profit

Config TricksNOT sandbox

YourSplunkSandbox

8

Build

BuildaSplunkSandbox:Options

Localhost Cloud Virtual ContainerAdminRights? Exfiltration? Effort? Coolness?

BuildaSplunkSandbox:License

10

Settings>Licensing

BuildaSplunkSandbox:Developer

11

dev.splunk.com

BuildaSplunkSandbox:STOP

12

YourSplunkSandbox

13

Play

PlayinyourSplunkSandbox:Tutorial

14

PlayinyourSplunkSandbox:ProdData

15

Exportproddata

Gotchas:– Hugedatavolumecouldtimeout– Exportasrawunlessyoujustwanttoplaywithfields

Addtoyoursandbox

YourSplunkSandbox

16

Config Tricks

ApplyConfig withoutRestart

17

| extract reload=true

/debug/refresh– Forcerelogin?

/en-US/_bumpDevelopmentmodesettings– Search“docs.splunk.com developmentmodesettings”

Warning:Notnecessarilysupported

YourSplunkSandbox

18

NOT sandbox

WhentoAvoidtheSandbox

19

NewSearch:– Timeselector– | head

EditKnowledgeObject(Dashboard,Report,etc…)– Clone– Defaulttoprivate

Burch’sGoal

20

WhatNow?

21

Ratethis!(behonest)Moretalks:– conf.splunk.com/speakers.html– Searchforê Burchê Champagneê Optimizationê Practicesê tipsê Worst

Relatedbreakoutsessionsandactivities…

FreeDiscussion

22

Questions,ideas,experiences...haveyou?

THANKYOU