►
From YouTube: OpenShift Commons Briefing #132 Monitoring Kubernetes & OpenShift in Splunk (OutCloud Solutions)
Description
Kubernetes is a portable platform for managing containerized workloads and services with large growing ecosystem. OpenShift is a solution built on top of the Kubernetes to bring more secure and flexible for application developers deployments.
Come to learn the basics of the orchestration engines, find how to keep your clusters healthy, various ways you can monitor your clusters and forward logs to Splunk.
We will have an introduction in Kubernetes and OpenShift clusters, how they differ from Docker environments and Docker Swarm. Why would you choose OpenShift over Docker environments?
Learn about basics components of Kubernetes and OpenShift, including etcd, KubeAPI Server, KubeProxy, Kubelet, how they differ in between Kubernetes and OpenShift.
How to monitor them. How to forward logs from the Kubernetes and OpenShift, how to collect metrics. We will show some basics in different ways it can be implemented and demo solutions for Monitoring Kubernetes and OpenShift clusters. How to setup ACL based on Projects and Namespaces, how to define fields extractions.
Learn how to monitor and diagnose your clusters, best practices you need to apply to keep it secure and stable.
A
B
A
B
Yeah,
yes,
so,
first
of
all,
I
think
everybody
who
joined
us
today
for
this
webcast
and
at
the
same
time,
like
I,
just
hope
that
will
give
some
information
about
this.
Like
what
the
reason
why
would
be
interesting
to
using
squonk
to
my
internship
I
also
give
you
an
overview
of
our
solution,
so
people
you
get
start
to
the
demos.
B
Let
me
actually
introduce
myself
so
you'll
know
like
it's
some
story
behind
our
company
and
what
we
do
so
any
big
mind
must
actually
in
support
development
from
2005
I
work
on
various
tools
like
development
tools,
services,
even
mobile
developers,
but
my
my
passion
was
always
about
the
DevOps
tools
like
developer
tools
and
operation
tools
as
well.
I
worked
in
Microsoft,
wonk
and
stripe
as
well,
and
a
lot
of
used
a
lot
of
where's
languages
and
platforms.
So
you
can
find
me
on
all
code,
windows,
comb
and
my
user
name
and
Twitter.
B
For
example,
we
use
it
for
development
workflows
for
some
other
things,
and
but
in
2017
that
laughs,
Blanc
and
I'm.
Thinking
like
out
of
my
career,
is
just
start
to
work
with
kubernetes
and
build
this
first
prototype.
I
am
and
I
found
that
it's
actually
I
was
really
interesting
to
find
a
way
to
monitor
the
kubernetes
since
Blanc,
and
so
they
like
first
prototype
of
my
entering
daughter
and
went
from
beneficence
blog
in
November.
B
We
found
that
that
it's
actually
not
only
real
for
actually
interested
in
that,
and
there
are
some
customers
who
wanted
to
pay
for
that,
and
so
I
found
the
co-founder
and
we
decided
in
December
that
they
should
found
the
company
and
start
working
on
the
on
the
on
the
the
solutions
for
mentoring,
opportunity,
torture,
our
cabinet,
the
Saints
Blanc,
and,
as
you
can
see
this
of
course-
and
we
just
use
this
name
because
through
some
water
it
was
done
on
my
knee
called
cold
man.
We
decide
just
to
use
it
so
people
a
little
cos.
B
There
was
some
history
around
who
is
working
on
this
and
and
so
on.
So
our
core
solutions
is
the
company
that
provides
monitoring
solutions
for
open,
Shoku,
Benitez
dorkin's,
one
enterprise
in
spoink
cloud.
We
are
providing
the
solution
for
Windows
and
Linux
containers
as
well,
and
we
have
probably
tell
that
we
actually
have
technology
partners
and
we
the
same
time
Splunk
technology
partners.
B
And
so
let
me
actually
now
go
to
the
one
of
our
solutions.
I'm,
most
people
gonna
talk
about
my
authority
open
ship,
but
our
solution
to
maintain
kubernetes
is
pretty
much
familiar.
There's
few
things
different
around
the
like
and
giving
native
experience
like,
for
example,
an
open
treat
and
then
spaces
are
called
projects.
So
we
trying
to
keep
it
this
way,
I
about
in
micro
videos,
we
call
them
in
namespaces
and
so
on.
B
So
what's
use
cases
for
using
our
solution.
First
of
all
is
application
monitoring.
We
actually
are
forward
all
the
information
about
the
metrics
from
the
fraud
sucess
containers,
all
the
information
about
limits.
If
you
limit
your
workloads
in
the
open
shipped
before
containers
and
application
logs,
and
what
congregation
is
another
use
case
when
you
actually
want
to
get
all
the
logs
from
containers
from
the
host
and
application
logs
or
something
more
specific,
like
our
deep
logs
from
the
master
nodes
as
well.
B
Another
thing
we
do
is
we
helping
you
to
infer
the
health
of
the
of
the
cluster
other
things?
