Tag Archive for 'splunk'

The book Implementing Splunk: Big Data Reporting and Development for Operational Intelligence written by Vincent Bumgarner and for which I was a reviewer (yes, it’s a unashamed advertisement) is now available.

February 1, 2013, 2:42 pm lock

The latest version Splunk (5.0) is now out, with some nice improvements:
The most visible missing feature for users (customers ?) is PDF report generation: Splunk is now able to generate natively PDF reports (including for report scheduling). You can forget the crappy PDF report app .
Report acceleration (similar to ArcSight trends) that allows fast reports [...]

October 31, 2012, 4:00 am lock

In a non-dsitributed architecture (your indexer is also the host receiving the events), you might want to keep Splunk running as a non-privilegied user but still be still receive syslog from remote hosts. You have (mainly) two solutions:
Setup your favorite syslog daemon (syslog-ng or rsyslogd) to listen to port 514, and then configure Splunk to [...]

March 13, 2012, 3:10 am lock

Splunk 4.3 is out for a few days, and this new release contains some nice improvements:
Sparklines (like in BlueCoat): * | chart sparkline count by host gives the following result:

Flash is replaced by HTML5 (for recent browsers; flash is still used for old browsers), but the behaviour of flashtimeline or reports is kept unchanged. Allows [...]

January 13, 2012, 1:00 am lock

The main log management solutions available on the market have different features, and different way of handling the data. This article focus on how ArcSight Logger, Loglogic and Splunk are handling archives, and what are their integrity functionalities.

How the different log management solutions are handling the data archiving ?
ArcSight allocates data by one gigabyte [...]

September 5, 2011, 12:42 am lock