Summary

In this chapter, we explored the process of onboarding data and creating configurations that will allow us to search more efficiently. We covered the basic structure of a Splunk add-on and app, including the main folders such as bin, default, local, and lookups. Each of these folders has a specific purpose. We looked at different ways of inputting data that exist in the Splunk Add-on for Microsoft Windows. We learned that the inputs.conf file is the file where we store input configurations. The default inputs.conf file in the Splunk Add-on for Microsoft Windows contains file monitors and scripts that allow us to ingest Microsoft Windows logs. We enabled configurations in the add-on to ingest Microsoft Windows Security, Application, and System logs. We also learned how to use Splunk Web to create new inputs. Next, we went through a series of examples of renaming fields (field aliases), creating calculated fields, and extracting fields using regex. Finally, we reviewed some of...