How
well
is
what
the
current
status
of
best
declining?
How
well
you
actually
managing
the
capacity
of
your
cluster,
some
guidance
about
security
or
which
campaign
is
running
and
with
the
root
privileges,
are
always
elevated
security
formation.
Some
like
that,
we
also
give
you
our
overview
over
your
control,
plain
etcd
cluster
could
be
nice,
api
server
and
so
on.
So
I
will
show
you
a
demo
on
this
as
well.
B
Some
broad
benefits
it's
built
specifically
for
commuters
and
open
shape.
So
it's
ready
to
use
it's
10
minutes.
The
top
just
literally
takes
10
minutes
to
actually
get
it
up
and
running
and
get
pretty
much
all
the
data
we
will
show
in
the
demo
in
SWANCC.
It's
a
certified
solution,
so
we
actually
work
in
with
red
card
to
certify
a
solution
like
the
server-side
piece.
B
So
and
at
the
same
time,
if
you
are
a
just
one
in
customer,
then
you
can
leverage
your
Splunk
Enterprise
will
spawn
cloud
infrastructure
or,
if
you're
not
want
customers.
Bunk
is
really
useful
for
and
really
powerful
in
a
sense
of
reviewing
the
logs
and
and
you
like,
having
correlation
between
Watson
metrics,
you
can
also
build
some
custom
dashboards,
basically
custom
custom
application
solution.
Some
topics
want
the
description,
for
example,
what
we
did
you
can
actually
set
up
project
or
cluster
level
access
control.
These
I
will
show
you
them
on
this
as
well.
B
B
You
you
will
need
to
install
our
application
from
the
spawn
base.
It's
you
know,
I
keep
you
know
familiar
with
one
base
or
Splunk.
Basically,
like
a
App,
Store
ego,
you
find
the
application
stolid
and
that's
a
done,
and
after
this
you
can
download
our
predefined
configuration.
They
have
one
Alpine
based
for
like,
for
example,
people
who
use
a
region
and
another
one
is
health
records
based
images,
certified
images
from
the
Red
Hat
registry,
if
you're
a
Red,
Hat
customer
I
even
want
to
use
that
and
we
support
what
you
started
from
3.4.
B
So
after
you
don't
figure
Asian,
basically
between
it
thinks
you
need
to
do
I,
said
Allah
and
said
the
URL,
where
your
spunk
is
and
defined
it
talking,
and
so
it
freaking
is
basically
the
way
how
you
can
secure.
Are
you
and
point
to
make
sure
that
nobody
else
will
try
to
send
some
data
on
this
important
and
after
this
apply
the
configuration
and
give
our
user
privileged
access?
The
thing
is
I
mean
you
can
work
around
it
as
well,
but
you
know
I
can
most
cases
when
user
or
not.
B
For
me,
we
don't
have
a
time
to
actually
define
how
much
well
grained
control.
So
the
first
thing
we
need
to
make
sure
that
we
get
access
to
the
log
files
and
usually
they're
written
by
the
root
user
from
the
book.
You're
a
demon
or
something
and
another
thing
we
need
to
be
traced,
I
mean
security,
privileges
on
the
Linux
boxes,
to
get
the
information
from
the
metrics
and
so
on.
So
there
are
some
things
which
required,
and
this
is
the
easiest
way.
B
If
you
want
to
work
around
this,
we
can
talk
to
us
and
we
will
give
you
the
best
way
to
do
that.
Well,
so
after
you
deploy
what
we
do,
we
deploy
to
daemon
set
one
on
the
masternodes,
where
we
collect
all
the
Lords
overnight,
raids
and
I'll,
say
information
from
the
control
plane,
like
from
controllers
API
server,
atcg
glossary.
If
the
running
etcd
on
the
masters
another
demon
set
is
for
the
other
master
nodes
where
we
don't
need
to
collect
a
control
point
matrix,
so
we
basically
just
go
collect
the
host.
B
I
mean
all
the
loads
from
the
host
container
application.
Logs
of
the
metrics
brought.
Is
running
inside
the
containers
outside
different
containers,
there's
some
things
like
Google,
Earth
metrics
as
well.
That
helps
you
to
find,
where
you're
spending
your
time,
when
you're
trying
to
launch
something
in
open
ship,
and
the
third
thing
is
just
single
instant
deployment.
We
call
at
dawn
which
allows
us
to
collect
things
in
just
once,
like,
for
example,
to
bring
incidents
or,
if
you're
running
it
CCD
class
through
on
dedicated
notes
as
well.
B
They
don't
really
interesting
about
the
host
and
like
this
is
the
cluster
setup
and
everything
they
only
like
interesting
in
how
well
their
application
or
Ronnie
how
they're
eyeing
our
and
but
just
they
want
to
manage
all
the
application.
So
this
is
basically
a
view
for
developers
where
they
can
go
and
see
all
the
projects
there
have
access
to
and
all
the
workloads
on
application
shrine
inside
the
weapon
saved
all
the
events
having
in
indoor
cluster.
