>> Hi, we're on Module 4,
and in this video we'll be getting
familiar with the Splunk Web Interface.
To start off, I'm logged into
my machine where we
previously installed Splunk Enterprise.
I've got a browser open to the Splunk Web Interface,
and it's unable to connect.
Since I didn't enable
boot start and have since shut down this machine,
Splunk isn't currently running.
I can check that by going opt/splunk/bins/splunk/status.
Splunkd is not running.
If you want to start
the Splunk software to
run automatically when you turn on your machine,
you can enter the following command,
opt/splunk/bin/splunk enable boot.
start. Perfect. To start it up,
I'm going to go opt/Splunk/bin/Splunk start.
Checking that everything is up and running,
and once that's done,
I should be able to log in.
Perfect.
For starters,
we're going to one of the most commonly used places,
the search and reporting app.
Since we haven't got data yet forwarding the Splunk,
you'll only be able to get Splunk on
Logs about how it and its host are doing.
I'm going to type in index equals internal,
just so we have something to see here.
From this screen, we have a few options.
We could save this as an Alert,
Report or Dashboard and
we can go through some different options
to visualize the data.
This green eye,
is another good place to know about.
It's a quick overview of the health status of Splunk.
Since everything's green, there
isn't anything we need to investigate here.
Messages can be another good place
to check for possible errors and issues.
These just tell me there's a newer version available.
Another place you can get
a more thorough overview of
the health and status of Splunk
is by going to settings, monitoring console.
This page gives us
a nice overview of how I'm looking as far as CPU,
disk memory, and licensed usage.
If I click on health check,
I can run a report for possible issues.
We aren't going to go in-depth with this,
but you want to know what the different pieces are if
you plan to have administrative duties in Splunk.
I'm going to click back on the settings button here,
and go do searches,
reports, and alerts.
You'll immediately notice,
that there are already some items here.
These are alerts designed to let you
know when there's a problem with Splunk's health,
such as if you're at your License Coda,
or if you're running out of disk space.
These all pertain to the monitoring console App.
If I click here,
I can select all.
You'll notice that we have several pages
of saved searches,
reports, or alerts.
If I want, I can look at the ones that I've just built,
which is none right now.
I'm going to take a look at users by going to settings,
User Authentication and Access Controls.
If I click on Users,
there's just me right now.
But if I wanted to, I could add
a new user by clicking here.
If I go back and click on Roles,
you can see the different
default roles that are available.
You should be set as an admin right now.
But if you wanted to create more limited roles,
which is a good idea to only
give people as much access as they need,
you have the Ability in Splunk Enterprise to limit
users to only access certain data,
and limit their access in other ways.
You can also tie accounts to
external authentication methods such as LD App.
Going back to settings,
we can also restart Splunk from the Web Console by
going to settings, server controls.
Then we can just click
this restart button if we wanted to.
Then under activity there are two useful options;
jobs and triggered alerts.
Triggered alerts are just what you'd think,
alerts that I've recently triggered.
If we want to open up jobs,
it will show you which jobs have recently completed,
or currently running, such as searches.
If I wanted to go back into
the Search and Reporting app and run on a such,
we can see it pop up in there.
While data is stored for a while,
which is determined by your retention policies,
specific such as typically aren't kept for very long.
In this jobs area,
if you knew that you wanted to store
specific results for a while and maybe share it,
that you could extend the life in here,
by clicking on that button.
You could also delete the job
such as if you're in a situation where
too many searches were run at once and
it was causing problems,
you could go through and try
and delete the unneeded ones.
Or if you forgot about what
that perfect search was that you ran
just a minute ago and had closed out the window,
it will still show up here.
In future videos we'll get to a lot of these other items.
So just looking at data inputs, indexes, and look-ups.
Now we'll just hop back to my slides for a quiz.
True or false?
You can restart Splunk from the Web Interface.
The answer is true. You can restart
Splunk by going to settings and server controls.
In our next video, we'll look at different ways to
get data into Splunk. Thanks for watching.