Welcome to Splunk

0:00You asked and it's finally here. Here at CPT Nuggets, we're actually doing a course over Splunk.

0:06And I know we've touched on it in the past. In fact, I'll have a link below in another course

0:12where we get into Splunk from a cloud at enterprise level. But I just want you to know that we're

0:18finally doing it and we're going to be going through with the basics of Splunk and what it is.

0:25Now, this means that we're going to be focusing on Splunk at more of a centralized level on a

0:31physical physical system because we do have a lab environment for you going throughout the

0:36rest of the skill. And we will be introducing that lab here momentarily. But for those that

0:42aren't really familiar with Splunk, let's do a quick review. First, where's my little side screen

0:49here where I can put notes up and everything? There we go. We're talking about the differences

0:54between IDS and IPS. Now, I know we're getting into a little bit before in history type thing,

1:01but there's a reason I'm getting here is because we need to understand what it is that Splunk is

1:06actually going to be doing for us and why Splunk is what it is that we need. I know I repeated

1:13there. It's okay. So an IDS is an intrusion detection system. These devices can be put on

1:20host or network. You can have basically an IDS on a host system that alerts you to whenever

1:28something happens based on a rule set. Now, these rules come in two different flavors. And if you

1:34notice in my notes, I'm putting this up for both because they apply to both. First, we have

1:40definitions. These are rules that are already defined based on like dictionary definitions

1:48or predefined rules that have already been created for us by other different systems that are

1:53applying to our IDS or IPS. Basically, when something is found that matches this criteria,

2:00this action is going to be taken. Now, the difference between IDS and IPS, which IPS is

2:06intrusion prevention system, is that the IDS is going to alert and the IPS is going to take an

2:14action against. So our rules that we have, I've only given you one type so far, so bear with me,

2:21is that if X happens, then Y. Well, for IDS, it will be alert. And then in IPS, it will be action.

2:31Action could be blocked traffic or even include alert. But just know that you can go beyond

2:36alerting and actually do a block, a reroute of traffic, take something offline or send traffic,

2:47whatever the case may be that you decide. And it also works based on a second set of rules

2:54that we have called anomaly-based detection, because this is one of the words that I'm

2:59really bad at pronouncing. It's called heuristic. And I'm going to try to avoid using that word

3:05throughout the rest of this course because it's really a tongue twister for me. Now, anomaly-based

3:10detection is that, similar to our defined rules, we have if X happens, then do Y. Well, X could be

3:19if it looks like X, smells like X, walks like X, could be a duck, right? Well, if it even

3:28remotely falls into that category, then we will take action. Now, IDS and IPS systems, whether

3:35they are host or network based, don't just run with hands off and we just never come back to

3:43them. We do have to check up because we have the risk of running false positives, meaning that,

3:49especially in the anomaly-based detection, could be that a packet was traversing the network

3:55or a file, whatever the case may be. And then that anomaly-based rule found it and said,

4:03it looks like a duck. And then we want to take the action of, it is a duck, but it in fact was a goat.

4:11So, what do we do? Well, we can undo that action and rewrite the rule more specifically and make

4:16it a defined rule. Now, the reason I'm getting into IDS and IPS is because it leads us into

4:24SIEM and SOAR. Now, a SIEM is a security information and event management system,

4:31where we focus on the actual log collection, aggregation, and analysis. Now, if you noticed,

4:38I did not mention any kind of action being taken place. So, we are taking the traffic and reports

4:44that we are receiving from all the devices within our organization, whether they be network or host

4:51or BYOD devices, anything that's configured to send to that SIEM. And we're getting all that

4:58traffic and just taking a look at it and saying, how does everything look? So, this is more akin to

5:05an IDS, the actual detection part, because a SIEM is not going to take an action against,

5:12it's going to alert and notify that something is going on. We've seen in past courses and skills

5:18together, because I enjoy being with you and you enjoy being here, that there are IDS and

5:25SIEM systems out there that will basically report and give you a dashboard of whatever it is that

5:32you're tracking. It could be failed logon attempts, could be unknown IPs entering the system, could be

5:40improper port usage. That's more on the anomaly-based side of detection, but it's going to

5:46just let us know. Now, the actual action behind all this in terms of our security systems is going

5:53to be the SOAR. And this is the Security Orchestration Automation and Response.