B
So,
as
you
can
see
after
drill
down
to
this
name
project,
I
see
all
the
deployments.
I'm
writing
on
this
project.
If
you
will
have
like
cron
jobs
or
demon,
sets
your
you'll
see
them
here
as
well
from
there.
You
can,
for
example,
drill
down
to
one
of
the
work,
and
this
will
be
a
deployment
front
aunt
where
you
actually
will
see
all
the
ports
running
in
your
deployment
of
like
metrics.
B
If
you
memory
I
or
called
the
containers
processes
running
inside
of
them
and
locks
as
well,
you
will
get
them
here
so,
as
you
can
see
here,
actually
scaled
up
my
workload
to
plus
two
more
ports,
so
you
you
don't
need
to
press
it
up
or
anything.
Every
time
you
scaled
up
or
it
created
the
new
workloads
they
automatically
will
be
picked
up
by
us
and
forward
to
squonk,
and
so
from
here.
B
You
can
always
drill
down
to,
for
example,
support
to
see
the
information
about
the
port
and
list
of
containers
running
processes
in
this
board.
If
you
will
set
up
CPU,
quadrant
superiors
or
Lemus,
you
see
that
on
this
dashboard
as
well,
this
boat
doesn't
have
any
walks,
and
so
from
here
you
can
actually
drill
down
to
container
to
see
information.
Specific
can
go
out
continue,
but
this
board
doesn't
have
multiple
containers.
So,
maybe
it's
not
so
interesting,
but
from
here,
for
example,
you
can
drill
down
to
the
arm
process
metrics
and
in
process
metrics.
B
You
can
see
pretty
much
any
information
you
can
get
from
the
profile
system.
We
also
trying
to
make
sure
that
you
are
not
gonna
be
lost
in
this
dashboard,
so
we'll
provide
the
help
to
understand
what
you
are
actually
working
on
and
you
like
use
CPU
like,
for
example,
contacts
which
is
number
of
threads
trying
in
your
applications.
B
All
the
various
virtual
memory
you'll
be
able
to
see
where
you
are
when
there
is
allocated
in
some
information
about
IO
like
in
Cisco,
so
everything
will
be
pretty
much
here
and
let
me
actually
now
show
you,
as
I
said,
like
the
different
view
on
the
on
your
cluster.
Is
you
can
four
operators
they?
In
most
cases
they
want
to
actually
see
if
the
whole
cluster
are
all
the
things
you
are
in
your
all,
the
notes,
you're,
writing
on
your
plaster.
B
So
in
my
case
currently
I
have,
as
I
said,
two
clusters,
one
develop
and
run
production,
and
so
what
we
do,
we
recommend
actually
to
define
the
nod.
Labels
to
be
able
to
actually
distinguish
this
cluster,
so
let's
say
if
I
want
to
see
my
production
cluster
I
can
just
filter
and
see
all
my,
but
some
are
notes
from
production
cluster.
If
I
want
to
is
just
see.
B
The
development
class
I
can
always
again
filter
and
see
on
a
developer
cost
work,
which
has
only
two
notes
or
at
the
same
time,
for
example,
if
I
want
to
find
the
master.
I
can
do
that
as
well
by
using
labels
alright.
So
in
this
view
you
actually
will
get
their
list
of
horse
again,
like
all
the
metrics
the
bands,
if
there
were
some
warnings,
for
example,
I,
haven't
finished,
setting
up
the
in-school
service
broker
and
the
cost
loads
as
well
so
you'll
be
ending
here
as
well.
B
We
also
provide
for
you,
wait
like
II,
easy-to-use
winter,
multiple
flights
or
so
multiple
months
views
like
top
like
musical
in
that
way
to
see
like
all
containers
which
are
using
the
most
CPU
at
this
moment
and
to
pull
the
cluster
out
and
like
my
internal,
a
and
health
of
the
clusters,
we
provide
a
lot
of
views,
but,
for
example,
this
is
the
first
you
I
will
going
to
show
you
it's
out
deep,
looks
so
from
this
view.
You
can
actually
see
who,
when
and
why
I
change
things
in
your
cluster.
B
So,
for
example,
I
can
drill
down
to
the
admin
username,
and
actually
you
can
see
that
this
is
where
I
scale
up
my
cluster,
so
you
can
actually
like,
but
the
operation
find
that,
like
when
I
was
trying
to
watch
on
this
namespace
and
like
what
I
did
in
this
moment
and
you'll
get
pretty
much
all
the
information
from
about
that.
You
are
also
you'll
be
able
to
see
from
where
I
did
that.
So
this
is
actually
my
IP
address.
B
My
network
I
mean
my
internet
provider,
so
they'll
be
able
to
see
that
as
well,
and
if
there
were
some
issues
with
access,
you'll
be
able
see
them
as
well.
So,
for
example,
some
reasons,
probably
when
I
was
browsing,
something
from
the
web
page
I
didn't
I
get
four
four
or
one
of
the
IPR
calls
in
other
things
like
the
control
plane,
I
metrics,
like
API
server,
so
you'll
get
them
out
of
moves
here
as
well.
