Skip to content

Commit c08c1e4

Browse files
timhard-splunktimhard-splunk
committed
fixed formatting, added clarification on a few steps
1 parent acde91d commit c08c1e4

File tree

9 files changed

+84
-55
lines changed

9 files changed

+84
-55
lines changed

‎content/en/ninja-workshops/11-ingest_processor_for_observability_cloud/1-getting-started/1-access-cloud-instances.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,12 @@ Login to Splunk Show using your [splunk.com](https://login.splunk.com/) credenti
2222

2323
{{% notice title="Note" style="primary" icon="lightbulb" %}}
2424

25-
Take note of the Participant Number provided in your Splunk Show event details. This number will be included in the `sourcetype` that you will use for searching and filtering the Kubernetes data. Because this is a shared environment only use the participant number provided so that other participants data is not effected.
25+
Take note of the `User Id` provided in your Splunk Show event details. This number will be included in the `sourcetype` that you will use for searching and filtering the Kubernetes data. Because this is a shared environment only use the participant number provided so that other participants data is not effected.
2626

2727
{{% /notice %}}
2828

29+
![Splunk Show Instance Information](../../images/show_instance_information.png)
30+
2931
## 2. Splunk Observability Cloud Instances
3032

3133
You should have also received an email to access the Splunk Observability Cloud workshop organization (You may need to check your spam folder). If you have not received an email, let your workshop instructor know. To access the environment click the **Join Now** button.

‎content/en/ninja-workshops/11-ingest_processor_for_observability_cloud/3-create-an-ingest-pipeline/1-login-to-splunk.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,27 +8,27 @@ In this section you will create an Ingest Pipeline which will convert Kubernetes
88

99
{{% notice title="Pre-requisite: Login to Splunk Enterprise Cloud" style="green" icon="running" %}}
1010

11-
Open the **Ingest Processor Cloud Stack** URL provided in the Splunk Show event details.
11+
**1.** Open the **Ingest Processor Cloud Stack** URL provided in the Splunk Show event details.
1212

1313
![Splunk Cloud Instance Details](../../images/show_instances_sec.png)
1414

15-
In the Connection info click on the **Stack URL** link to open your Splunk Cloud stack.
15+
**2.** In the Connection info click on the **Stack URL** link to open your Splunk Cloud stack.
1616

1717
![Splunk Cloud Connection Details](../../images/sec_connection_details.png)
1818

19-
Use the `admin` username and password to login to Splunk Cloud.
19+
**3.** Use the `admin` username and password to login to Splunk Cloud.
2020

2121
![Splunk Cloud Login](../../images/sec_login.png)
2222

23-
After logging in, if prompted, accept the Terms of Service and click **OK**
23+
**4.** After logging in, if prompted, accept the Terms of Service and click **OK**
2424

2525
![Splunk Cloud Login](../../images/sec_terms.png)
2626

27-
Navigate back to the Splunk Show event details and select the Ingest Processor SCS Tenant
27+
**5.** Navigate back to the Splunk Show event details and select the Ingest Processor SCS Tenant
2828

2929
![Ingest Processor Connection Details](../../images/show_instances_scs.png)
3030

31-
Click on the **Console URL** to access the **Ingest Processor SCS Tenant**
31+
**6.** Click on the **Console URL** to access the **Ingest Processor SCS Tenant**
3232

3333
{{% notice title="Note" style="primary" icon="lightbulb" %}}
3434
**Single Sign-On (SSO)**

‎content/en/ninja-workshops/11-ingest_processor_for_observability_cloud/3-create-an-ingest-pipeline/2-review-k8s-events.md‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,29 @@ In this section you will review the Kubernetes Audit Logs that are being collect
88

99
{{% notice title="Exercise: Create Ingest Pipeline" style="green" icon="running" %}}
1010

11-
1. Open your **Ingest Processor Cloud Stack** instance using the URL provided in the Splunk Show workshop details.
11+
**1.** Open your **Ingest Processor Cloud Stack** instance using the URL provided in the Splunk Show workshop details.
1212