6:00Sam did that from memory and totally didn't have to glance at the acronym being spelled out.

6:06But we are focusing on the actual action and remediation, meaning that we are now more into

6:12the IPS territory of security systems. We're doing the exact same thing that a SIEM is doing

6:18for alerts and notifications, but now we're taking it one step further by also making an action

6:24happen. So, if we see traffic come in to a certain point and it doesn't or it matches

6:31an either defined rule or an anomaly-based rule, we can further take an action along with

6:37notification if we want to. Now, I'm going to go more in depth with this and describing the

6:41differences between a SIEM and a SOAR, because once we bring all this together, it'll give you a

6:47firm understanding of why it is that we're actually going into Splunk as a course by itself

6:53and using the best of both worlds. Because, spoiler alert, Splunk kind of falls in between all this

6:59and can do one or the other, if not both, depending on how you want to use it. So, sit tight. We'll be

7:05right back.

0:01Now I know that we covered the basics of what Splunk is and also at the same time covering the differences between a SIEM, a SOAR, IDS, and IPS.

0:10But I want to make sure that we have all the understanding and cover the last few points of what Splunk can do for us and how it's categorized as a SIEM or SOAR.

0:20Because again, spoiler alert, Splunk can be utilized as either one or both at the same time.

0:27It just depends on the implementation that we decide to use it in.

0:31Now more times than not, it's going to be used as a SIEM because it's not really taken in action and there are other things out there.

0:40And I'll give you examples here in a little bit of dedicated SIEMs, dedicated SOARs, etc.

0:46But get this, Splunk has this ability to utilize add-ons.

0:51And I'm going to be showing you in the next portion of this skill when we go over the introduction of our lab environment,

0:57how that can actually be utilized and get you at least understanding that it can happen before we actually start teaching and learning together on the utilization.

1:07So the more that you add to Splunk, the more that you can cross the lines and blur the imaging between SIEM and SOAR.

1:16But it's really important to note the differences between the two and how it's being implemented in your organization.

1:22Just as a side here real quick.

1:24If you already have a SIEM for your organization and you want to install something else like Splunk,

1:30just keep in mind that it comes down to a personnel issue and also ease of use.

1:37Do you have 10 different things watching one particular item?

1:42Is that the proper usage within your organization?

1:45It is a different size for different folks out there.

1:49So what you may decide to use for your organization could be completely different than what somebody else decides.

1:54And that's okay.

1:56I'm just going to make sure that we understand that Splunk is and can be utilized for just about anything you want to do at a very easy of use level.

2:08Because between Bob and I, we're going to show you in this course really how far you can take Splunk.

2:14And as the link above in the previous section shows, it can go even further into an enterprise or cloud infrastructure should you desire to go that route.

2:23And remember, I just want to point this out there as a side note real quick.

2:27While I am usually cybersecurity and digital forensics here for our courses at CBT Nuggets,

2:32due to the acquisition of Cisco by acquiring Splunk, I am now a Cisco dude.

2:39That's right. I get to wear the top hat.

2:42Jokes aside, not really a joke, but moving on.

2:46When we talk about data handling, how does a SIEM versus a SOAR actually deal with this?

2:52And this is really critical for us dealing with Splunk altogether because Splunk deals with a lot of data.

2:59In our lab environment, we already have an index built out so that way you can work with actual data that's been created in a lab environment.

3:10So that way you're not just dealing with like one or two different events.

3:14You actually get to deal with a whole bunch of stuff.

3:16And that whole bunch of stuff is straight up data.

