Once, when I picked up a book from the local library, the librarian asked to tell her what I thought about the book when I would bring it back. Well, why not write a few lines about all the books I read so everybody could see what I thought about it? I'm often also happy to have friends recommend a certain book or tell me this and that is not really worth reading. I won't comment about the tons of books I have read so far, but about books I read from now on.
| highly recommended | sehr empfohlen | |
| good reading | gutes lesematerial | |
| average | durchschnittlich | |
| not too interesting | nicht allzu interessant | |
| recommended not to read it | empfehlung das buch nicht zu lesen |
 |
|
|---|---|
| title | Big Data Analytics Using Splunk |
| author | Peter Zadrozny and Raghu Kodali |
| ISBN-10 | 1-430-25761-X |
| ISBN-13 | 978-1-430-25761-5 |
| ASIN | |
| rating | |
| date | 2014-May-25 |
splunk> is a very powerful tool. With the right input, and the right questions asked, you can get an awful lot of information out of your logs and data.
This book helps you understand how splunk> works, how to "think splunk>". It does walk you through a number of scenarios with mostly publicly available data. Many scenarios are probably not what you will use in your environment (flight data, twitter data, foursquare data), but that's not the intention either. It is to showcase both possibilities with and handling of splunk>. All the scenarios include information on how to get the input/sample data, how to make it available to splunk> and the how to dig for the golden information nuggets in it. The text points out again and again how important it is to understand your logdata, and yes, as someone working with splunk> professionally, I agree this can't be stressed enough.
There are many monochrome screenshots to show what is being done, which is good. But sometimes coloured images would be easier to follow, especially when some resulting charts are shown. Some screenshots are not too easy to decipher, there are a few mistakes in the text and also some other rough edges, but it's not too bad. While I think the topic about clustering splunk> at the end of the book is positioned well, I personally think the introduction to forwarders should have come towards the beginning, not the end. After all, you may want to get started with your own projects already while working through the book.
The appendix dealing with performance is rather vague and the appendix listing some of the apps may be outdated quickly, but it does give some idea what there is in terms of add ons. The book only scratches the surface of the available commands and does not give any lists or tables of what commands, evals etc. are available in splunk>, but then again, it is not a tutorial or product documentation, but a selection of scenarios to showcase approaches and the way of thinking and exploring required to make you a successful splunk> user or admin.
If you are new to splunk>, don't think you'll know all there is to know after reading this book, you'll need other information too. But for getting info and samples how to wrap your head around logs and data the "splunk> way", I think the book is worth its price.
