>> Hello, and thanks for coming back.
I'm Natasha, and in this section we're going to enter
the deceptively simple question of, what is Splunk?
Splunk is a company worth
several billion US dollars
and based out of San Francisco.
It specializes in data use and processing.
Splunk has multiple different products.
But when you refer to just Splunk,
people most often think of
the Splunk platform and its core capabilities,
or they may just think about
whatever they have set up at their company.
Splunk Enterprise, Splunk Cloud, Splunk Free,
and Splunk Light makeup what is
thought of as a Splunk platform.
In future videos,
we'll discuss the differences between
these and talk about other products.
This course will focus on the common uses of
the popular Splunk Enterprise and Splunk Free,
and briefly cover the capabilities of
other products that typically build on this platform.
The company sums up its purpose as
Splunk turns machine data into answers.
To dig a little deeper, Splunk software aggregates,
processes, analyses, and helps you
use small and massive amounts of data.
It's particularly helpful for turning
unstructured data into usable information.
Some examples include ingesting
authentication logs and alerting
when there have been high-volume failures,
or it could collect web traffic data
and provide statistics on visitor activity.
Another example would be storing some data
to let an admin search for
information to troubleshoot a problem.
You could retrieve malware alerts
and correlate it with other activity,
or use a lookup to define error codes
and organize a problem in human-readable format,
gather IoT data and provide meaningful metrics,
sort and store information required for an audit,
and tons of other uses.
Splunk has a strong community
built around its product including forums,
conferences, and even local events in many places.
Its growth has exploded over the last few years,
but was founded back in 2003.
The easiest way to get a grasp on
Splunk might be to take a quick look.
Here's a relatively empty instances
Splunk Enterprise I have running on a virtual machine.
I am searching for some data,
just traffic on this machine,
and I found 320 events in the last hour.
We're going to look at a single event here,
I can pull this up and see the raw text.
This itself would be hard for us
to work with, but as you see here,
it breaks it out into different fields that I can then
use for other tasks.
Right here, I could run a simple search
where I look at how many events
have happened in this data by app.
There we are. Now we've got to our quiz, true or false.
Splunk can only handle parsed data?
The answer is false.
Splunk is great for organizing raw data.
To sum up what we've learned in this section,
Splunk takes data that's difficult to handle,
maybe because there's so much of it,
or because it's unorganized or meaningless on its own,
and makes it usable in a variety of ways,
such as for a reporting, alerting, troubleshooting,
threat hunting, making business decisions, and so on.
In the next video, we're going to be talking about
Splunk and your career. Thanks for watching.