Ingesting and Parsing Unstructured Logs in Splunk

[@PaulJeffery81]

Long-time Splunker here! I've been sending my junior engineers and customers to your channel. Keep up the good work!

[@lamecreations_guides]

Awesome! Thank you!

[@maryamjd20]

I'm a newbie to Splunk and find your videos really helpful! I have been searching for content like this -not complicated and explain basic stuff! I hope you make more videos for newbies for example creating dashboards etc..

[@lamecreations_guides]

Thank you so much for your kind words and I love getting suggestions for new content. Looking at existing content, I would recommend this play list for some content on creating dashboards kzbin.info/aero/PLFF93FRoUwXEuaoqQR2Ghe57vmO8IG4yh but based off your request, my next few videos will focus on giving more info on building dashboards. Stay tuned.

[@gebrekutano3507]

Thank you so much! You videos are making deference over here!

[@lamecreations_guides]

Happy to hear that!

[@healthymealthy775]

Great stuff!! Thanks for you all you do!

[@lamecreations_guides]

Thank you for your support to this channel and your kind words

[@pavithratulsi2825]

Can we import any type of logs into Splunk? Is there any specific format required?

[@lamecreations_guides]

The simple answer is, yes. Splunk can ingest any type of time based logs. Syslog, json, text, csv, tsv, key value, etc. There are some exceptions, but that is primarily related to binary data. if it is human readable, splunk will ingest it like a champ. Splunk is considered an unstructured because it takes the logs in their "raw" format and then you can choose to parse them to any format you like after ingestion. Elastic is a structured system because it requires you to identify the structure and format for the logs before ingesting and if the format changes after ingestion, you must re-ingest everything. Hope that helps.

[@ashshah3380]

How do you create a workflow and capture the logs?

[@lamecreations_guides]

Not really sure what you are asking. Are you looking to set up a specific workflow action to drill down on logs or do you need help collecting logs for monitoring a particular process in Splunk. Feel free to reach out to me on my discord and we can chat.

[@healthymealthy775]

I don't see the practice file in github though

[@healthymealthy775]

Can I install this on a cloud version of Splunk?

[@lamecreations_guides]

Only a limited number of apps are available for use on cloud and anything from git will not be approved