Splunk & AWS
Splunk & AWSGain real-time insights from your data at scaleRay Zhu Product Manager, AWSElias Haddad Product Manager, Splunk
Forward-Looking StatementsDuring the course of this presentation, we may make forward-looking statements regarding future events orthe expected performance of the company. We caution you that such statements reflect our currentexpectations and estimates based on factors currently known to us and that actual events or results coulddiffer materially. For important factors that may cause actual results to differ from those contained in ourforward-looking statements, please review our filings with the SEC.The forward-looking statements made in this presentation are being made as of the time and date of its livepresentation. If reviewed after its live presentation, this presentation may not contain current or accurateinformation. We do not assume any obligation to update any forward looking statements we may make. Inaddition, any information about our roadmap outlines our general product direction and is subject to change atany time without notice. It is for informational purposes only and shall not be incorporated into any contract orother commitment. Splunk undertakes no obligation either to develop the features or functionality described orto include any such feature or functionality in a future release.Splunk, Splunk , Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc.in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. 2017 Splunk Inc. All rightsreserved.
Agenda Current Splunk ingestion landscape for AWSCurrent challengesNew SolutionDemoQ&A
Monitored bySplunk Cloud Available Worldwide4
Splunk Portfolio of AWS SolutionsEnd-to-End AWSVisibilitySelf-deployed AMIs or SaaSon AWS MarketplaceAWS-based SaaSApp for AWSAvailable on Splunk Enterprise,Splunk Cloud and Splunk LightAMI on AWS MarketplaceAWSIntegrationsSaaS Contract Billed throughMarketplaceAWS Lambda, IoT, Kinesis,EMR, EC2 ContainerServiceInsights for AWSsdCloud MonitoringAMI on AWS MarketplaceBenefits of Splunk Enterprise asSaaS
Current Splunk GDI Landscape for AWSv1.2
Challenges Reliability, scalability and fault toleranceManagement overhead of data collection nodesDelayed event delivery due to poll based ingestionAPI throttling with poll based data ingestion
Need for New Solution
Amazon KinesisKinesisStreamsStores data as acontinuousreplayable stream forcustom applicationsKinesisFirehoseLoad streaming datainto Amazon S3,Amazon Redshift, andAmazon ElasticsearchServiceKinesisAnalyticsAnalyze datastreams usingstandard SQLqueries
Current State of Kinesis FirehoseIngestKinesis AgentKinesis StreamsTransformDeliverAmazon S3Amazon RedshiftCloudWatch LogsAmazon ElasticsearchCloudWatch EventsAWS IoT
Our Answers to Challenges Reliability, scalability and fault tolerance challenges Extremely reliable with underlying infrastructure operating in three different AZsExtremely durable with three copies of same data in three different AZsTemporarily holds and buffers data to absorb back pressureData backup to Amazon S3 upon failureManagement overhead of data collection nodes in existing solution Serverless with no resource provision or management overhead Delayed event delivery due to poll based ingestion Push delivery with configurable buffer size and interval API throttling with poll based data ingestion Horizontally scalable with no limit
Kinesis Firehose With Splunk DeliveryIngestKinesis AgentKinesis StreamsTransformDeliverAmazon S3Amazon RedshiftCloudWatch LogsAmazon ElasticsearchCloudWatch EventsAWS IoT
Kinesis FirehoseAdvantagesWhy should I use Kinesis Firehose versus other ingestionmechanisms for Splunk?
Why Kinesis Firehose Fully managed service with serverless architecture Bypass the need for setting up and managing heavy weight forwarderExtremely scalable and reliable Well integrated with various data sources Easy to use with no programming requirementAbility to transform raw data prior to sending it to Splunk Super low cost - 0.029 per GB of data ingested
Serverless and Scalable Supports native balancing to indexing tier Supports Splunk Cloud and Splunk Enterprise
Serverless and Scalable Supports ELB and third party load balancers
Reliable AWS Add-on as Failover Supports delivery acknowledgment. Un-acknowledged events can be persisted toS3 and re-ingested via alternative delivery mechanism.Un-delivered and un-acknowledged events can be ingested from S3 bucket usingpoll based mechanism (Splunk add-on for AWS)
Reliable Lambda to HEC as Failover Un-delivered and un-acknowledged events can be ingested from S3 using lambdafor full push-based architecture.Lambda can be configured to push data to a failover HEC endpoint
Cross Account Delivery Consolidate VPC flow data from multiple account into one Firehose deliverystreamAbility to route events to different indexes based on Lambda conditions
Kinesis Firehose UseCaseWhen should I use Kinesis Firehose versus otheringestion mechanisms for Splunk?