B
If
you
open
I,
will
be
able
to
monitor
that
and
I'll
be
able
to
see
the
performance
of
my
API.
You
guys
servers
as
well,
so
nothing
is
controller.
So
this
helps
you
to
know
how
quickly
things
are
scheduled
in
your
cluster
and
if
there
are
any
issues
with
that,
so
I
really
actually
see
our
customers
are
looking
at
these
dashboards
or
like
trying
to
find
any
issues
with
it,
but
sometimes
can
help
as
well
to
that
they
start.
B
Looking
on
some
problems,
Kubla
I
can
give
you
information
about
how
your
on
up
and
ship
cluster
working
on
every
node
with
the
dorker,
so
where
you're
spending
all
the
time
I
mean
it's.
Usually
everything
is
pretty
Italians
like
micro-cycles
milliseconds,
but,
for
example,
you
see
the
the
longest
separations.
They
usually
put
images
right,
so
you'll
be
able
to
see
them
here
as
well
and
things
you
can
actually
debug
here
is
like
how
long
it
takes
to
terminate
the
instances-
and
you
know
maybe
how
long
it
takes
to
mount
on
the
balloons.
B
B
Another
thing
we
do
is
we're
trying
to
I
help
how
you
can
monitor,
for
example,
allocate
the
resources-
and
this
is
a
capacity
climbing
rate,
so
you
can
actually
take
a
look
on
that
all
the
resources
available
on
your
clusters.
How
much
CPU
request
you
already
made?
How
many
memory
request?
Your
aim,
a
total
amount,
is
what's
the
current
CPU
limit
and
so
on
so
you'll
be
able
to
see
that
as
well.
For
every
note,
you'll
be
able
to
see
that,
and,
like
my
in
my
case,
my
clusters
are
pretty
small
and
that's
why
I?
B
B
So,
let's
say,
for
example,
you
are
bootstrapping
your
cluster
and
running
it
to
see
its
CD
servers
on
the
masters
and
if
this
monsters,
for
example,
have
16
gigabytes
of
memory,
if
you
say
that
this
master
actually
allow
have
allocatable
like
I
put
in
I,
give
I
said:
I
mean
this
means
that
it
will
actually
try
to
allocate
everything
in
this
open
shape.
There's
not
a
lot
of
memory
will
going
to
be
left
for
system
component
like
it
is
in
equalizer,
simply
just
any
other
things
running
on
the
system
which
not
part
of
open
shape.
B
Ports
and
so
which
I'm
gonna
make
sure
that
you
actually
give
this
enough
of
the
memory
to
discompose,
and
you
can
see
in
like
in
my
testing
arm.
I
didn't
and
things
can
go
not
well.
If
I,
you
know,
I'll
most
of
my
thoughts
will
try
to
use
memory
close
to
the
limits,
and
this
actually
can
break
my
deployments
so
we're
trying
to
help
the
dead
and
enterprise
and
guidance
as
well.
B
So
you
don't
want
to
see
a
rat
in
your
deployments,
the
security
we
provide
some
information,
while
they're
all
privileged
containers
and
all
the
enable
communities
in
the
deployments.
Like
again
as
I
said,
a
collector
al
collector
actually
are
running
as
the
root,
because
it's
a
lot
of
things
to
to
get
all
the
metrics
and
just
give
access
to
the
logs.
You
know
this
world
can
try
to
limit
them,
but
in
this
deployment,
which
I
got
from
sub
shop
is
actually
using
the
cut
not
being
serviced.
B
So
this
means
that
this
is
the
capability
that
allows
the
proteins
to
bind
to
the
force
from
one
mm,
and
you
don't
really
need
that
in
the
continuous
right
you
can
bind,
for
example,
to
8,000
of
this
mount
this
or
to
lower
one.
So
this
probably
something
you
want
to
release
it.
So
this
is
like
really
quick,
quick
overview.
Are
there
just
one
thing,
I
wanna
show
you
like
again
like
if
you're
familiar
with
us,
along
with
you,
will
try
to
do
the
old
logs
from
the
campaign.
Yes,
we
are
forward
to
a
spunk.
B
B
Yeah
there's
a
good
question,
so
what
we
we
don't
provide.
Any
alerts
by
default.
I
really
know
how
well
how
experiences
first
remove
is
long,
but
I
can
show
you
a
quick
demo,
so
we
don't
really
have
any
alerts
about
predefined
the
roads,
because
blank
has
a
lot
of
capabilities
to
alert
you
and
we
only
know
what
kind
of
feel
like
trigger
you
want
doing,
send
email
or
would
you
want
to
send
the
unification
the
slack
channel
he
child
something
like
that,
and
so
what
you
can
do
always
do.
B
Let's
say
you
open
this
search
in
the
new
top
right
and
after
this
you
at
something
like
search
and
I'm,
one
type,
for
example,
not
normal,
so
anything
not
normal.
