56
Copyright © 2013 Splunk Inc. Splunk-Live Korea Hands-On Session Splunk Korea

Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

  • Upload
    others

  • View
    0

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

Copyright*©*2013*Splunk*Inc.*

Splunk-Live,Korea,Hands-On,Session,

Splunk,Korea,

�� � ����

Page 2: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

Copyright*©*2013*Splunk*Inc.*

오후,2시»Ħ�

ÎĶ�ğ�ßĎuÛå�ļi�

스플렁크를,직접,체험Ļ�Í�ús�

Hands-On,세션õ�

ċÀ��Û�úÏuv�

K��><9=7�+>>=�K�

Page 3: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

사전,준비,사항,

 ÓÏç�pī¼�

•  î}è�ÀÎġ�õÂ��s�(+/��%9=CF�

•  �Îğ�aS� �!��õÂ�

•  QÂņ�ÐÎĨ��Èģ��

� öĦo�á]�

•  łÁÿ�åõįõ�

•  ĪÒÁ�åõįõ�ħz����

� Xö�¦÷�_ą��Èģ��

� ğ��įõÛıÎ��Èģ��

��

1.,세션,소개,및,준비,

Page 4: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

장경운,부장,+?;C=:�"=3�+5=9>@�+1;5A��>=AC;B1=B��

한상욱,부장,+?;C=:�"=3�+5=9>@�+1;5A��>=AC;B1=B�

1.,세션,소개,및,준비,

강사,소개,

Page 5: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

아젠다,

��

순서, 내용, 시간,

� ËX�¯�ċÀ� �����J��� �� �½�

�� ÎĶ�ğ�ÉĜĸh� �� ��J������ ��½�

�� ÎĶ�ğ�ì�Áçĸh� �����J������ ��½�

ŋÑ����½��

�� {õĦ�ŀ��� �����J������ ��½�

�� āÿ�[Ä�¯�{й�� �����J��� �� ��½�

�� ^`�ÅÊĸh� �� ��J������ ��½�

đ¬�¯�x·�

Page 6: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

2.,스플렁크,설치하기,

��

ÎĶ�ğ�vé���

ÉĜ�]b�Ňö�

ÎĶ�ğ�ÉĜ�

Page 7: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

2.,스플렁크,설치하기,

다운로드,

•  www.splunk.com,•  ʼnëQù�Ŋ�vé���

��ÎĶ�ğ�ėhņ¨��� ��ÎĶ�ğ�ʼnëQù�ņ¨���

�gö�ʼnëQù�

v��

Page 8: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

2.,스플렁크,설치하기,

다운로드,

��Ķ�ij¸�ÎĶ�ğ�ÉĜ�į÷�vé����� ��ÉĜ�į÷�vé�����

î}èç��ÉĜį÷�vé���

Page 9: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

2.,스플렁크,설치하기,

스플렁크,설치,

•  ‘관리자’,모드로,설치,c�û�eĺð��Ħ®m�Ół�

O3<4Pù�Ŋ���B@;�+896B��=B5@�

Page 10: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

2.,스플렁크,설치하기,

스플렁크,설치,

Page 11: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

2.,스플렁크,설치하기,

스플렁크,설치,

Page 12: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

2.,스플렁크,설치하기,

설치,결과,확인,

��+?;C=:�ÉĜ�IJz��� ��+?;C=:�Xö¸�Éą�ą¹��

Page 13: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

2.,스플렁크,설치하기,

설치,결과,확인,

��.9=���*��A5@D935A<A3�Ół��� ���B@;���+896B����A3�ÆÀÎ�Ół�ÂĢ��

Page 14: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

3.,스플렁크,웹,사용하기,

��

ÆÀÎ�Ðü� [ÄÚ�ÉĜ�ì�ĄÌ�¯�dÊ�æË�

[Ä� �g�ÅÊ�

Page 15: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

3.,스플렁크,웹,사용하기,

스플렁크,시작,

Ðü�ĵ�g���������A?;C=:�5=12;5�2>>BAB1@B�

Page 16: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

3.,스플렁크,웹,사용하기,

스플렁크,접속,

•  http://localhost:8000,

• Áçûõ����14<9=�• ØŅ���381=75<5�

Page 17: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

3.,스플렁크,웹,사용하기,