13-
2. Navigate to **Apps** -> **Search and Reporting**
13+
**2.** Navigate to **Apps** -> **Search and Reporting**
1414

1515
![Search and Reporting](../../images/search_and_reporting.png?width=20vw)
1616

17-
3. In the search bar, enter the following SPL search string:
17+
**3.** In the search bar, enter the following SPL search string.
18+
19+
{{% notice title="Note" style="primary" icon="lightbulb" %}}
20+
Make sure to replace `USER_ID` with the User ID provided in your Splunk Show instance information.
21+
{{% /notice %}}
1822

1923
```
20-
```Replace PARTICIPANT_NUMBER with the participant number provided in your Splunk Show event details```
21-
index=main sourcetype="kube:apiserver:audit:PARTICIPANT_NUMBER"
24+
```Replace USER_ID with the User ID provided in your Splunk Show instance information```
25+
index=main sourcetype="kube:apiserver:audit:USER_ID"
2226
```
2327

24-
4. Press **Enter** or click the green magnifying glass to run the search.
28+
**4.** Press **Enter** or click the green magnifying glass to run the search.
2529

2630
![Kubernetes Audit Log](../../images/k8s_audit_log.png)
2731

28-
You should now see the Kubernetes Audit Logs for your environment. Notice that the events are fairly robust. Explore the available fields and start to think about what information would be good candidates for metrics and dimensions. Ask yourself: What fields would I like to chart and how would I like to be able to filter, group, or split those fields?
32+
<center>
33+
<b>You should now see the Kubernetes Audit Logs for your environment. Notice that the events are fairly robust. Explore the available fields and start to think about what information would be good candidates for metrics and dimensions. Ask yourself: What fields would I like to chart and how would I like to be able to filter, group, or split those fields?</b>
34+
</center>
2935

3036
{{%/ notice %}}

‎content/en/ninja-workshops/11-ingest_processor_for_observability_cloud/3-create-an-ingest-pipeline/3-create-ingest-pipeline.md‎

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ In this section you will create an Ingest Pipeline which will convert Kubernetes
88

99
{{% notice title="Exercise: Create Ingest Pipeline" style="green" icon="running" %}}
1010

11-
1. Open the **Ingest Processor SCS Tenant** using the connection details provided in the Splunk Show event.
11+
**1.** Open the **Ingest Processor SCS Tenant** using the connection details provided in the Splunk Show event.
1212

1313
![Launch Splunk Cloud Platform](../../images/data_management_home.png?width=40vw)
1414

@@ -20,40 +20,40 @@ When you open the **Ingest Processor SCS Tenant**, if you are taken to a welcom
2020

2121
{{% /notice %}}
2222

23-
2. From the Splunk Data Management console select **Pipelines** -> **New pipeline** -> **Ingest Processor pipeline**.
23+
**2.** From the Splunk Data Management console select **Pipelines** -> **New pipeline** -> **Ingest Processor pipeline**.
2424

2525
![New Ingest Processor Pipeline](../../images/new_pipeline.png?width=40vw)
2626

27-
3. In the **Get started** step of the Ingest Processor configuration page select **Blank Pipeline** and click **Next**.
27+
**3.** In the **Get started** step of the Ingest Processor configuration page select **Blank Pipeline** and click **Next**.
2828

2929
![Blank Ingest Processor Pipeline](../../images/blank_pipeline.png?width=40vw)
3030

31-
4. In the **Define your pipeline’s partition** step of the Ingest Processor configuration page select **Partition by sourcetype**. Select the **= equals** Operator and enter `kube:apiserver:audit:PARTICIPANT_NUMBER` (Be sure to replace PARTICIPANT_NUMBER with the participant number you were assigned) for the value. Click **Apply**.
31+
**4.** In the **Define your pipeline’s partition** step of the Ingest Processor configuration page select **Partition by sourcetype**. Select the **= equals** Operator and enter `kube:apiserver:audit:USER_ID` (Be sure to replace USER_ID with the User ID you were assigned) for the value. Click **Apply**.
3232

