Mastering Splunk Paperback – Illustrated, December 17, 2014

Here is my first complaint: for $45, I expect at least some of the diagrams to be in color. Instead, the publisher has a download site where you can get a color PDF of the diagrams. Annoying, particularly when the author writes "If you haven't noticed, I have used the color attribute..." No, it didn't really show up in the black-and-white diagram!!The book tries to provide some high-level context for Splunk, but it is uneven. By page 7, the book discusses using a single Splunk server vs. multiple servers, but has built no foundation for this discussion. I often found myself saying: "true, but why do I care?" Other than a scattering of screenshots, the book has few illustrations (so maybe color isn't so important). The discussion also seems jumpy, as if the author has a number of facts about Splunk without having an organized way of presenting them. This made the topics harder to understand, even though most topics are treated superficially (e.g., sizing the Splunk installation). Even the detailed topics, like searching, start with a discussion of tags before even the most simple search is introduced.I found some of the examples simplistic; most were not well-explained. Other examples illustrate poor Splunk usage, particularly around subsearches. Complex topics such as macros are introduced way too early and with little explanation. There are typos in some of the examples.If you know Splunk, you won't learn anything new from this book. If you don't know Splunk, I don't know how you will achieve any of the items listed on the back of the book as "what you will learn from this book."Another reviewer said that this book had a chapter on the Splunk documentation. It does not, but you could certainly look at the free tutorials, videos and online documentation at splunk.com, and save your money.

THIS BOOK IS HORRIBLE! ITS HAS A CHAPTER ON SPLUNK DOCUMENTATION WTF!!!!!!

Enjoyed this.