SPLUNK

Are you searching for something important ? Is it a particular data or anything else? Have you ever thought of creating a software for searching data? If  you have something in mind related to that, just erase it, because it already created and the developers named it SPLUNK.

Splunk acts as a bridge between you and the system containing data. This bridge will be in the form of index through which you can search for a particular data easily.

WHAT IS SPLUNK?

It is nothing but developing software which captures, indexes and correlates real time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.

A system analyses all the data and arranges according to the users need.

Multiple systems should be used to make the process quicker.

(40 node clusters will be used for a quick process. 40 node clusters- 40 machines to run process parallely):- HADOOP.

WHAT HAPPENS WHEN A SYSTEM GOES DOWN?

1) The logs generated by the system will be analysed.

2) The updated information of the log will be viewed.

3) The interaction can be made with the system directly.

WHAT ARE THE DIFFICULTIES?

1) It is difficult to verify all the logs at the same time.

2) It is difficult to validate all logs at the same time.

SPLUNK FEATURES

1) Reporting

2) Monitoring

3) Log analysis

4) Alerting

5) Dashboards

Yes splunk can be obtained by these three methods

Let's see what these are

SPLUNK ENTERPRISE

Gets all the attributes of splunk when you install splunk enterprise. 

Splunk enterprise is not open source.

The license for splunk enterprise in a paid one.

SPLUNK CLOUD

If splunk cloud is installed then you don't have to install splunk main software. This is because , splunk can be accessed through the cloud.

But i wont prefer using splunk cloud. The data gets out when you use cloud, so it is better to use splunk and not splunk cloud.

SPLUNK LIGHT

This is a lighter version of splunk. 

This splunk light can provide solutions for small IT environment.

COMPONENTS OF SPLUNK ENTERPRISE

There are six major components :

1) UF (Universal Forwarder)

2) HF (Heavy Forwarder)

3) Indexer

4) Deployment Server

5) Search head

6) License Master

UNIVERSAL FORWARDER

• This forwards logs from the system.
• You have to install this software separately (INSTALL SPLUNK UF).
• Collects and forwards data from one component to another.
• It cannot generate report, alert etc.
• You have to install this in all the systems which are involved in the processing.
• UF cannot do anything except forwarding.
• Can forward to  multiple systems.

HEAVY FORWARDER

• The load balancer maintains multiple systems at the same time.
• Heavy forwarder is an area where filtering can be applied.
• Filtering is nothing but removing unwanted data.
• The heavy forwarder performs action on data provided by the Universal forwarder.

INDEXER

Arranging the data provided by the HEAVY FORWARDER.

There are totally two mechanisms in this:-

1) PUSH

2)PULL

DEPLOYMENT SERVER

• To share a data, you have to install database application in all the systems.
• But it is difficult to install database application in each and every system.
• So deployment server can be used to share data in common between multiple users, there wont be need to install database in each and every system.

SEARCH HEAD

• This is used to search data.
• You can search the data you want by just entering the keyword and the results will be listed,  these results can be viewed.
• Search head is a graphical interface.
• Data is pulled from indexer and report is generated from the search head.

LICENSE MASTER

• User faces limit for the data to be indexed.
• Some applications provides restrictions for licensing.
• These can be handled by using license master.

Example:-

using 10gb

used 10gb fully

License master informs about the crossed limit.