YourSplunkSandboxWhileyougetsettled…
1
LoadFeedback:DownloadLatestSlides:https://splunk.box.com/v/burch-
sandboxoraskaneighborwithflashdrive
RelatedBlog:Search:blogs.splunk.com yoursplunk
sandboxhttp://blogs.splunk.com/2016/03/22/your-splunk-
sandbox
Copyright©2016Splunk Inc.
BurchSalesEngineer@Splunk
YourSplunkSandbox
Disclaimer
3
Duringthecourseofthispresentation,wemaymakeforwardlookingstatementsregardingfutureeventsortheexpectedperformanceofthecompany.Wecautionyouthatsuchstatementsreflectourcurrentexpectationsandestimatesbasedonfactorscurrentlyknowntousandthatactualeventsorresultscoulddiffermaterially.Forimportantfactorsthatmaycauseactualresultstodifferfromthose
containedinourforward-lookingstatements,pleasereviewourfilingswiththeSEC.Theforward-lookingstatementsmadeinthethispresentationarebeingmadeasofthetimeanddateofitslivepresentation.Ifreviewedafteritslivepresentation,thispresentationmaynotcontaincurrentoraccurateinformation.Wedonotassumeanyobligationtoupdateanyforwardlookingstatementswemaymake.Inaddition,anyinformationaboutourroadmapoutlinesourgeneralproductdirectionandissubjecttochangeatanytimewithoutnotice.Itisforinformationalpurposesonlyandshallnot,beincorporatedintoanycontractorothercommitment.Splunkundertakesnoobligationeithertodevelopthefeaturesor
functionalitydescribedortoincludeanysuchfeatureorfunctionalityinafuturerelease.
What’saBurch?
4
• SeniorSalesEngineerinBoston• Education• CS@BostonUniversity• MBA@NortheasternUniversity
• SplunkCustomer• Middlewarefor8years(+splunk)• SplunkAdminfor1.5years(splunk4.3+)
• Certs:Knowledge,Admin,Architect• @SplunksinceDec14• Splunkbaseapps
Burch’sGoal
5
Hesitatenomore
Burch’sGoal
6
AgendaStage1:BuildStage2:Play?Stage4:Profit
Config TricksNOT sandbox
YourSplunkSandbox
8
Build
BuildaSplunkSandbox:Options
Localhost Cloud Virtual ContainerAdminRights? Exfiltration? Effort? Coolness?
BuildaSplunkSandbox:License
10
Settings>Licensing
BuildaSplunkSandbox:Developer
11
dev.splunk.com
BuildaSplunkSandbox:STOP
12
YourSplunkSandbox
13
Play
PlayinyourSplunkSandbox:Tutorial
14
PlayinyourSplunkSandbox:ProdData
15
Exportproddata
Gotchas:– Hugedatavolumecouldtimeout– Exportasrawunlessyoujustwanttoplaywithfields
Addtoyoursandbox
YourSplunkSandbox
16
Config Tricks
ApplyConfig withoutRestart
17
| extract reload=true
/debug/refresh– Forcerelogin?
/en-US/_bumpDevelopmentmodesettings– Search“docs.splunk.com developmentmodesettings”
Warning:Notnecessarilysupported
YourSplunkSandbox
18
NOT sandbox
WhentoAvoidtheSandbox
19
NewSearch:– Timeselector– | head
EditKnowledgeObject(Dashboard,Report,etc…)– Clone– Defaulttoprivate
Burch’sGoal
20
WhatNow?
21
Ratethis!(behonest)Moretalks:– conf.splunk.com/speakers.html– Searchforê Burchê Champagneê Optimizationê Practicesê tipsê Worst
Relatedbreakoutsessionsandactivities…
FreeDiscussion
22
Questions,ideas,experiences...haveyou?
THANKYOU