Session detailing some of the best announcements from the recent Splunk users conference. Delivered at the Splunk User Group in Edinburgh on October 16, 2017.
With Splunk Enterprise 7.0 and the latest Splunk solutions, it will be much easier to work with metrics, which are sets of numerical, time series data used to track a particular process or activity.
You might think, “Splunk has always dealt with metrics.” We’re all familiar with graphs and charts in Splunk. Let me explain how this is different with Splunk Enterprise 7.0.
Splunk was initially designed for people who are trying to find something in a mess of unstructured data (the needle in a haystack). What about the scenario when you know what you’re looking for and where to look - like temperature fluctuations in a car, or CPU utilization over time (or the weight of all the straws in a haystack) - and you simply need to find this information quickly? We’ve rebuilt the Splunk engine to enable you to achieve this velocity.
With Splunk Enterprise 7.0, metrics are now supported as first-class data. Use of the new metrics index boosts the speed of monitoring and alerting by at least 20X versus previous releases.
This new support for metrics in Splunk Enterprise 7 enables faster, easier machine data analytics. Let’s take a look….
With Splunk, you can pretty much graph or chart anything. Splunk Enterprise 7.0 takes this further. Event Annotation unifies and correlates log events, annotations, and metrics—often from disparate sources—into a single view so you can understand these events with more clarity (e.g., what might have resulted in this particular event - e.g. spike or drop in data. And what additional events might have driven this change)
One example of the ever improving ways to help you visualize your data… and help you get to the answers faster. Feature details:
Event annotations can only be applied to time-series charts (line, column, area). Driven by a secondary search, event annotations expect the following fields as part of the search result:
_time [required] - time is a required field in order to render events on the chart.
annotation_label - this field is optional, but recommended, in order to provide a description of the specific event.
annotation_category - this field is optional and only useful if you want to include multiple event types, such as service starts versus stops.
Custom visualizations must be updated to explicitly support this new behavior.
In this release, event annotations can only be configured using SimpleXML.
in this release, PDFs are not supported for event annotations.
With Splunk, you can pretty much graph or chart anything. Splunk Enterprise 7.0 takes this further. Event Annotation unifies and correlates log events, annotations, and metrics—often from disparate sources—into a single view so you can understand these events with more clarity (e.g., what might have resulted in this particular event - e.g. spike or drop in data. And what additional events might have driven this change)
One example of the ever improving ways to help you visualize your data… and help you get to the answers faster. Feature details:
Event annotations can only be applied to time-series charts (line, column, area). Driven by a secondary search, event annotations expect the following fields as part of the search result:
_time [required] - time is a required field in order to render events on the chart.
annotation_label - this field is optional, but recommended, in order to provide a description of the specific event.
annotation_category - this field is optional and only useful if you want to include multiple event types, such as service starts versus stops.
Custom visualizations must be updated to explicitly support this new behavior.
In this release, event annotations can only be configured using SimpleXML.
in this release, PDFs are not supported for event annotations.
With Splunk, you can pretty much graph or chart anything. Splunk Enterprise 7.0 takes this further. Event Annotation unifies and correlates log events, annotations, and metrics—often from disparate sources—into a single view so you can understand these events with more clarity (e.g., what might have resulted in this particular event - e.g. spike or drop in data. And what additional events might have driven this change)
One example of the ever improving ways to help you visualize your data… and help you get to the answers faster. Feature details:
Event annotations can only be applied to time-series charts (line, column, area). Driven by a secondary search, event annotations expect the following fields as part of the search result:
_time [required] - time is a required field in order to render events on the chart.
annotation_label - this field is optional, but recommended, in order to provide a description of the specific event.
annotation_category - this field is optional and only useful if you want to include multiple event types, such as service starts versus stops.
Custom visualizations must be updated to explicitly support this new behavior.
In this release, event annotations can only be configured using SimpleXML.
in this release, PDFs are not supported for event annotations.
