>> Hello, I'm Natasha and in this video,
we'll go over the basics of using apps and Splunk.
Apps and add-ons are two ways to add to
Splunk capabilities and they're easy to get mixed up.
Partly because there's, according to Splunk,
no definite criteria that
universally distinguish an app from an add-on.
We can still try to separate them out.
Apps are applications you install on the Splunk platform
and often have interactive dashboards
so they'll do new things with your data.
Apps are typically more visual and interactive.
Add-ons or more for getting data in
and doing behind-the-scenes changes.
This could be a specific configuration
you give out to foreigners to
retrieve a certain type of data and
extract the fields properly, just for example.
Apps and add-ons can be Splunk
built or they can be built by vendors or users.
Many different companies offer
Splunk apps that work with the data from their products.
Individual developers can also submit apps.
It's highly recommended that you install apps in
a test environment before adding
them to a production environment.
Sometimes there can be conflicts with
other configurations and apps may cause issues.
You'll definitely want to check out Splunk base.
Here you can search over a thousand apps and
add-ons for things that may be
useful in your environment.
These are a few popular apps
just to give you an idea of what's out there.
Splunk security essentials provide
security focus searches you can use in your environment.
It has an interactive dashboard where you can
evaluate your source types for
the things you might monitor,
and look for what types of
threats you'd be able to target.
This is not to be confused with the Splunk app,
enterprise security, which you have to pay for.
But it still provides many useful abilities.
The DB Connect app is really helpful for tying into
databases such as SQL database to retrieve data.
The lookup file editor lets you modify
lookup tables from the web console with these.
There are a ton of vendor-specific apps,
such as ones for Cisco sources,
AWS, Palo Alto, Microsoft Azure, Workday, etc.
There are also plenty of
useful apps for specific purposes,
such as geolocation lookup,
special visualization, even weather information.
If you're interested in creating apps,
that's totally an option,
you can make them for your personal use
or share them with the community.
If you want to, you can become
a Splunk certified developer.
You need to first become
a Splunk Enterprise certified admin to pursue
this and then take
several classes specific to development,
and then take an exam.
Let's go ahead and install an app
from the GUI so you can see what it looks like.
The app I'm installing today
is called Splunk essentials for wire data.
This app is mostly going to provide examples and
instruction for working with wire data
like network traffic and packet captures.
To start off, I'm
just going to unclick this fine More Apps button.
If I wanted to, I could start off in Splunk base and then
download the file and upload it to the web interface.
Here, I can browse by tons of new apps,
lookout popular ones, and I can search by keywords.
I'm going to type in Splunk essentials
for wire data and see what comes up. There we are.
I'm just going to click "Install".
I will have to log in for this.
It just downloaded.
That was pretty quick and I'm going to go ahead and
restart now in order to complete the installation.
I've locked back in and now I see a new app under
here. Here we are.
We installed an app.
If we want to, we can click around a little.
This just gives us different use cases and examples.
If we were to open one of this app,
we can work with a search
to find things that match this use case,
like looking for a misconfigured DNS endpoints.
I click down here.
It gives us some sample searches and the types of
things that I might receive if I
had the proper data for this.
True or false?
You should first install an app
in a production environment before testing it.
If you read that sentence carefully,
you should have said false.
Production environment or Splunk is
currently being used for business purposes,
isn't the best place to test out new apps.
Ideally, you'll have a test
environment with the same version
and similar settings to the real one to experiment with.
Our next video, we'll begin our last module.