스플렁크,초기,화면,•  6.0에서,새로워진,기능들,�•  8BB?���EEEA?;C=:3><�D95E�E81BA=5E�+)���� ���

�•  O.81BNA�=5E�9=�+?;C=:��P��[Ä��

Page 18: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

3.,스플렁크,웹,사용하기,

스플렁크,초기,화면,

[ÄĔ�

{õĦ�ù��Éą�

ÚĴÐĔ�}ê£�

Page 19: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

��

3.,스플렁크,웹,사용하기,

스플렁크,검색,앱,

Page 20: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

첫,검색,

•  "=45F�09=B5@=1;�

Page 21: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

� �

3.,스플렁크,웹,사용하기,

첫,검색,

þ�¦r�

Ú�¦r�

õ¶ī�«��

Áçû�ą¹�¦r�

¦ÐĎ�×��¦r�

Éą�¦r�

ÞĮÀĮ�¦r�

}ê£�¦r�[Ä�¦r�

[Ä�Ĕ�

[�]b�

[Ä�Đł�°�

[Ä�]b�ĥ�

ġø�ö�

ķ��Èģ�Ĕ�

[Ä�ª��

Page 22: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

잡,메뉴,

•  *��ô�);19=�,12;5b�ïÁĸ\�+?;C=:ô�+)%ò�½ÇĻ�Í�úÏuv�

•  Mþ�¦rNÝÆ�M"=A?53B�#>2N�Èģ�

Page 23: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

잡,메뉴,

��Πī�ª��L� ��ė��� ��`Ì�ª����ė��

Page 24: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

잡,메뉴,

•  ŃĀ�Ółčö�[Äò�-*%��ġöb�aïĻ�Í�úÏuv�

•  aï�³ĭ�Ġ��

Page 25: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

필드,목록,창,

Page 26: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

언어,변경,

:>0$*�

5=0-+�

•  ĴÐ�ÜÛs�¿�èāô�ÜÛÉąò���Q§�VĆ��°j�Í�úÏuv�

Page 27: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

앱,설치하기,스플렁크는,앱을,통해,기능을,확장합니다.,

8BB?���1??AA?;C=:3><�

Page 28: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

앱,설치하기,

• 설치할,앱,(App),•  !5>�%>31B9>=�%>>:C?�+3@9?B��69;5���&�/&"'�B1@7H��

• 앱,설치,방법,•  ²µ ���vé���ĺ�Ú�į÷ò�ÎĶ�ğÝÆ�¾�å�ÉĜ�

•  ²µ����ÎĶ�ğÝÆ�ďĄ�Ú�ÉĜ�

Page 29: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

앱,설치하기,

Page 30: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

로그,생성하기,

•  http://www.splunkuser.com,

•  “log,generator”,폴더에서,파일,다운로드,

•  LogGenerator.py,•  %>7!5=0CA5@943AD�•  %>7!5=0A5@D935943AD�

Page 31: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

� �

3.,스플렁크,웹,사용하기,

로그,생성하기,

#,./LogGenerator.py,¨r,¨feventa.log�#,./LogGenerator.py,¨r,¨i800,¨feventb.log,

1385825568.961,10872193,SERVICE_B,155.100.13.15241385825568.967,10039822,SERVICE_C,46.90.207.8741385825568.977,10827472,SERVICE_B,224.163.49.15641385825568.979,10335827,SERVICE_E,58.189.159.12741385825568.987,10432654,SERVICE_C,154.204.200.22141385825568.988,10991255,SERVICE_B,25.228.6.10241385825568.990,10432654,SERVICE_E,226.218.223.1841385825568.992,10672291,SERVICE_D,185.4.149.25441385825568.994,10674888,SERVICE_A,81.48.64.6641385825568.996,13857173,SERVICE_A,111.73.238.12441385825568.998,10335827,SERVICE_C,146.100.121.21741385825568.999,13982752,SERVICE_B,69.172.194.5541385825569.001,10798213,SERVICE_D,135.152.71.15141385825569.001,10119872,SERVICE_D,33.168.215.21241385825569.003,10432654,SERVICE_E,242.119.26.23941385825569.004,10432654,SERVICE_C,18.174.146.24