Supported Kinesis Firehose Data SourcesHere is a list of AWS Services supported by Kinesis Firehose AWS CloudWatch Logs VPC Flow Logs AWS Lambda Logs CloudWatch Events AWS API Call Events (CloudTrail), Auto Scaling Events, AWS CodeBuild Events, AWSCodeCommit Events, AWS CodeDeploy Events, AWS CodePipeline Events, AWS ConsoleSign-in Events, Amazon EBS Events, Amazon EC2 Events, Amazon EC2 System ManagerEvents, Amazon EC2 System Manager Configuration Compliance Events, Amazon EC2Maintenance Window Events, Amazon ECS EventsAmazon EMR Events, Amazon GameLiftEventAWS Health Events, AWS KMS Events, Amazon Macie Events, Scheduled Events,Trusted Advisor Events AWS IoTKinesis Streams
What Ingestion Mechanism Shall I Use?Use CaseKinesis FirehoseSplunk AWS Add-onSupported Kinesis FirehoseData SourcesPreferred-Fault toleranceYesOnly SQS based S3 inputGuaranteed delivery and reliabilityYesNoS3 InputNoYesOn-Prem Splunk with privateIPsNoYesPoll-based Data Collection(Firewall restrictions)NoYes
Kinesis Firehose Limits 20 Kinesis Firehose delivery streams per RegionDefault a maximum of 2,000 transactions/second, 5,000 records/second, and 5MB/secondLimits can be increased, but be careful not to increase past the incoming trafficamount. This can lead to small delivery batches to destinations, which isinefficient and can be costly.Please refer to the Kinesis Firehose documentation for instructions on how toincrease limits: its.html
Demo
In SummarySplunk AWS Cloud Visibility Strong partnership with numerous product integrationsCurrent GDI for AWS data into Splunk HTTP Event Collector, AWS Add-on, DB ConnectFirehose Kinesis integration Addresses scalability and reliability concerns
Interested? Sign up for BetaKinesis AgentKinesis StreamsCloudWatch LogsCloudWatch EventsAWS IoT
Q&A
2017 SPLUNK INC.Thank YouDon't forget to rate this session in the.conf2017 mobile app
Splunk Portfolio of AWS Solutions AMI on AWS Marketplace Benefits of Splunk Enterprise as SaaS AMI on AWS Marketplace App for AWS AWS Integrations AWS Lambda, IoT, Kinesis, EMR, EC2 Container Service SaaS Contract Billed through Marketplace Available on Splunk Enterprise, Splunk Cloud and Splunk Light End-to-End AWS Visibility
As an alternative, an app can be uploaded using the corelight-client command line utility: corelight-client splunk list splunk delete Removes a previously uploaded Splunk App. splunk download Retrieves a previously installed Splunk App as a ZIP file. splunk list Returns a list of all installed custom Splunk Apps. splunk upload Uploads a new Splunk App from a ZIP file.
Intellipaat's Splunk certification training includes the complete aspects of Splunk Developer and Splunk Administration. This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log analysis, Splunk dashboard, and deploying Splunk search, monitor, index, report, and analysis.
GSG-Monitoring-and-Diagnostics-101 sales@splunk.com www.splunk.com Try Splunk Cloud or Splunk Enterprise for free or learn more about IoT and industrial data. Already have Splunk? Download Splunk Apps on Splunkbase. 5 Connecting Splunk to Industrial Data and the IoT Kepware Industrial Data Forwarder for Splunk
This is Intellipaat Master Program in Splunk tool includes Splunk Developer and Splunk Administration training. As part of this Splunk course, you will work on searching, sharing, saving Splunk results, creating tags, generating reports and charts, installing and configuring Splunk, monitoring, scaling and indexing large volumes of searches and analyzing it using the Splunk tool. Instructor Led Training 26 26Hrs of highly interactive
compatible knowledge to use with other Splunk apps, like the Splunk App for AWS, Splunk Enterprise Security, and Splunk IT Service Intelligence. This guide shows a central view of logs for the security teams in a multi-account AWS environment. The log archive account in an AWS Control Tower landing zone is the
Splunk Configuration 1. To install Splunk Apps, click the gear. 2. To install Splunk Apps, click the gear. Click Browse more apps and search for "Fortinet" 3. Install the Fortinet FortiGate Add-On for Splunk. Enter your splunk.com username & password. 4. Then install the Fortinet FortiGate App for Splunk. Enter your splunk.com username .
Splunk Documentation: docs.splunk.com Splunk Education & Training: education.splunk.com Third-Party Tools (not supported by Splunk) Search Examples: Big Book of Splunk Searches:bbosearch.com GoSplunk-A Search Repository: gosplunk.com Sizing Tool for Predicting Storage Requirements: splunk-sizing.appspot.com
alimentaire à la quantité de cet additif qui peut être ingérée quotidiennement tout au long d’une vie sans risque pour la santé : elle est donc valable pour l’enfant comme pour l’adulte. Etablie par des scientifiques compétents, la DJA est fondée sur une évaluation des données toxicologiques disponibles. Deux cas se présentent. Soit après des séries d’études, les experts .