If
you
will
get
any
result
here,
you
want
the
alert
from
this.
There
is
nothing
here
yet,
and
so
what
you
can
do.
You
can
say
this
as
a
little
hurt
and
if
and
it's
at
some
point
you
will
actually
get
this-
not
normal
warnings.
You're
gonna
get
an
action.
This
is
default
action.
It's
like
that
hoax
sent
emails
transcripts.
B
A
B
Or
the
currently
has
so,
as
I
said
like,
for
example,
you
can
drill
like
if
you
know
that
we're
writing
like
project
or
namespace,
you
can
always
go
there,
and
but
in
other
options,
for
example,
you
can
go
to
the
least
of
all
ports
currently
running
in
your
production
right,
and
you
can
only
search
here
again
like
if
you
know
that
not
labels.
You
can
do
that.
If
you
know
the
code
labels,
you
can
find
it.
If
you
know
the
projects
you
can
filter
it
and
you
can
always
filter
life.
B
B
So
when
you
do
not
like
either
some
which
are
down,
you
almost
see
them
in
squat
right
because
we
actually
what
we
do.
We
run
our
and
I
will
contain
also
our
collector
as
part
of
open
shape
deployment,
and
so,
for
example,
if
you
have
like
cluster
of
six
members,
you
will
see
all
of
them
in
Splunk.
If
you
are
sure
any
of
them,
the
panel
will
then
will
go
down.
B
A
B
I,
like
questions,
thank
you
for
the
questions.
It's
always
helps
me
like.
If
you
actually
give
me
the
right,
then
why?
Because
again,
like
I,
don't
really
know
how
the
expertise
of
the
account
but
people
who
actually
watching
this
is
how
funny
really
just
blank
and
so
on.
So
it's
useful
questions
are
useful,
so
back
to
the
slides,
so
now
I
actually
want
to
drill
down
a
little
bit
to
like
close
to
product
like
most
to
like
real
environment.
B
So
a
lot
of
cases,
our
customers
want
to
limit
the
access
to
the
data,
let's
say,
for
example,
a
curators
want
to
see
all
the
host
logs
and
all
the
information
running
on
from
the
host
like
the
health
of
the
clusters,
but
developers.
Maybe
they
didn't
want
to.
Maybe
they
did
not
allow
to
see
that
and
we
want
to
actually
define
the
developer
should
be
able
to
see
only
information
from
their
specific
for
their
project.
So
we
are
going
to
do
that.
B
You
can
do
this.
Also
one
dama
I
can
show
you
is,
but
this
user
that
actually
have
access
to
just
one
project
called
a
sock
shop
and,
as
you
can
see,
if
this
is
the
same
overview
for
the
same
cluster,
and
he
actually
have,
he
only
see
that
this
one
project
so
true
and
he
can
only
drill
down
to
this
a
social
project
and
see
all
the
deployments
in
the
social
project.
But
if
you'll
try
to
preserve
all
go
to
the
list.
B
Of
course,
you'll
not
be
seeing
information
because
he
doesn't
access
to
this
indices
and
very
quickly.
I
can
show
you
how
it
it
can
be
done.
So
if
you
go
to
the
funk
settings
and
I
have
this
user,
that
this
regular
user
and
it's
part
of
the
user
role
and
in
this
user
role
for
this
user
role,
I
actually
gave
this
user
only
access
to
this.
This
is
AK
indexes
and
forward
all
the
information
from
this
project
so
shop
on
it
through
this
indexes,
so
only
to
the
synthesis.
B
B
The
other
things
are
some
information
about
container
logs,
and
this
is
I
think,
like
a
really
cool
demo,
to
know
a
little
bit
more
about
swamp
itself
and
the
show
you
capabilities
of
our
solution
as
well.
So,
every
time
when
you
form
like
we
automatically
forward
all
the
logs
from
the
containers
right
and
we
actually
proceed
on
this
special
source
format,
where
you
can-
which
we
can
strive
for
all
the
various
components
of
the
port
we
work
in
close
container
ID
containing
name
is
a
important
in
them
space
and
daughter
stream.
B
B
So
you
actually
define
the
things
you
say
like
hey
I
want
from
every
container
ID
from
every
container
I
want,
but
I
want
to
make
sure
that
all
this
container
is
using
engines
like
signature
or
let's
say
you
want
to
get
lots
from
the
containers
named
proxy
and
then
injects
image
can
have
any
attack.
You
can
do
this
again,
these
wild
cards
again,
because
I
show
that
we
actually
annotate
all
the
enhancements
one.
B
You
can
also
use
different
approaches
for
like
personal
namespaces,
you
can
actually
do
the
sources
as
well,
but
you
can
also
you
this
build
metadata.
We
attach
and
another
example
like
deployment
name,
you
can
say
I
want
to
all
the
logs
from
this
open
circuit
point
and
then
from
and
and
open
meant
by
structure
and
you'll
get
all
the
lots.
We
can
find
the
more
information
on
this
link
and
yeah.