ġøÎĤĵ� Áçû"�� ÆÀÎ"�� ĄÌ")�

Page 32: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

���

3.,스플렁크,웹,사용하기,

로그,생성하기,

Page 33: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

휴식,

čS�ŋÑ�ÐS�

오후,3:00,~,3:30,

���

Page 34: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

4.,데이터,핸들링,

���

ö|Î�ÅÊ��<G9=45F��

{õĦ�ÍĒ��Ňö�

{õĦ�ù���5D5=B1;>7��5D5=B2;>7��

ËÎ�ġù�ÅÊ��<G5D5=B��

�g�ÅÊ��%>7!5=5@1B>@?G��

Page 35: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

인덱스,생성,

���

4.,데이터,핸들링,

•  Éą���ö|Î� •  Ã�é�ö|Î�õ�ò�Ďąĸ`�k¥Ď�Uñ�hºUð��Áç�

Page 36: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

인덱스,생성,

���

4.,데이터,핸들링,

•  “myindex”,는,현재º,•  Ęy����!���āÿĻ�Í�ú`�

•  ŃĀs� &���Áç�čõ§�

•  �gQ��Z�āÿ�Û�úó�

Page 37: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

입력,설정,

���

4.,데이터,핸들링,

•  Éą���{õĦù�� •  ù��ïńñ�ë��į÷�¯���ĩ���,�)��-�)��Îğ�ī��QĎõk�î}è��ïńõ�z�¢Ïuv�

Page 38: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

입력,설정,

���

4.,데이터,핸들링,

•  Ã�é��g��ÍĒĸh�íĿ�MÃ�¡�hN�Èģ� •  ďĄ��g�į÷ò�ÈģĿÆ�ÍĒ�

Page 39: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

입력,설정,

���

4.,데이터,핸들링,

•  �g�±Åh��ÅÊĺ�į÷�č�ĺX��Èģ�•  �5D5=B1;>7��

•  Ã�é�ËÎÝ�Ã�é�A>C@35�BG?5�Ďą�

Page 40: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

입력,설정,

���

4.,데이터,핸들링,

•  두,가지만,확인!, ��g�ÐS�ą¹�öÑ�ä°�Ď���%9=5��@51:�ä°�Ď�

•  Ã�é�+>C@35�,G?5�õ��Ďą�•  O<G5D5=BP�`�ù��

Page 41: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

입력,설정,

� �

4.,데이터,핸들링,

•  Ĭą��g�į÷�ËÎ�ò�ĎÌĂð��ªuĦ��Ļ�ãąõ­��+>C@35�¦rô�ĕ´ē�ľ«�Èģ�

•  ÙÆ�ÅÊĺ�O<G9=45FP�Èģ�•  į÷ô�·^½¡�ÍĒĸh�íĿ�M,19;���hN�Ėğ�

Page 42: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

입력,설정,

���

4.,데이터,핸들링,

•  “eventb.log,도,등록!,•  w��5D5=B1;>7���Ð�ËÎġùò�ÅÊŁð­��MhĈ�

+>C@35�BG?5�ĂçN�ÈģŊ�M<G5D5=BN�Èģ�

•  Ã����ĺ�{õĦ�ËÎ�Ňö�•  5D5=B1;>7��5D5=B2;>7�

Page 43: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

데이터,수집,확인,

���

4.,데이터,핸들링,

•  ý�ÍĒ�`�úsĎ�[Ä��9=45F�<G9=45F��•  ÙÆ���ĺ�ËÎ��X}�Ňö�

•  Ã����ĺ�{õĦ�ËÎ�Ňö�•  ÍĒ��g�Í��Ð_â��ćʼn�•  �9=45F�<G9=45F�I�B9<5381@B�3>C=B�2G�A>C@35��

