Visualizing Your Data

1. Data Models

Welcome to data and models. The concept of a data model is quite simple,but data models themselves can get kind of tricky. That's OK, we'll walk you through them. In general, a data model makesmachine data easier to use. It simplifies complex data through abstraction and groups specific types of data. What do we mean by that? Well, your DevOps group or your operational intelligence group may not know everything that you know about Splunk. So what you can do is build data models for them so that they can still create visualizations, alerts, and reports in Splunk but without having to know the nitty-gritty details of Splunk like you do. We actually use data models more often than we think. For example, mathematical formulas are a perfect example of data models. Remember that the formula for calculating the area of an atriangle is area equals one-half base times height. And think about it. The data can be totally different for A, B, and H,but the model is how we make sense of the data. We can put in any number for two of those three variables and solve for the third one, for example. So, a data model is essentially a set of rules that govern how we interact with data and how data behaves. It's kind of like stacking Legos in the spark world. We stack objects with object constraints and object attributes. I e. Fields objects contain event searches and transactions,each with their own proper constraints. And then we add fields, autogenerated by the Splunk engine, lookup tables,eval statements, regular expressions. Let's take a closer look at objects more closely.Events are the most commonly used type of object, and usually events represent the very first part of a search, i.e., the metadata. In addition, host equals source equals source type equals. It's a very broad place to start, and that's good. Searches are more complex than events in that they can contain commands and transformations and things like that. And transactions can combine multiple events from one or many sources into a single event. And now let's take a look at fields and object attributes in the data modelling world. They're not tied to a specific object. We can get auto, extracted fields, evalstatements, lookup tables, or regular expressions. Data models are extremely powerful in Splunk, and the idea is to have a dedicated team of people that just build and define data models for the operational intelligence people. And the operational intelligence people will then use the Splunk Pivot tool to build visualisations, alerts, and reports based on the data model that you've already built for them. So you build the underlying structure, the data may change the rules that govern that data, which is embedded in your model and ready for the operational intelligence people to use. So let's take a look at building a simple data model in Splunk. To create a data model on our Splunksearch head, we'll go to settings > data models and we'll choose a new data model. We'll call it something we'll choose. In an app context, it doesn't matter too much. I like to go with searching and reporting. Click Create. And now it's going to ask us to start building with those Legos to start putting together our data sets and our constraints. So first of all, it says to get started with a data set. Now, recall, we can start with a root event or a root search. An event is simpler than a search, and usually it's broader than a search. We could do a broad search like hostequals or source equals or source type equals. And I think it's good to start with that. Let's name our data set "my data setone," and this is the constraints box. And that is where we will focus our search. And we know that we have the homework data set already uploaded into the Splunk instance and the host value is set to homework. I can click Preview here and see that. And there's our homework data set. So let's save that and notice it. Put that data set here as one of the building blocks for this data model. And it gave us the original Splunk metadata fields of time, host source, and source type. And we can add more fields as necessary. But now let's think about the use case for this data model. Let's say that our operational intelligence analysts want a data model that they can put data in and manipulate that deals with backup volume and backup duration. So, as a Splunk administrator or as the data professional in the organisation to build this data model, those are the fields that we want to add, the fields that we believe the analysts will need in this data model. So, because this is just a CSV file,all of the fields have been auto extracted.But we can use an eval expression or look up a regular expression to get the feelings that we need. But we already know the fields are auto extracted. So for backups, I think it's safe to say we would need these two fields. We can look at a sample dataset of any field we are unsure about. Let's include the date and maybe destination IP is important. Let's look at event types. Okay, nothing there, level. If that relates to backup error messages,then it would be good to include physical addresses, which look like machine Mac addresses. The analysts may need that information. Source IP would be good because we have a destination IP up here as well. They might need to know the state and the system ID. And we won't worry about these time ones because we can just use the default underscore time and type probably has something to do with it as well. Now we can force these columns, these fields, to have different data types, but generally speaking, spike, that's the best data type for you. Okay, here's our current data model. We can create a more complicated data model. If we had more data sets to work with,that would be relevant to this data model. in other words, relevant to analysing backup data. We could add children and other root events as well. So you can see how we build this data model in a hierarchical way. In the next video, we'll look at how to use this data model by accessing the Pivot editor right here. So until then, keep blunting. And I really appreciate your staying with me on this course.

