Clara-Fication Workshop: Understanding the Expensive Bits in Your Splunk Environment
- Bring your own Splunk environment
- Having access to internal indexes (
_internal,_introspection,_audit) will provide the most insight from this session - Create dashboards manually by copypasta the XML into a Splunk Classic dashboard or install the app from https://splunkbase.splunk.com/app/7386
- Environment Investigations
- This dashboard will show information related to the entire deployment
- Dashboard Investigations
- This dashboard will show information specific to dashboards and potential improvements
- Search Investigations
- This dashboard has information related to ad-hoc and scheduled searches and potential improvements
- Datamodel Investigations
- This dashboard will have helpful information around datamodel inefficiencies