We
will
share
with
you
all
this
slide,
so
nobody
will
find
this
slides
in
links
later
on.
B
So
let
me
actually
show
you
the
power
of
Splunk
and
how
we
can
actually
use
this
knowledge
of
the
sources
to
build
a
custom
dashboards.
So
let
me
go
to
the
the
admin.
User
and
I
have
mentoring,
upshift
application
I.
Have
this
not
chase
them
applications
as
I'm
writing
actually
currently
I'm
running
some
workload
on
this
application.
We
generate
some
logs
and
just
put
the
general
purposes.
B
So
this
is
not
jazz
application,
which
has
one
good
EB
and
some
front-end
application
and
which
is
which
is
just
not
yeah,
not
just
throw
ports
and
at
the
bottom,
as
you
can
see,
there
is
lower
box.
So
let
me
actually
open
these
logs
and
start
working
with
them.
The
first
thing
I
can
do
was
removed.
This
has
invisible
to
the
native
experience.
What's
one
gives
you
information
about
the
advance
in
your
arm,
a
Splunk,
and
so
this
is
where
I
started
to
actually
are
running
my
workload.
B
As
you
can
see,
there's
190
once
every
minute,
all
the
on
the
left.
You
can
actually
see
metadata
attached
to
this
log.
So
if
you
want
to
very
quickly
drill
down
on
specifics,
you
can
do
that
and
but,
as
you
can
see
here,
I
have
six
sources
right,
so
the
workload
is
long
balance
and
it's
actually
really
well
balanced
between
all
of
the
six
ports.
So
who
choose
just
one
right.
B
I
will
actually
see
the
water
on
different
one,
and
this
is
not
what
I'm
going
to
do
is
give
the
dashboard
for
all
the
ports
and
as
they
show
you
I
actually
don't
need
the
replication
controller.
Deep
enough.
I
can
use
this
wildcards
to
say,
like
hey,
container
ID,
take
care
no
Jia's
like
this
is
the
this
file,
and
this
is
basically
the
container
name.
I
can
keep
it
because
all
the
it
is
named
the
same,
a
port
name.
B
They
all
have
different
pull
name,
so
I
can
use
wildcards
so
get
back
to
the
view
of
my
six
ports,
and
so
why
I'm
so
curious
about
the
sources,
because
now
I
can
use
this
knowledge
actually
how
to
get
the
logs
from
all
my
ports
and
I
can
start
extracting
the
fields.
But
this
is
basically
how
Splunk
is
differentiated
from
all
the
other
solutions
that
requires
you
to
actually
define
the
schema
when
you
in
this.
The
data
plunk
are
allows
you
to
pre
index
some
data
like
those
on
our
metadata
we
attach
to
logs.
B
But
after
this
you
can
actually
work
with
already
index
data
to
start
extracting
more
fields
and
building
custom
dashboards
or
things,
and
let
you
actually
care
about.
Let
me
actually
show
you
an
example:
what
I'm
gonna
do
I'm
gonna
go
to
the
fields
and
jump
instruction,
building
structure,
I'm
going
to
use
servers
and
I'm
going
to
use
this?
B
The
kilter
which
I
used
with
wild
cards
and
so
on,
to
give
an
example
of
all
the
logs
I'm
actually
getting
in
in
my
spawn
deployment,
so
I
will
choose
one
as
an
example
goes
next,
and
I
have
two
options.
I
can
define
this
as
like
CSV
type
file,
where
you
like
their
spaces
divide,
the
things
or
I
can
use
regular
expression
to
extract
their
fields.
B
B
And
I
like
risk
response.
That
is
so.
Let
me
get
the
last
one
here,
the
feeling
right,
so
you
actually
you
can
just
using
that
start
to
extract
the
fields.
As
you
can
see
it
important.
You
can
reify
that
everything
is
struct
is
as
you
want,
and
so
the
pause
is
a
little
more
complicated
for
the
reason,
I
will
show
you
in
what
you
can
actually
do
busy
func
search
as
well
to
extract
even
more
complex
data.
B
From
from
the
things
you
already
extracted
right,
so
I'm,
I'm,
okay,
right
now
is
what
I
have
what
I
see
is
the
way
I
struck
with
verbs
request,
fast
response
status.
Let's
say:
I
don't
care
for
now,
but
other
data
on
this
logs
so
go
the
Knights
view.
I
filed
that
everything
is
correct,
I
can
actually
even
take
a
look.
No
mattress
mean
like
is
there
anything
that
you
know
at
any
father's?
B
Regex
is
any
logs
from
my
source,
which
I
define
as
a
future
that
do
not
much
that
it's
possible
that
there
can
be
like,
for
example,
when
I
start
more
jails.
It
actually
prints
out
some
of
the
not
bad
logs
about
your
exam
information
about
this
parking,
the
process
and
it
will
not
match
it's
fine
right.
So
it's
like
they're
not
useful
for
me,
because
what
they
want
right
now
is
get
information
about
the
web
request.