3333
![Add Partition](../../images/add_partition.png?width=40vw)
3434

35-
5. Click **Next**
35+
**5.** Click **Next**
3636

37-
6. In the **Add sample data** step of the Ingest Processor configuration page select **Capture new snapshot**. Enter `k8s_audit` for the name and click **Capture**.
37+
**6.** In the **Add sample data** step of the Ingest Processor configuration page select **Capture new snapshot**. Enter `k8s_audit_USER_ID` (Be sure to replace USER_ID with the User ID you were assigned) for the Snapshot name and click **Capture**.
3838

3939
![Capture Snapshot](../../images/capture_snapshot.png?width=40vw)
4040

41-
7. Make sure your newly created snapshot (`k8s_audit`) is selected and then click **Next**.
41+
**7.** Make sure your newly created snapshot (`k8s_audit_USER_ID`) is selected and then click **Next**.
4242

4343
![Configure Snapshot Sourcetype](../../images/capture_snapshot_sourcetype.png?width=20vw)
4444

45-
8. In the **Select a metrics destination** step of the Ingest Processor configuration page select **show_o11y_org**. Click **Next**.
45+
**8.** In the **Select a metrics destination** step of the Ingest Processor configuration page select **show_o11y_org**. Click **Next**.
4646

4747
![Metrics Destination](../../images/metrics_destination.png?width=20vw)
4848

49-
9. In the **Select a data destination** step of the Ingest Processor configuration page select **splunk_indexer**. Under **Specify how you want your events to be routed to an index** select **Default**. Click **Done**.
49+
**9.** In the **Select a data destination** step of the Ingest Processor configuration page select **splunk_indexer**. Under **Specify how you want your events to be routed to an index** select **Default**. Click **Done**.
5050

5151
![Event Routing](../../images/event_routing.png?width=20vw)
5252

53-
10. In the **Pipeline search field** replace the default search with the following.
53+
**10.** In the **Pipeline search field** replace the default search with the following.
5454

5555
{{% notice title="Note" style="primary" icon="lightbulb" %}}
56-
**Replace `UNIQUE_FIELD` in the metric name with a unique value which will be used to identify your metric in Observability Cloud.**
56+
**Replace `UNIQUE_FIELD` in the metric name with a unique value (such as your initials) which will be used to identify your metric in Observability Cloud.**
5757
{{% /notice %}}
5858

5959
```
@@ -63,12 +63,14 @@ import logs_to_metrics from /splunk/ingest/commands
6363
$pipeline =
6464
| from $source
6565
| thru [
66-
//define the metric name, type, and value for the Kubernetes Events
67-
| logs_to_metrics name="k8s_audit_UNIQUE_FIELD" metrictype="counter" value=1 time=_time
68-
| into $metrics_destination
69-
]
66+
//define the metric name, type, and value for the Kubernetes Events
67+
//
68+
// REPLACE UNIQUE_FIELD WITH YOUR INITIALS
69+
//
70+
| logs_to_metrics name="k8s_audit_UNIQUE_FIELD" metrictype="counter" value=1 time=_time
71+
| into $metrics_destination
72+
]
7073
| eval index = "kube_logs"
71-
//Send unfiltered logs to S3
7274
| into $destination;
7375
```
7476
{{% notice title="New to SPL2?" style="info" icon="lightbulb" %}}
@@ -83,15 +85,15 @@ Here is a breakdown of what the SPL2 query is doing:
8385

8486
{{% /notice %}}
8587

86-
11. In the upper-right corner click the **Preview** button ![Preview Button](../../images/preview.png?height=20px&classes=inline) or press CTRL+Enter (CMD+Enter on Mac). From the **Previewing $pipeline** dropdown select **$metrics_destination**. Confirm you are seeing a preview of the metrics that will be sent to Splunk Observability Cloud.
88+
**11.** In the upper-right corner click the **Preview** button ![Preview Button](../../images/preview.png?height=20px&classes=inline) or press CTRL+Enter (CMD+Enter on Mac). From the **Previewing $pipeline** dropdown select **$metrics_destination**. Confirm you are seeing a preview of the metrics that will be sent to Splunk Observability Cloud.
8789

