The Splunk Web interface

You can log into Splunk Web using the appropriate URL and the default port of 8000: http://<hostname or ip address>:8000. If you have configured Splunk to use HTTPS (a good idea), you will need to reflect the port you configured in the web.conf file. Another example, using a fully-qualified domain name, is https://mysplunkserver.mycompany.com:8443. After logging in with your username and password, you will be presented with the Home interface (unless you'd selected another default page in the past), which features a list of clickable icons for all the installed applications along the left-side. One of the icons along the left side menu will be Search & Reporting – click that icon to open the Search interface:

Fig 6.1: Splunk launch page

At this point, you're ready to enter a search command using Search Processing Language (SPL...