2. Using Pivot to Build Basic Visualizations

Welcome to working with the Pivot Editor. This video is a direct SQL to the last video. So I recommend you watch the last video if you haven't already. Where we left off was that we created a basic dataset and the Pivot editor works with data sets created by the data managers in the organisation and they are the rules and constraints which govern data. And they allow analysts to use the Pivot editor to build visualisations based on those data sets. Here we built a very simple data set that has homework and then it includes all of these fields. If we simply click on Pivot to enter the Pivot editor, it will ask us to select the data set that we want to work with. There's only one data set. It's the one we created when we first entered the Pivot editor. You'll notice that we have some default values already preset. In the filters area, we have all time. And in the column values, we already have one column value that's the count of all events in the data sets. These are the things we manipulate in the Pivot editor to build our statistical table and eventually to build our visualization,which we'll select from the left side. Here, the filter area is used to reduce the result count for the dataset. For example, I could do a filter for only the last 30 days or something like that, and that would reduce the result count. You could imagine if you're working with huge data sets, filtering those data sets would be extremely important. Time is essential to use as the first filter for any data set. But we can add other filters as well that will reduce this data set. And notice that only the fields that we selected to be in our data model are here. So you can imagine that by doing this, we make the analyst's job a lot easier. Here we have split rows, and what this does is split out the pivot results by row. For example, we could have a row that represents a particular date and time. We could have a row for each month,or a row for each week, etc. We can also split the values by column. But be careful about splitting values by column. Column values are almost always numeric in nature. They're some sort of count or sum or average. So let's start working with our data set. First of all, let's constrain this by time. Let's say, let's choose a relative timestamp and we'll go to 120 days ago and apply that. Now we've filtered this down to only 205 events. And now remember, we're pretending we are the data analysts now. So we want to find out specific backup data and we want to build a report on that. So let's add a row for time. And what period do we want? Let's say days will work and we'll do the default sort. Now we have one row per day. So that's what split rows mean. We still have the default column value of the count of all events. So this counts all events on that day. But that's not really going to help us with our analysis of the backup data. So, let us click here and change it to backup volume. Give it a friendly name. And notice here that we can do different kinds of calculations. This is assuming that it's a numerical value, and that there are only distinct values in the data set. So doing sum will be fine. I'm going to sum it up per day. Backup volume Awesome. Now, we might also want to know the source IP address,for example, and we can manipulate this if we want to. We could move. We could simply drag and drop the rows around. But I think we have a good amount of data to build a very basic visualization. So I'm envisioning a line chart or an area chart with time on the xaxis and volume on the yaxis and then coloured by the source IP. Let's see if we can do that. And I think maybe we'll try an area chart. And right now, time is on the x axis and volume is on the y axis. So let's scroll down to colors, add a color,and the colour should be the source IP,and let's see what that does. Okay, now this could be useful. The data in the data set generates a random source IP,but if we assume that we only have a distinct set of systems, then this could be a really valuable area chart. So let's make this zoom in just a little bit and in the time range. Let's do a date range, and we'll do April 1 to April 30, one month. There are way too many source IPS here. Let's instead change the colour to something that has discrete values and not as many maybe level. Now, this is a much better chart because we can see the date, we can see the volume on the y axis,and then we can see that it's coloured by level. So maybe it's an error level or something like that. That's the area chart. We can see if a different chart might work better for us, maybe a line chart. And as you can see, where there is no data, it is not connecting them. We can change that simply by clicking this here undergeneral where it says no values. We simply connect, it makes it look a lot better, and we can maybe see what a bar chart would look like. It's pretty busy there, though, on a bar chart. What about a column chart? Again, this could be useful. I think maybe if we do a stack there, that's really quite nice. You.

3. The Chart and Timechart Commands

In this segment, I want to show you how to create simple visualisations without using Pivot by just using SPL. So again, using our homework data, let's think about another visualisation that we might want on our dashboard and over on the Field Explorer, I'm going to pick out some interesting fields that might be meaningful to us or to our stakeholders. For this one, let's look at Users, and we have a bunch of different usernames, so that could be good. Let's include users in our search and we want to include all the usernames to keep it simple. We might just want to know how many users are in each state. So State has all the two other postal abbreviations for states in the United States. So let's also include the field state. We'll query every single state. So our host homework data, our user, and our state are all the same. Now to make this look more organized, we're going to use a technique that we used earlier in the course where I'm just going to create a simple table with User and State. This will make the data look more organised and it will also show us only the data that we want. So we have a user and a state. Now there are a finite number of states, but there are not a finite number of users. There could be any number of usernames. So chances are, since there are 20 rows, there are some states with more than one user. So let's say we want to make a columnchart that shows states on the x axis and the count of users on the y axis. And you can sort of envision that in your head. And there are two main ways to make a chart using SPL, and they are to either use the command chart or time chart. The time chart command automatically builds a chart based on time. Time goes on the x axis, and you can't change that with the time chart command. But remember, I wanted the x axis to be each state. So we can't use a time chart. We'll have to use the regular chart command and chart has some of the same functionality that the stats command has. And we did. We checked out the stats command earlier in the course. So what I really want to do is get the count of the number of users by state. So I'm going to do the count and then field. The field we want is User. We want the number of users, and we'll simply say by state. Okay, now this is a nice statistical table of each state and the number of users for each state. And if we click on the visualisation tab, we already have a recommended visualisation and it has a column charge just like we wanted. So now we can see each individual state. We can hover over it and see the number of users. We can also look at the y axis for the number of users as well. Let's say that this counts as USR. This is pretty cryptic, and our CEO or whomever our stakeholders want a different name for the Yaxis. It's very easy. We can just pipe to renamecount USR as the number of users. And remember, we are putting the number of users in quotes because it is a phrase, it has spaces in it, and they are not individual keywords. Run the search again. And here we have the legend number of users, number of users on the y axis in each individual state. So let's add this visualisation to our existing dashboard, which we'll save as a dashboard panel. Existing homework panel titles will be counted by state and don't view the dashboard yet. We're not quite done. To show you the time chart command, I'm going to go back to our core search now for time chart. Let's think about something that we might want to record or visualise over time. And let's say maybe we want the average time it takes to do a backup. So the average backup duration by domain could be beneficial. So let's bring in backup duration and domainwildcards to each, because we don't care what backup duration and which domain it is. We're going to be charting those over time. We'll simply pipe that to the time chart, and it has a lot of the same format as stats or regular charts. So we actually need to average backup duration by domain. Let's see what that gives us. Okay, so the time chart commandsplit the columns by domain. We have all of our domains listed there and the date it looks like by day. And let's see what Splunk recommends for visualisation for this. Okay, so this looks interesting. We have colour by domain name. We have a date on the x axis and the average hours that it took to do a backup on that domain. In theory, we can add this as is to our dashboard,but let's see what we can do with the format, because we might be able to do something more interesting, like a stacked chart where it will show each day. It will still colour by domain, but it will stack them. This will allow us to see proportionally, which is taking longer. The other way we can do it is by stacking 100%, which will show us real proportions and percentages based on a total number of 100%. So this could be an interesting chart. So let's add that to our existing dashboard called Homework, and we'll say average backup duration by domain for our panel title. Okay? Let's edit the dashboard panels. And let's drag this one up here. And now we've got a really nifty looking dashboard. And if this were real data, it could actually be useful to an IT operations environment. I hope you've enjoyed working with visualizations. I recommend you practise these as much as you possibly can and learn everything you can about SPL and Splunk visualizations. It's really the core of Splunk. As always, I thank you for joining me. I'll see you in the next segment.