So
the
last
thing
I
need
to
do.
B
I
finished
it
I
saved
it,
and
now
I
actually
explore
this
field
research.
So
now,
actually
it
like
a
simple
thing:
I
can
do
time,
chart
count
by
request,
verb
and
start
building
some
visualization
right,
so
I
can
go
to
visualization.
I,
actually
see
all
what
actually
drill
down
to
like
a
lot
for
our
site
and
I
can
see
things
whose,
having
for
the
last
hour
I
can
even
change
like
span,
then
wanting
to
be
more
accurate.
B
So
for
every
minute,
I
can
see
all
the
requests
and
Whirley
how
they're
actually
going
I
can
also
do
a
lot
of
various
type
of
graphs
and
I
can
actually
just
tag.
So
you
like
you,
can
actually
can
compare
all
the
different,
so
I
do
a
lot
of
gates.
I
do
some
force
and
you
deletes
and
what
you
can
do.
You
can
actually
now
say:
I'm
gonna
save
this
as
a
dashboard
and
I
back
up
and
hit
the
chart
and
the
application.
B
So
everybody
will
see
that
so,
let's
say
that
we
can
first
view
on
the
dartboard
and,
let's
actually
start
putting
more
date
in
here.
So
now
we
get
to
get
delete
post.
So
I
already
mentioned
that
what's
really
interesting
about
this
data,
like
the
request
path,
is
a
little
bit
more
complicated,
for
example,
him
to
request
part
right.
B
It
actually
has
the
query
parameters,
this
Q
equal
entry
as
a
question
right.
So
what
we
want
to
do.
We
want
to
extract
these
data
as
well
and
maybe
build
some
dashboards,
see
like
what
what
questions
user
ask
in
our
like.
You
know
application.
So
maybe
we
do
can
do
some
statistic
on
all
this.
So
for
that
actually
free
I
saved
I
saved
the
search
to
save
your
time,
but
let
me
actually
go
and
show
you
pretty
much
every
step.
I
do
so
help
it
is
just
for
debugging.
B
B
So
like
people
we
actually
saw
those
the
euro
was
encoded,
so
we
decode
it
to
make
it
more
user
readable,
but
we
did
that
next
thing
we
actually
extract
with
reg
X
again
we
extract
the
question.
It's
easy
to
pick
and
actually
in
this
simple
example,
you
can
do.
Maybe
even
these
they're
just
tricks
the
string
substitution.
You
can
actually
just
say
like
sorry
for
like
index
I
want
for
this
is
my
question,
and
so
you
can
now
define
the
table
that
you
know.
As
you
can
see,
we
extracted
the
question.
B
B
So
that's
that
I
also
top
so,
which
ought
to
give
you
count
in
percent,
depending
on
your
preferences.
You
can
always,
for
example,
do
like
scales
you
like
for
that
percent.
So
you
can.
Actually,
this
is
a
data
or
you
can
again
go
to
visualization
everybody
likes
pie
chart.
So
we
can
should
build
the
pie,
charts
and
the
other
thing
you
can
do
can
save
it
to
existing
that
fort,
which
we
just
created,
how
they
called
it.
Some
like
web
web
app
right,
I'll,
collect
questions.
B
And
we
go
now,
you
actually
have
the
dashboard,
which
has
to
show
all
the
different
verbs
and
also
all
the
questions
running
your
application.
As
you
can
see
with
the
power
bank
and
they
say
LTS
one
processing
language
and
with
the
capabilities
of
building
the
dashboards,
you
can
actually
start
defining
your
own
dashboards
and
you
can
edit
this
divorce
ad.
You
can
actually
convert
it
to
JavaScript
and
start
using
javascript
to
build
a
more
complex
views.
B
I
can
even
add
filtering
as
well
here
and
you
can
actually
combine
the
more
so
you'll
be
able
to
drill
down
from
one
to
another.
So
when
I
show
you
the
overview
of
the
application,
the
basically
just
a
set
of
dashboards,
we
don't
have
any
more
specific
than
that.
We
actually
basically
just
use
this
way
of
constructing
dashboard
and
rebuild
our
application.
So
hope
that
can
give
you
some
over
you
what's.
B
Splunk
is
useful
for
and
some
capabilities
you
can
get
from
out
of
spawn
and
there's
much
more
others
like
machine
learning
toolkit
that
allows
you
to
predict
something
some
things
that
yeah.
If
you
can
build
this
on
your
data
and
a
lot
more,
so
let
me
actually
go
back
to
the
slides.
If
I
have
anything
else
left
so
I
give
you
them
a
custom
dashboards.
Some
things
about
the
pricing
so
before
a
swank
I
can
just
say
that
the
pricing
depends
on
the
ingesting
volume.
B
So
you
can't
need
to
know
slightly
about
like
how
much
they
didn't
ingest
and
spunk,
and
our
pricing
as
I
said
we
actually
different
company
that
provides
the
solution.
Purpose
want
LV
price
based
on
the
main
turret
nodes
and
starting
from
300
five
notes
so
like.