8890
![Preview Pipeline](../../images/preview_pipeline.png?width=40vw)
8991

90-
12. In the upper-right corner click the **Save pipeline** button ![Save Pipeline Button](../../images/save_pipeline_btn.png?height=20px&classes=inline). Enter a name for your pipeline and click **Save**.
92+
**12.** In the upper-right corner click the **Save pipeline** button ![Save Pipeline Button](../../images/save_pipeline_btn.png?height=20px&classes=inline). Enter `Kubernetes Audit Logs2Metrics USER_ID` for your pipeline name and click **Save**.
9193

9294
![Save Pipeline Dialog](../../images/save_pipeline_dialog.png?width=40vw)
9395

94-
13. After clicking save you will be asked if you would like to apply the newly created pipeline. Click **Yes, apply**.
96+
**13.** After clicking save you will be asked if you would like to apply the newly created pipeline. Click **Yes, apply**.
9597

9698
![Apply Pipeline Dialog](../../images/apply_pipeline_dialog.png?width=40vw)
9799

‎content/en/ninja-workshops/11-ingest_processor_for_observability_cloud/3-create-an-ingest-pipeline/4-confirm-metrics.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@ Now that an Ingest Pipeline has been configured to convert Kubernetes Audit Logs
88

99
{{% notice title="Exercise: Confirm Metrics in Splunk Observability Cloud" style="green" icon="running" %}}
1010

11-
1. Login to the **Splunk Observability Cloud** organization you were invited for the workshop. In the upper-right corner, click the **+** Icon -> **Chart** to create a new chart.
11+
**1.** Login to the **Splunk Observability Cloud** organization you were invited for the workshop. In the upper-right corner, click the **+** Icon -> **Chart** to create a new chart.
1212

1313
![Create New Chart](../../images/create_new_chart.png?width=40vw)
1414

15-
2. In the **Plot Editor** of the newly created chart enter the metric name you used while configuring the **Ingest Pipeline**.
15+
**2.** In the **Plot Editor** of the newly created chart enter the metric name you used while configuring the **Ingest Pipeline**.
1616

1717
![Review Metric](../../images/review_metric.png?width=40vw)
1818

‎content/en/ninja-workshops/11-ingest_processor_for_observability_cloud/4-update-pipeline-and-visualize/1-update-ingest-pipeline.md‎

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,18 @@ weight: 2
66

77
{{% notice title="Exercise: Update Ingest Pipeline " style="green" icon="running" %}}
88

9-
1. Navigate back to the configuration page for the Ingest Pipeline you created in the previous step.
9+
**1.** Navigate back to the configuration page for the Ingest Pipeline you created in the previous step.
1010

1111
![Ingest Pipeline](../../images/ingest_pipeline.png?width=40vw)
1212

13-
2. To add dimensions to the metric from the raw Kubernetes audit logs update the SPL2 query you created for the pipeline by replacing the `logs_to_metrics` portion of the query with the following.
13+
**2.** To add dimensions to the metric from the raw Kubernetes audit logs update the SPL2 query you created for the pipeline by replacing the `logs_to_metrics` portion of the query with the following:
1414

1515
{{% notice title="Note" style="primary" icon="lightbulb" %}}
16-
**Be sure to update the metric name field (`name="k8s_audit"`) to the name you provided in the original pipeline**
16+
**Be sure to update the metric name field (`name="k8s_audit_UNIQUE_FIELD"`) to the name you provided in the original pipeline**
1717
{{% /notice %}}
1818

