Showing posts with label Log Management. Show all posts
Showing posts with label Log Management. Show all posts

Wednesday, October 28, 2009

Search Assistant in Splunk 4

Being a software developer whose passion evolves about search, mobile applications and analytics and love to look at log files, I find that the most useful and technically attractive feature as I play along with the free version of Splunk> is the Search feature. It is so helpful that contextual suggestions will be given to you as you type your search phrases in the textfield. Initially I was completely clueless about how to perform a search.

The screenshots are as shown below. The top most image is the untouched search string. At first I was afraid to type anything into the textfield having the similar fear that Google might crash if we search for "google". Nah ... just kidding:P As a fail-safe software developer I assume that Splunk has an excellent exception handlings. However, I tried searching for the usage manual but I did not know how to search for it (for example the appropriate search strings to search for the manual and such).Imagine myself greeting you "Hi, this is Nicholas Key and I'm a software engineer. EEErrrggghhh..."This video provides you an excellent way to get started, in my opinion.


Update: Actually there is an introduction that teaches you how to use the Search feature but I overlooked it. Instead of clicking at Getting Started, I clicked at *NIX. You may find a brief explanation about using various techniques to perform search. Screenshots are as below:

Tuesday, October 27, 2009

Splunk> User Interface

Here I am at the login page of Splunk>. The username/password is admin/changeme by default. You will have to click at the "First time signing in?" link to get the clue ;)
I think that the UI is really welcoming and slick. The snapshot is as below.
Since I feel like first trying out the *NIX application, I'll have to enable the feature before launching it. Even the AJAX powered loading modal looks impressive. Don't believe me? Take a look at it yourself :)

Trying out Splunk> 4.0.5 build 69401

This is my first time trying out an intelligent application that helps you monitor the content of your log files. Let's see how much I progress being a new user installing this application.

[1] Downloading a copy of Splunk>
This is the URL if you want to try out the free version of Splunk>. There are many choices of platforms for you to choose. I chose the MacOS 10.5 version and downloaded the DMG file. The version that I downloaded when I first wrote this article is splunk-4.0.5-69401-macosx-10.5-universal.dmg
[2] Installing Splunk>
If you are stumped trying to install Splunk>, there is a wiki page at your convenience. Click here to take a look at their help page and then select the appropriate version of the copy you downloaded. I clicked at version 4.0.5 and selected the link that guides me how to install it into my computer.
[3] Installation steps
The installation was a breeze until I wanted to launch it. According to the manual, I'll have to type this out $INSTALLATION_DIRECTORY/bin/splunk start. It did not work but I had this "gotcha" moment and did a ./splunk start and it worked just fine. You do not actually need to do $INSTALLATION_DIRECTORY/bin/splunk start --accept-license because you'll have to agree with the agreement during the installation by typing y (the second picture illustrates that).
[4] Installation process completed
I was shown these lines at the bottom of the output:

If you get stuck, we're here to help.
Look for answers here: http://www.splunk.com/base/Documentation

The Splunk web interface is at http://nicholas-keys-macbook-pro.local:8000

[5] There's no step 5 :P
Just kidding. The fifth step is to start exploring the features of Splunk> and understand why it is good as how people claim it is. Splunk's themes are very catchy and I particularly like this theme "Finding your faults just like mum". Sample snapshot of Splunk> in my browser is shown below.