Upload File

final_ctm89127_burch_splunk_your splunk sandbox

23
Your Splunk Sandbox While you get settled… 1 Load Feedback: Download Latest Slides: https://splunk.box.com/v/burch- sandbox or ask a neighbor with flash drive Related Blog: Search: blogs.splunk.com your splunk sandbox http://blogs.splunk.com/2016/03/22/your-splunk- sandbox

Upload: ngoduong

Post on 13-Feb-2017

232 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

YourSplunkSandboxWhileyougetsettled…

1

LoadFeedback:DownloadLatestSlides:https://splunk.box.com/v/burch-

sandboxoraskaneighborwithflashdrive

RelatedBlog:Search:blogs.splunk.com yoursplunk

sandboxhttp://blogs.splunk.com/2016/03/22/your-splunk-

sandbox

Page 2: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

Copyright©2016Splunk Inc.

BurchSalesEngineer@Splunk

YourSplunkSandbox

Page 3: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

Disclaimer

3

Duringthecourseofthispresentation,wemaymakeforwardlookingstatementsregardingfutureeventsortheexpectedperformanceofthecompany.Wecautionyouthatsuchstatementsreflectourcurrentexpectationsandestimatesbasedonfactorscurrentlyknowntousandthatactualeventsorresultscoulddiffermaterially.Forimportantfactorsthatmaycauseactualresultstodifferfromthose

containedinourforward-lookingstatements,pleasereviewourfilingswiththeSEC.Theforward-lookingstatementsmadeinthethispresentationarebeingmadeasofthetimeanddateofitslivepresentation.Ifreviewedafteritslivepresentation,thispresentationmaynotcontaincurrentoraccurateinformation.Wedonotassumeanyobligationtoupdateanyforwardlookingstatementswemaymake.Inaddition,anyinformationaboutourroadmapoutlinesourgeneralproductdirectionandissubjecttochangeatanytimewithoutnotice.Itisforinformationalpurposesonlyandshallnot,beincorporatedintoanycontractorothercommitment.Splunkundertakesnoobligationeithertodevelopthefeaturesor

functionalitydescribedortoincludeanysuchfeatureorfunctionalityinafuturerelease.

Page 4: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

What’saBurch?

4

• SeniorSalesEngineerinBoston• Education• CS@BostonUniversity• MBA@NortheasternUniversity

• SplunkCustomer• Middlewarefor8years(+splunk)• SplunkAdminfor1.5years(splunk4.3+)

• Certs:Knowledge,Admin,Architect• @SplunksinceDec14• Splunkbaseapps

Page 5: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

Burch’sGoal

5

Hesitatenomore

Page 6: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

Burch’sGoal

6

Page 7: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

AgendaStage1:BuildStage2:Play?Stage4:Profit

Config TricksNOT sandbox

Page 8: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

YourSplunkSandbox

8

Build

Page 9: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

BuildaSplunkSandbox:Options

Localhost Cloud Virtual ContainerAdminRights? Exfiltration? Effort? Coolness?

Page 10: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

BuildaSplunkSandbox:License

10

Settings>Licensing

Page 11: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

BuildaSplunkSandbox:Developer

11

dev.splunk.com

Page 12: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

BuildaSplunkSandbox:STOP

12

Page 13: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

YourSplunkSandbox

13

Play

Page 14: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

PlayinyourSplunkSandbox:Tutorial

14

Page 15: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

PlayinyourSplunkSandbox:ProdData

15

Exportproddata

Gotchas:– Hugedatavolumecouldtimeout– Exportasrawunlessyoujustwanttoplaywithfields

Addtoyoursandbox

Page 16: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

YourSplunkSandbox

16

Config Tricks

Page 17: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

ApplyConfig withoutRestart

17

| extract reload=true

/debug/refresh– Forcerelogin?

/en-US/_bumpDevelopmentmodesettings– Search“docs.splunk.com developmentmodesettings”

Warning:Notnecessarilysupported

Page 18: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

YourSplunkSandbox

18

NOT sandbox

Page 19: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

WhentoAvoidtheSandbox

19

NewSearch:– Timeselector– | head

EditKnowledgeObject(Dashboard,Report,etc…)– Clone– Defaulttoprivate

Page 20: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

Burch’sGoal

20

Page 21: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

WhatNow?

21

Ratethis!(behonest)Moretalks:– conf.splunk.com/speakers.html– Searchforê Burchê Champagneê Optimizationê Practicesê tipsê Worst

Relatedbreakoutsessionsandactivities…

Page 22: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

FreeDiscussion

22

Questions,ideas,experiences...haveyou?

Page 23: FINAL_CTm89127_Burch_Splunk_Your Splunk Sandbox

THANKYOU


DIGITAL SANDBOX WORKSHOP - Carnegie Mellon …sandbox/news/SDX2004_CAD_print.pdf1 DIGITAL SANDBOX WORKSHOP Summer 2004 Sandbox CAD Support Digital Sandbox Mission The virtual SoC design

データ分析プラットフォーム「Splunk」 - Panasonicdl.it-sol.jpn.panasonic.com/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Splunk Conf2010: Corporate Express presents Splunk with SAP

Splunk bsides

Enter Sandbox: Android Sandbox Comparison - … Sandbox: Android Sandbox Comparison Sebastian Neuner, Victor van der Veen, Martina Lindorfer, Markus Huber, Georg Merzdovnik, Martin

Healthcare Services Platform Sandbox. The HSPC Sandbox HSPC Sandbox Architecture : Scot Post van der Burg Asthma Ally

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

SandboxLIVE Maples PPT · Sandbox Social Media Sandbox Webinar Sandbox Resource Library Sandbox Exhibitor Academy Sandbox TV Sandbox LIVE. Sandbox Exchange. Sandbox Social Media

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Splunk Search

SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

Splunk App for StreamMany Solutions, One Goal. Some history •Splunk acquires Cloudmeter, December 2013 •Renamed Splunk App for Stream •Released with Splunk 6.0 (August, 2014)

Splunk For IT Operational Intelligenceuploads.integrity360.com/1425903243-Splunk-for-IT-Operations.pdf · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad [email protected] Indexing 2.2.1 Searching using splunk Splunk uses

Netfilter Iptables for Splunk Documentation - Read the Docs · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users

Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk ITSI Sandbox Guidebook

Splunk Cloud Product Briefwinncom.com.ua/wp-content/uploads/2018/07/splunk-Log_Flow.pdf · Extend Benefits With Splunk Apps Splunk Cloud includes support for premium solutions such

Splunk in Rakuten: Splunk as a Service for all

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Industrial Data Internet of Things splunk (REST API, SDKs) splunk . TESCO splunk 500 Y—Jt1-3— 41328 . SHANON 1/5 splunk . htt . (500MB/B) s lunk splunk . Created Date:

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk conf2014 - Splunk for Data Science

Regulatory Sandbox Framework Sandbox/Documents...Regulatory Sandbox Framework February 2019 1 Table of Contents 1. Introduction ..... SAMA�s Sandbox directly connects with ‘KSA’s

SPLUNK Capabilities Overview - GTRI · Overview GTRI is the only ELITE Splunk integrator with certified Splunk architects and engineers on staff. In addition to ... SPLUNK-Overview