3:20Now a SIEM, which is more of our IDS-ish way of thinking of Splunk in this particular manner,

3:27because we're talking about the analysis and not the action, basically ingests large amounts of volume.

3:34And you're going to see that in our data set in the lab.

3:37And it's in raw form. It's not formulating it to a very specific standard.

3:44So whether we get something from a Cisco networking device or let's say a Microsoft Windows workstation,

3:50this data is just being sent at the one and zero form to the actual ingest point.

3:56And that particular ingest point is Splunk.

3:59Now how do we get all this information?

4:02Just another quick aside real quick.

4:04This depends on where you put Splunk on the actual network.

4:07Now if you have in your Windows configurations,

4:10and we covered this in different skills and courses here across CBT Nuggets,

4:14you can point your workstations, your network devices, anything on your organization's network,

4:20to be able to point to an aggregator.

4:23That aggregator that we're discussing here is Splunk.

4:26So when you look at the actual database and index that we have within our lab environment,

4:31I want you to pretend for a moment that you're in an enterprise organization

4:35and everything is sending its data to have Splunk ingested into one central location for analysis in that same mode.

4:45This allows us to be able to correlate everything.

4:48And you're going to see that as we continue through our labs and working inside of Splunk specifically,

4:54how all this comes together.

4:56Because you can search for something and get all the things related to that

5:00as we correlate the events based on a certain criteria.

5:03Whether it be a source type or a destination or a source, whatever the case may be.

5:09That correlation is done for us so that way we don't have to do it manually.

5:14And we can actually set up rules either through rule-based or anomaly-based to be able to flag these events.

5:21However, we want to deal with them later.

5:24Now keeping in the same environment that flagging is just for reporting purposes only,

5:29and then in our SOAR environment, we are actually going to take an action against.

5:34Because on the SOAR side of things, we use Splunk to ingest all of this stuff,

5:40not just in raw data mode, but we're looking at it primarily for alerts.

5:44And those alerts are going to come in the form of either rule-based or anomaly-based detection standards

5:51that we set in as our definitions.

5:54And say, if this packet or this file or this whatever does X, then we want it to trigger Y.

6:03And then we're taking it and correlating it again to all the raw logs,

6:08and we're going to standardize how a security team, our cybersecurity defense responders,

6:15are going to respond to all of these things that are happening

6:19in accordance to whatever our organization's SOPs or standard operating procedures or our policy dictates.

6:27And that's really the crux of looking at SOAR or Splunk as a SEAM or a SOAR.

6:33SEAM and SOAR by themselves have defined roles in what they do.

6:39Splunk blurs the lines and can be used as an either-or.

6:44Now, that being said, right below this video, I'm going to have a little table for you of other known SEAM and SOAR products

6:53and how that way you can get more familiar, because you may have worked with some of these before,

6:58and say, aha, that is yet how a SOAR works or that is how a SEAM works.

7:03And this is how Splunk bridges the gap between the two

7:07and allows us to be able to see everything from a centralized standpoint

7:11and take either action on the spot or predetermined actions later on.

0:00To start things off, I want to make sure that we're all on the same sheet of music here,

0:04and I'm going to walk you through a couple of links on how to be able to get some of this

0:07on your own. We're not going to go through the installation of Splunk, but I just want to be

0:12able to point out where it's at and what data set that we're using, just in case you want to

0:16start dabbling on your own system at home. But we do have this in a lab environment, as you will see

0:22right above this video. Now that being said, let me shoot over to the side screen real quick,

0:27and you can see here that I am on the Splunk main site. Now you can get a free trial of Splunk

0:34with your Cisco account, because it is Cisco owned, remember that. And it has a limited use,

0:41along with a limited time frame. Generally it's 60 days and can only work up to a certain amount

0:47of data in gigabytes. Anything past that, you'll have to pay for it. But we have it set up in our

0:54lab environment, where you ain't got to worry about that. But just remember, time and data

0:59sizes do apply if you want to do this at home. And I'll have these links below the video.

