To best start onboarding and beginning to work with data in Splunk Enterprise, review the following general steps.
- First, decide on the objective you want to achieve using Splunk Enterprise. Then identify the data you need in Splunk Enterprise to help you complete that objective.
- Use Splunk Lantern’s security and observability use case libraries to discover new applications for your data.
Onboarding your data
Getting data in - Windows
Getting data in - Linux
Getting data in - Forwarders
- .Conf talk: Best Practices for Forwarder Hierarchies
- .Conf talk: Managing Forwarders
- .Conf talk: Starting Your Splunk Journey - Get Your Data In
- .Conf talk: When Data Sources Say “I Do”: Creating a Happily-Ever After Triage Solution
- Splunk downloads: Download a universal forwarder
- Docs: How to forward data to Splunk Enterprise