Summary

That wraps up Chapter 1! We've covered what Splunk is and why it's great, you got a free copy of Splunk installed on your laptop so that you can experiment freely with its files and features, and most importantly, started building a basic mental model of how Splunk works and introduced the key concepts around getting data in, parsed, and indexed. We also performed a basic search and got familiar with events and their four key fields. Finally, we covered all the resources that are available to expand your knowledge of Splunk far beyond what can be covered in a Quick Start guide.

In the next chapter, we'll go into the details of designing and implementing a Splunk Enterprise environment from scratch!