1:04That being said, I do want to point out that we're using an external data set inside of our

1:10lab environment. I will specifically have this GitHub link below, because if you do have a Splunk

1:17at home, and you do want to use it, just know that this is the data set that we're using.

1:21There's a couple things that I want to point out in this real quick. First and foremost is that

1:26warning, that there is some foul language that I've been trying to filter out inside of this

1:32data set. I think I got rid of all of it, but I don't want to say 100% for sure. Just know that

1:38some data packets in here may be inappropriate. And I don't mean for that to be on purpose,

1:43and I'm constantly trying to root them out, so that way we can just stick to the core issues

1:48of what needs to be in this skill and course. Now, there are many different things that we can

1:54get from this data set, and I want to walk you through this GitHub real quick, because it'll

1:59become relevant as the course unfolds. The data source and types include a whole bunch of

2:05different things from a whole different lot of type of systems. Our lab environment has been

2:10made to where it's isolated away from the actual internet, so that way this doesn't bleed into any

2:16other working environment. See, got to have that pen testing mindset in there, if you will.

2:22Now, that being said, there are add-ons that are required to view some of these tools in dashboards

2:29aside from the actual searching. It has already been downloaded and built into the actual Splunk

2:34itself, but if you are curious, scroll further down and you will see a list of required software.

2:41These are the actual add-ons that you can either download manually on your own, and then bring

2:46them into Splunk, or install them through Splunk yourself, if you have internet connection to your

2:54Splunk system. These have already been installed, as you can see, there's quite a few of them,

3:00and they will help us be able to analyze the different types of packets. Now, as an example,

3:05I want to show you, as I zoom in here for you, I'll highlight this first, this add-on right here

3:12is for AWS GuardDuty. That means that anything related to packets or data that are being ingested

3:20by our Splunk related to AWS GuardDuty, it can be analyzed in a preset tool inside a Splunk to

3:27work with it. Otherwise, it's just listed as raw data. That's not really that bad, because we can

3:34still analyze raw data from like a packet level. Wire sharp, right? Now, if we zoom out and then

3:41scroll up, you'll see in our data source types included, let me zoom in for, I'm going to highlight

3:50all the AWS stuff, and then zoom in for you. You can see that we have AWS specific data types that

3:57are included in our index or data set. That is on purpose, and those add-ons allow us to be able to

4:05utilize those and get more out of them than just regular basic packet data later on as we start

4:13doing more courses and more curriculum related to advanced Splunk usage. We're just getting through

4:19the basics right now. I also just wanted to make sure that we're all on the same page with what's

4:23being offered here. Now that being said, let's take a look inside the lab. Here we are inside

4:30the lab, and you'll notice that I goofed. When I was developing this lab, I had a phantom VM that

4:38just won't go away. As you see with this virtual machine error right here, you'll get this whenever

4:43the lab starts up. That's okay. Don't worry about it. Just hit okay, and just pretend it never

4:48happened. Now, generally, when you come into our labs, you'll just on the top right of the screen,

4:54I'll zoom in for you, you'll see Splunk. That is the VM within our lab, and when we double click

5:00on it, you should come up to a virtual machine that's already running and should already have

5:06its window open to Splunk. While that's taking its sweet precious time opening, you'll notice on the

5:13left, right below the trash can or recycling bin, that we have a passwords.txt document. This is

5:20important just in case you're in the lab long enough that the system's locked or whatever.

5:27Like that one came up locked, these are the passwords to be able to get into it.