1919
```
20-
| logs_to_metrics name="k8s_audit" metrictype="counter" value=1 time=_time dimensions={"level": _raw.level, "response_status": _raw.responseStatus.code, "namespace": _raw.objectRef.namespace, "resource": _raw.objectRef.resource, "user": _raw.user.username, "action": _raw.verb}
20+
| logs_to_metrics name="k8s_audit_UNIQUE_FIELD" metrictype="counter" value=1 time=_time dimensions={"level": _raw.level, "response_status": _raw.responseStatus.code, "namespace": _raw.objectRef.namespace, "resource": _raw.objectRef.resource, "user": _raw.user.username, "action": _raw.verb}
2121
```
2222

2323
{{% notice title="Note" style="info" icon="info" %}}
@@ -26,20 +26,40 @@ Using the `dimensions` field in the SPL2 query you can add dimensions from the r
2626
You should consider adding any common tags across your services so that you can take advantage of context propagation and related content in Splunk Observability Cloud.
2727
{{% /notice %}}
2828

29-
3. In the upper-right corner click the **Preview** button ![Preview Button](../../images/preview.png?height=20px&classes=inline) or press CTRL+Enter (CMD+Enter on Mac). From the **Previewing $pipeline** dropdown select **$metrics_destination**. Confirm you are seeing a preview of the metrics that will be sent to Splunk Observability Cloud.
29+
The updated pipeline should now be the following:
30+
31+
```
32+
/*A valid SPL2 statement for a pipeline must start with "$pipeline", and include "from $source" and "into $destination".*/
33+
/* Import logs_to_metrics */
34+
import logs_to_metrics from /splunk/ingest/commands
35+
$pipeline =
36+
| from $source
37+
| thru [
38+
//define the metric name, type, and value for the Kubernetes Events
39+
//
40+
// REPLACE UNIQUE_FIELD WITH YOUR INITIALS
41+
//
42+
| logs_to_metrics name="k8s_audit_UNIQUE_FIELD" metrictype="counter" value=1 time=_time dimensions={"level": _raw.level, "response_status": _raw.responseStatus.code, "namespace": _raw.objectRef.namespace, "resource": _raw.objectRef.resource, "user": _raw.user.username, "action": _raw.verb}
43+
| into $metrics_destination
44+
]
45+
| eval index = "kube_logs"
46+
| into $destination;
47+
```
48+
49+
**3.** In the upper-right corner click the **Preview** button ![Preview Button](../../images/preview.png?height=20px&classes=inline) or press CTRL+Enter (CMD+Enter on Mac). From the **Previewing $pipeline** dropdown select **$metrics_destination**. Confirm you are seeing a preview of the metrics that will be sent to Splunk Observability Cloud.
3050

3151
![Ingest Pipeline Dimensions](../../images/ingest_pipeline_dimensions.png?width=40vw)
3252

33-
4. Confirm you are seeing the dimensions in the dimensions column of the preview table. You can view the entire dimensions object by clicking into the table.
53+
**4.** Confirm you are seeing the dimensions in the dimensions column of the preview table. You can view the entire dimensions object by clicking into the table.
3454

3555
![Ingest Pipeline Dimensions Review](../../images/ingest_pipeline_dimensions_field.png?width=40vw)
3656

37-
5. In the upper-right corner click the **Save pipeline** button ![Save Pipeline Button](../../images/save_pipeline_btn.png?height=20px&classes=inline). On the “You are editing an active pipeline modal” click **Save**.
57+
**5.** In the upper-right corner click the **Save pipeline** button ![Save Pipeline Button](../../images/save_pipeline_btn.png?height=20px&classes=inline). On the “You are editing an active pipeline modal” click **Save**.
3858

3959
![Save Updated Pipeline](../../images/save_updated_pipeline.png?width=30vw)
4060

4161
<center>
42-
<b>Because this pipeline is already active, the changes we’ve made will take effect immediately. Your metric should now be split into multiple metric timeseries using the dimensions you added.</b>
62+
<b>Because this pipeline is already active, the changes you made will take effect immediately. Your metric should now be split into multiple metric timeseries using the dimensions you added.</b>
4363

4464
In the next step you will create a visualization using different dimensions from the kubernetes audit events.
4565
</center>

0 commit comments

Comments
 (0)