If
you
want
to
get,
for
example,
giving
me
the
risk
one
and
open
trade,
we
find
it's
a
lot.
It
can
be
useful.
We
just
start
with
us
because
you
start
getting
data,
you
can
explore
the
data
and
the
onus
work
with
us.
B
If
you
have
any
questions
and
that's
my
last
slide
so
I
hope
you
enjoyed
our
demo.
If
there's
any
more
questions
I'm
here
to
answer-
and
you
can
find
more
information
about
us
at
Arco
solutions
at
home,
all
the
instructions
how
to
install
our
solution
and
all
the
information,
all
the
demos
I,
you
don't
need
to
contact
us.
If
you
want
to
try
it,
you
can
just
download
it
right
away
and
it
said
it
takes
five
minutes
to
set
it
up.
You
can
also
for
some
Twitter.
A
B
A
good
question,
actually
let
me
actually
try
to
find
if
I
can
an
example,
so
by
default
our
collector
actually
trying
to
predict
the
multi-line
walks.
Just
like
it's,
it's
real
problem,
if
you,
if
you
experienced
a
daughter,
a
user
and
use
it
for
a
while,
it's
like
a
real
problem.
Actually,
if
you
have
multi-line
log
lines,
they
will
be
split
by
everywhere.
It's
actually
having
pretty
much
on
every
don't
your
drivers
on
logging
driver
and
it's
a
cloud
watch
as
well.
B
B
B
B
Yeah,
probably
I,
don't
have
this
right
now,
but
basically
what
we
do
we,
if
you
see
that
there
is,
if
you
see
that
you
have
the
lines
which
start
from
the
space,
basically
just
glue
it
together
this
previous
line-
and
so
you
always
will
be
able
to
you-
don't
need
to
do
anything
specific
here
if
you
have
more
complex
logic,
for
example,
if
you
know
that
your
lines
always
start
from
the
timestamp,
some
like
that,
you
can
define
that
as
well
in
in
our
application,
and
we
have.
We
have
definitive
age
for
pretty
much.
B
All
of
that,
it's
information
you
can
go
to
our
website
through
our
dogs
and
find
an
information.
How
we
do
that,
like
in
case
of
open
shapes
as
well,
you
can
find
how
we
do
that.
So
it's
like
join
rules.
You
need
to
define
if
it's
rejects
actually
far
more
complex
rules,
so,
for
example,
in
this
example,
this
rule
we
were
automatically
merge.
But
if
you
want
to
get
this
as
one
message,
then
you
actually
will
need
to
define
your
own
rules.
How
to
adjourn
events
together,
hope
this
answers.
The
question.
B
It's
a
good
question
so
on
yes,
it's
a
truly
hard
question
on
this.
One
has
a
lot
of
demos.
How
you
can
use
a
multiple
kids
I
mean
we
don't
use
it
can't
in
our
application,
because
using
a
mallet
toolkit
requires
you
to
have
more
knowledge
of
like
what
you're
trying
to
predict
right
and
I
mean
now
he's.
You
know
how
we
can
apply
to
our
mentoring
solution.
We
can
say
we
can
start
predicting
that.
Maybe
you
don't
get
out
of
resources
bill
in
the
way
how
you
schedule
things
on
your
cluster
right?
B
Maybe
we
can
do
it
here
and
but
the
same
time,
it's
pretty
easy
to
tell
you
is
ultimate
machine
learning
that
you
know
you're
getting
close
to
hitting
the
resource
limit.
So
maybe
you
should
expand.
You
faster
sound
like
that
right,
more
complex
things
around
the
cultures
or
like
web
blogs
that
you
like
you
like,
maybe
if
hard
like,
if
you,
if
you,
for
example,
you
use
your
web
application
that
and
maybe
there's
you
know.
B
Sometimes
apartments
happens
that
the
flow
of
users
can
increase,
like
the
number
of
users
can
increase,
because
maybe
there
are
some
purple
blog
post
published
somewhere
and
then
maybe
there's
like
specific
patterns
where
you
like,
the
the
increase
of
users,
and
you
can
actually
want
to
make
sure
that
you'll
predict
that
and
again,
like
increase
the
capacity
of
your
clusters
to
actually
being
able
to
hold
this.
So
there's
a
lot
of
use
cases.
We
do
not
have
to
use
it
in
our
application
because
it's
it's.
We
need
to
really
wait
it
like
really.
B
B
So,
for
example,
I
know:
there's
a
spotlight
happening
pretty
much
in
every
city,
I
mean
in
all
a
lot
of
cities,
and
so
in
Seattle,
if
you're,
for
example,
in
Seattle
there
will
be
a
spunk
life
in
be
in
Seattle,
so
you
can
probably
find
those
like
as
long
as
calm
and
some
of
the
topics
will
be
about
the
machine
learning
as
well.
So
you
can
see
I,
don't
join
it.
If
you
know
other
City,
please
follow
the
spunk
life
and
there
I
salute
the
free
event.