What is splunk?

Patricia Schaffer

What does the splunk tool do? I know it is for working with Cobalt logs, but what exactly does it allow me to do?

anthony.novak

Splunk is a rich search tool on indexed items. In the Cobalt Platform, log files are indexed to search from a single place and consolidate trends. Files to be indexed must be identified and configured in the Splunk "Forwarder" configuration, then the files are forwarded to the splunk indexer to be indexed for searches through the GUI. Metadata from these logs is appended so you can associate trends - say by server, instance, or even a key word (Error, "was missing because", etc..). Splunk has many more features - monitors, scripts run on condition, etc...

You can index any log files (up to your usage limit) - and Coherence, bigIp, Oracle, and others have been added to the suite. Go to http://www.splunk.com/base/Documentation/latest/SearchReference/SearchCheatsheet for an overview of just the options you have for searching.

Links (search for Splunk in the Green section) - http://sharepoint.thomson.com/sites/sharedops/Lists/OpsLinks/AllItems.aspx?PageView=Shared