4. Reporting and Alerting

Welcome back. In this segment I want to talk about reporting and alerting. In Splunk. Reports and alerts are knowledge objects in Splunk. To create reports and alerts in Splunk, you need the enterprise license. As a result, when your licence licence becomes free, these two features are disabled. Reports are nothing more than saved searches that can be run on a schedule and perform an action. Some of the actions are sent via email to report consumers. These could be CEOs or anybody that would need these reports. You can embed them on a web page, you can use them for dashboard panels, or you can run a script. You can schedule reports to run every hour, day, week, month, or on a cron schedule that you define. And you can stagger the report running window. So if you have several reports running at the same time every day, say 8:00 a.m., and they're consuming a bunch of Splunk resources, you can stagger when the reports are being run. And next up, I want to talk about alerts. Alerts are very similar to reports. They can be scheduled or they can be set in real time. And an alert is really something that's triggered when the results of a search meet a specific condition that you define. So for example, if I want to see userauthentication failures on a certain firewall, I tell Splunk to monitor that in real time and if it returns anything, trigger an alert. And once you trigger an alert, you have to give it an action. An action can be sending an email, triggering a script, using a webhook listed in Spunk Triggered Alerts. You can just go to the Spunk triggered alerts page and it will show all the triggered alerts and use an external app like Page of Duty or Slack, which turned out to be very very helpful. So let's take a look at reporting and alerting in Splunk. And I'm going to move over to a mySplunk instance that has an enterprise license. And for this, I'm going to use Splunk's internal index and I'm going to create a search with some interesting fields. Here. It looks like there's a log level. So let's choose log level error and we're simply going to go up here to save as choose alert and let's just name it Test Alert. Here's where we would put a description like this: alerts if any error log levels come through and we can have a private or shared in the app. I like to do it in real time. We can choose between scheduled or real time. If we choose real time, it takes away all that scheduling information. If we use cron, we can, as I said, every hour, day, week, or month run on a cron schedule. So right now, let's say realtime and trigger an alert when we have peer results, number of results, number of posts, number of sources, and custom. So let's say the number of results is greater than zero in 1 minute and trigger once. And then we can do a bunch of actions here like log event pager duty, which I have attached to my Enterprise Splunk instance. Write a script, send an email, or web hook. So I'm not really going to build this alert because it will probably alert me. And this is an enterprise production system. Now, let's say we wanted to create a report. We'll do the same thing. We'll choose Save as and then choose Report, and we'll just name it Test. And reports can have time-range pickers built into them. That's fine, we can do that. And after we save the report,we can choose to embed it. This is embedding it in an HTML website. We can schedule it. We can give it different permissions. If we click on schedule, we have the same scheduling options as the alerts. And here's where we can choose a schedule window. If we have a bunch of alerts running at the same time every day, we might choose a different window for each one, and therefore it won't utilise as many Splunk resources. And as always, I thank you for joining me in this section and I look forward to seeing you in the next section. Bye.

ExamSnap's Splunk SPLK-1001 Practice Test Questions and Exam Dumps, study guide, and video training course are complicated in premium bundle. The Exam Updated are monitored by Industry Leading IT Trainers with over 15 years of experience, Splunk SPLK-1001 Exam Dumps and Practice Test Questions cover all the Exam Objectives to make sure you pass your exam easily.