5:31So this first password right here, and I'll have these on a sticky on the side for you in the

5:36skill, learner and password is for the actual VM itself. Then when you get to the Splunk

5:42GUI or user interface, you'll have learner and password for that as well too. I'm trying to keep

5:48everything the same, but I have this on here just in case you're like me and constantly need a

5:53reminder because you forget stuff. So that being said, we're going to go in into action on the VM

6:00itself because that's where you send the control all fleet. Then as that's coming up, you see there

6:07learner. We'll use our password to log in and boom, shock a lockout. We are here at the Splunk

6:16or not dashboard, but just Splunk Enterprise GUI. I have inside of this lab on the inside,

6:23I'm using Edge by the way for all this. If you look on the top left, you'll see that there's a

6:31bookmark icon on the toolbar for login Splunk. If you click on this, it will take you to the

6:36main page that we were just at. This is by default what I have it set as, as we're exploring the

6:43basics of Splunk. If you get logged out and you go to learner and you say log out to get a actual

6:51representation, this is your actual login screen. And I've done the courtesy of even further saving

6:57the password in the browser. So that way you don't have to really type everything all the time. You

7:02just click on the learner and go to sign in. Now, as a side note, as a security technician and,

7:10you know, pen tester myself, please don't do that. I'm just, this is ease of use for the actual lab

7:15itself. Don't store passwords in the actual browser itself. That's bad. Bad me. I'll be sure to punish

7:22me later on for this. This takes us directly to our actual Splunk starting page. And from here is

7:30where we start getting into the basics of Splunk. But I wanted to make sure that we had a firm

7:36introduction into the lab itself. Last thing, if you're wondering why this is full screen and looks

7:42kind of wonky for the backdrop, it's because I'm using remote desktop to actually get into the lab.

7:48Hold on a second. Let me show you what I'm talking about. This is the actual, where you see it inside

7:54of Adept when you're on the actual site itself. This is normally where you would go in and do

8:01the lab itself. But you'll notice this information on the right side over here, right there, right

8:07above me. That host information can be put into remote desktop and using the username and password

8:14in remote desktop app, you can have it opened in full screen mode like I do. The preferences,

8:21you know, different people like to do different things. So let's get ready to use Splunk.

0:00Here we are back inside of Splunk.

0:03I want to go back to what we were talking about previously in the previous section of this scope and cover applications.

0:12As we mentioned already, certain applications are needed to be able to parse information in certain ways or in certain manners.

0:19There are applications out there that cover a whole array of different things.

0:23In fact, I'm going to show you the actual repository.

0:28Yes, here we are.

0:30For actual applications in Splunk, I have the link for this below.

0:35I just want you to be aware that inside of the actual Splunk-based website,

0:41you can go through and search for add-ons and other applications for Splunk for a whole different variety of things.

0:48I just want to give you an example.

0:50We're going to search for, as you can see here, built by Splunk.

0:55We're going to go into Splunk and we're going to search for AWS as one of the applications that we were looking at earlier for the different data types.

1:06You can see that AWS GuardDuty does in fact show up because that is one of the data types that we have in our data set for our lab here.

1:15As you go into the actual application here on the Splunk site,

1:20you'll get details into what it's actually supposed to be doing along with the category type.

1:27This is where I really want you to pay attention to some of these apps.

1:30These applications are the crux of what really brings Splunk to gray the line between SIEM and SOAR.

1:40The AWS GuardDuty app that we're taking a look at, I'll highlight it for you and then zoom in, is an actual SIEM app.

1:48That means that this application will be able to ingest data for AWS GuardDuty and analyze it, not take an action against it.

1:58We see this even further when we get into the actual supported actions of what's going on.

2:04When you go back up top in the previous portion of the skill and take a look at that GitHub link,

2:10you'll see all those applications that are recommended for the data set that we're using inside of our Splunk lab.

2:16That would be an excellent time to go through and take a look at the different apps and see what it is that they actually do for you.

2:24You may determine that in your own setup environment that having AWS GuardDuty ain't exactly worth it.

2:30You're okay with looking at the actual raw data itself. That's okay too.

2:35Remember, different folks do different things.

2:37But this particular app in general does test connectivity,

2:42validate the asset configuration for connectivity using supplied configurations,

2:47meaning that we can actually go in and verify that everything is set up to our standards or our SOPs in accordance to our organization's policies.

2:57This is how we actually utilize Splunk and our security role to verify that our systems are doing what they're supposed to be doing.

