Summary

In this chapter, you learned a number of basic Splunk concepts that you need to get started with this powerful tool. You learned how to install Splunk and configure a new Splunk app. You ran a simple search against the Splunk internal logs to ensure that the application is functional. You then installed a Splunk add-on called Eventgen, which you used to populate dummy data into Splunk in real time. You were shown how to control Splunk using the web user interface and the CLI. Finally, you created your very first Splunk dashboard, based off a single search. We will get a lot more creative with dashboards in additional chapters later in this book.

Now, we will go on to Chapter 2, Bringing in Data, to learn more about how to input data.