Getting Started with Splunk

Getting Started with Splunk

What is Splunk

Splunk is a software solution that captures, indexes, and correlates data in realtime. You can then search for this data using a search bar similar to google's, but it also allows you to create dashboards, reports, and alerts from those search queries.

Why Splunk

In the forever growing number of devices deployed and used daily, monitoring, and analyzing data created by those machines becomes daunting. Splunk provides a central location in which all this machine data can be forwarded to and then analyzed.


Splunk has many use cases and has undoubtedly come a long way. For use cases, I suggest visiting Splunk for more information. Furthermore, in this series, we will focus on deploying Splunk in a simulated enterprise environment. From there I'll walk you through configuring Splunk and getting data ingested. Once Splunk has been installed and configured, we will learn how to use the Splunk processing language to perform business operations. These operations include monitoring, alerting, debugging, investigating, and creating reports or dashboards.


  • AWS account or similar cloud service
  • Email address
  • Internet (duh)

Positive Attitude and debugging skills are highly recommended if things do not work for you as expected.


During this series, if you find yourself stuck or you are on a different version of Splunk from which this series is based on I highly recommend you seek support from the following.


See you here tomorrow!

See: Installing Splunk