3:07Not just this app does it. You can have other apps or other rules that you create to actually go through and audit the actual systems themselves.

3:16If you all have heard me in any of my other courses and skills here on CBT Nuggets,

3:21you know that I'm all about the auditing and more specifically the logging.

3:26Log, log, log, write it down.

3:28Apps like this allow us to be able to do that.

3:31You can go through on your own and read the rest of what this application does and along with the other ones that we'll be using for this.

3:39But let's take a look at where it's actually at inside of our actual Splunk environment.

3:44Let me zoom out and go to our remote desktop here inside of our Splunk lab.

3:51We're taking a look at the actual Splunk welcome page for whenever we come in on a basic account with no other setups because we haven't configured anything yet.

4:01This is just a basic install.

4:03On the left, these are where all the actual applications are.

4:08You're not going to see all of them there because otherwise the list would be really long.

4:12First, I want you to take note that as an example, I'm going to have to zoom in for you here real quick, that we can see search and reporting.

4:20That is a default application because Splunk does have certain default apps that we use and have to rely upon in order to get basic functions done, such as searching.

4:32And that is a big component of a lot of what this course is actually made of in searching.

4:39Without that particular app right there, we would kind of be dead in the water.

4:43But if you notice, right above the search bar for search apps by name, right above that on the right is Manage.

4:51And that's where we're going to be going next.

4:53So inside of Manage here, let's re-login because I timed out.

4:59Shame on me.

5:01We can see that we have every app here listed.

5:05And we have 51 apps as we see here.

5:10And we can go through and search for them by app name and also expand the actual apps to get more details on them.

5:17You will see that there are Browse More apps as an icon on the top right.

5:22But again, this particular VM is limited that it does not have connectivity to the Internet.

5:27So Lab Environment will not allow you to go do that.

5:31Let's prove it.

5:32When you click on Browse More Apps, you will get to the actual page.

5:37But nothing will really fill in for you because that Browse More Apps goes back to the Splunk application repo link that I have right below this video.

5:48And searches from there.

5:51You can see that I have an unexpected token.

5:53Something, something, something is not a valid JSON.

5:56That's because it does not have connectivity to the actual network.

6:00Now at this particular point, if you are lost, like I get sometimes in here.

6:06And you want to go back to the first page that you started at.

6:09Just simply go to the top left and hit Splunk greater than Enterprise.

6:15And that will take you back to the actual starting page because we have not made any configuration changes to this yet.

6:22Now if we go back into Manage, you can see that we have more details about the actual applications.

6:28And more specifically, the permissions.

6:31This really matters when we start getting into users on Splunk because it's not just a user.

6:37It's multiple.

6:39We can even integrate this into Active Directory for users and permissions.

6:45But that's not what is done here.

6:47We only have one user inside of Splunk.

6:49Well, two.

6:51And sending permissions on those apps allows us to be able to delegate separation of duties for cybersecurity in the defense of our organization.

7:01Let's say you want somebody specifically on AWS.

7:04Or you want somebody specifically on Azure logs and stuff.

7:08You can actually delegate those up.

7:10We may get into that as the course unfolds.

7:14But as we just click on one here, we can actually see how an app uses the actual objects.

7:21And what description it has.

7:23The version.

7:24Does it check for updates?

7:25And is it visible?

7:27That visibility ties into the starting page when we saw all the apps that were being listed.

7:32If you'll notice this apps browser that we expanded right here.

7:36As I zoom in for you.

7:38There we go.

7:40If we move over, it has no visibility.

7:43But it is status enabled.

7:44Meaning it is running.

7:46It can be utilized.

7:48But it will not be listed in our apps on the actual listing on the main page.

7:53You can make those changes here if you'd like.

7:56By simply going into the actual settings of this app browser.

8:01I just wanted to make sure that we're familiar with where to get the apps from.

8:05How to get the apps from inside of Splunk.

