How does it work?
The data processing engine and query language of Splunk is unique. Getting data into Splunk is easy because of the big library of Splunk apps: choose which apps to use and install them on your Splunk instance. Next you use API’s, install a collector on a host, watch a file or simply import datafiles. Usually it is as easy as following the app manual. For example: monitoring a Windows host can be done by installing an app and a collector on the specific host. Make sure the network allows data to be sent and you’re done. You can use the out of the box visualization or create your own. When data comes into Splunk, it is indexed automatically and the first rudimentary analysis of the data is easily done. More complicated questions are, obviously, more difficult to answer. We do recommend a Splunk training session before experimenting.