Page 44: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

5.,저장,검색,및,데시보드,

���

ķ��ęĚ� {й��āÿ�[Ä�

Page 45: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

필드,추출,

���

5.,저장,검색,및,데시보드,

•  �g�čÝ�ô®ús�{õĦs�ķ���ęĚĸà�ňçĻ�Í�úÏuv�

•  û��ĹÏ�htò�íĿ�{õĦ�©�X�ù��Ŋ�•  ÅÊ�³ĭ�q�¨�ąfĴŃÑõ�û��ÅÊ��

Page 46: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

필드,추출,

���

•  ÅÊ��ąfĴŃÑb�•  fĝÝ�¤s�{õĦ�ĸõ�õī�

•  ķ�Ý�Ăăĺ�õ�ò�»àĸ`�āÿ�

5.,저장,검색,및,데시보드,

Page 47: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

필드,추출,

���

•  ęĚĺ�ķ�Q�ĉě�ķ��«�Ý�ĴÐ��

5.,저장,검색,및,데시보드,

Page 48: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

저장,검색,

���

•  [Äò�ĸ`�õ��āÿĻ�Í�úó�

•  M*5?>@BNQ�āÿ�[Ä�+1D54�+51@38�ø�

5.,저장,검색,및,데시보드,

Page 49: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

저장,검색,

���

•  9=45F�<G9=45F�A>C@35BG?5�<G5D5=B�I�B>?�CA5@94�;9<9B� ��

•  9=45F�<G9=45F�A>C@35BG?5�<G5D5=B�I�B>?�A5@D935�;9<9B���

•  9=45F�<G9=45F�A>C@35BG?5�<G5D5=B�I�AB1BA�43�CA5@94��

5.,저장,검색,및,데시보드,

Page 50: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

저장,검색,

���

•  ÙÝÆ�āÿĺ�ª��āÿ[Ä�«��

5.,저장,검색,및,데시보드,

Page 51: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

6.,경고,생성하기,

� �

^`�ÐÎĨ�Éą� ^`�Ňö�^`�ÅÊ�

Page 52: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

경보,발송을,위한,시스템,설정,

���

6.,경고,생성하기,

•  O�Éą�ÐÎĨÉą�õ¦÷�^`�ÉąP�¦rÝÆ�A<B?�Ƴ�Éą�•  7<19;ò�õçĻ�^è��

•  ¦÷�ŅÎī���A<B?7<19;3><�����•  õ¦÷�¹Ö���++%�•  Áçûõ����¦÷ĊË�•  ØŅ���õ¦÷�ØŅ�

Page 53: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

주요,메일,서비스,SMTP,주소,

���

메일서비스, 보내는,메일,서버,주소,

Ϧ÷� smtp.gmail.com, ,%+�++%� ����

nõ³¦÷� smtp.naver.com, ,%+�++%� ����

vó¦÷� smtp.daum.com, ,%+�++%� ����

nõī¦÷� smtp.mail.nate.com, ,%+�++%� ����

6.,경고,생성하기,

Page 54: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

경보를,위한,검색,작성,및,저장,

���

•  A51@38�1??ð��~ÕQÆ�vó�[Äò�Ół�•  A>C@35BG?5�<G5D5=B�51@;95AB��<�<�;1B5AB��<�I�AB1BA�3>C=B�

•  Ov��õ�ð��āÿ���^`P�¦r��Èģ�Ŋ��vób�Wõ�Éą�•  Oğ��ÎĞČ��ÓłP�Èģ�•  ğ��ĴŃÑð��O��� ��������P�

•  Áçû�Ďą�ćZ��Ý�OE85@5�3>C=B��� �P�ù��Ŋ�OvóP�

6.,경고,생성하기,

Page 55: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

경보를,위한,검색,작성,및,저장,

���

•  Oī�Y��^`ô��ÎīP���Èģĸ`�Ăăĺ�ÔR}��Éą�•  Oõ¦÷�¹lhP��Èģ�Ŋ�ÍÒĻ�õ¦÷�ĊË��ù��•  O]b�İļP�à»��Oö�öPð��Èģ�

6.,경고,생성하기,

Page 56: Splunk-Live,Korea, - Bluewins.combluewins.com/.../2014/11/SplunkLiveKorea-Splunk-Hands-On-v1.0.0.pdf · 2.,스플렁크,설치하기, 다운로드, • , • IëQù J vé Î 6 h F¨

TÁĽuv��