8:09And how to view the information on those apps.

8:12And how it applies.

8:13There we go.

8:14Number four.

8:15To the actual data that we may or may not have within our data set.

8:20Overall for our organization.

0:00As we begin to wrap up, I want you to think back to just previously in this skill, and think to

0:06yourselves, how many of those applications were visible, and how would we tell? Well, that's going

0:13to be the challenge here, and before I send you off on your merry way to figure that out, I'm

0:17going to give you a couple of hints. To the side screen, here we are. Back on our main page, inside

0:23of Splunk, we know that on the left side are all the applications. Now, you can see here that, yes,

0:30that's a lot of the applications, but did you know that if you scroll down, you get a load more? Let

0:36me zoom in to show you that right there, and you can click on load more. Now, you could very well

0:42right here, just count from there, and see how many visible applications there are, or we can

0:50actually go into the management function, and list all of them, and see, so that way we have

0:55an eye on what it is that we're actually taking a look at, and here you have, for a fact, 51 applications

1:04as I've highlighted, because you'll always be notified of how many are on here when you come

1:09to this page for management purposes. You can even display based on how many results per page,

1:16and since we have 51, if I list 100 per page, I should be able to list all 51 applications

1:23available to us, but there's a discrepancy you see. Not all of these applications are being viewed

1:30inside of our fancy-dancy dashboard in the very beginning on the main UI page, so how many apps

1:37are visible?

0:00Now, we asked a while ago how many apps were visible, and the answer to that is, is that, well, let's take a look.

0:05See in here on the apps manage apps page from the beginning start point of our Splunk UI, we have one of two ways that we can actually do this.

0:15On the previous page, we can go to load more and view all of them there.

0:19But I have found in the past that's not always the most reliable method.

0:23Here in our manage apps page, I would want to be able to view all 51 apps and count from here.

0:30Now, later on, we will definitely go into how to do this more efficiently, but you can just look at the visibility row here in our apps page for Splunk and just get a count based on whether it says yes or no.

0:47If it's yes, it'll be seen on that main page.

0:50If it's no, it won't be seen, but it'll still be in the background.

0:54And important to note here that just because a app does not have visibility does not mean that it can't be used or utilized in some other function.

1:04Not all applications are built inside of Splunk for UI.

1:09A lot of it, like we were talking about with AWS previously in the skill, is built just so Splunk can parse the information and deal with it more efficiently.

1:19Adding in basically a translator of sorts to be able to utilize that data in the easiest way possible for other applications.

1:29And you'll notice a lot of that with the applications in that GitHub link because not all of them come with predefined GUIs or dashboards or things like that.

1:38It's mostly just to be able to utilize the data set that we have, which we'll get into more as the next few skills, and then put together how we use that information.

1:50Because Splunk overall, again, is more about ingesting large amounts of data, and we've done that inside of our data set.

1:58You'll see it's huge, which is why the VM was built as big as it is, because it's very resource intensive, which is another thing I want to throw out there.

2:07The more applications, the larger the data set, the more logs that you're ingesting for your Splunk monitoring inside of your organization will dictate how many or how much of resource you want to add to a particular system running Splunk.

2:23As we get into more advanced uses of Splunk, we'll see that it's not just one, but can be many.

2:31Because we can have multiple Splunks out there reporting to one big Splunk, and we can have Splunk reporting to other different systems as well, and have other systems reporting to Splunk.

2:43But, if we're running Splunk on a workstation, like Windows 10 or 11, and we don't have a lot of RAM, storage, or CPU power, then the ability to go through and look at that information that's being ingested can really be a hassle.

3:01You'll see, especially as Bob starts getting into the searching mechanisms of Splunk, the data set here is quite huge, and even with the amount of resources we've thrown at this lab, can still take some time to load up for you.

3:15But that's it for now, and we're going to start getting into, in the next skill, how to manage those different users that we hinted earlier in this one.

3:23I hope this has been informative for you, and I'd like to thank you for viewing.