• Here, some of the key advantages of using splunk which will help you in understanding key features of splunk.

• Identify and resolve issues upto 70% faster.
• Reduces costly escalations by upto 90%.
• Splunk change difficult logs to visual graphs and reports resulting simplified analysis,reporting and troubleshooting

• No separate database requirements like oracle or SQL as splunk stores all data in its index
• Supports any format and any amount of data -enables centralized log management

• Simple to implement and scale
• Continually index all of your IT data in real time.
• Automatically search helpful information inserted in your data, therefore you can’t to spot yourself.
• Search your physical and virtual IT infrastructure for virtually something of interest and find results in seconds.
• Save searches and tag helpful information, to create your system smarter.
• Set up alerts to modify the observation of your system for specific continual events.
• Provide analytical reports with interactive charts, graphs, and tables.
• Share saved searches and reports with fellow Splunk users, and distribute their results to team members and project stakeholders via email.
• Design specialised, information-rich views and dashboards that work the wide-ranging desires of your enterprise.

• The application of splunk are Monitoring, Analyzes machines, security and business performance.
• With intuitive analysis features, machine learning, packaged applications and open APIs, Splunk Enterprise is a comfortable environment that scales from focused use cases to an enterprise-wide analytics backbone.

• A Splunk application is not much more than a structured set of configurations and assets help to achieve an end goal of data collection, indexing, and visualization.
• In order to make a valid Splunk application, you must include the ability to navigate. Without navigation in the application, you would be working on an add-on.
• The performance of application can be monitor vendors Dynatrace and Extrahop have developed apps for Splunk software to help the users to visualize their deep-dive application performance data in the event of all other application data like logs, events, infrastructure performance.

• Proxy logs : It’s better for C2 analysis of files, domains, downloads of DLL/EXE files.
• Anti‐virus logs : It’s good for analysis of malware, vulnerabilities of hosts, laptops, servers, monitor for suspicious file paths.
• Server Operating System logs : These logs are good for analysis of server activities such as users, runaway services, security logs.
• Firewall logs : Logs for network traffic of source/destination ip addresses, ports, protocols.
• Mail logs : Logs for inbound/outbound mail for malicious links, targeted recipients, unauthorized file out bound, data loss, bad attachments.
• Custom apps logs : Logs could be analyze for possible buffer overflow, code injection, SQL injection analyses.

• Intrusion Prevention System logs : To alert on signatures firing off, COTS signatures, threat analysis of bad network packets.
• Database logs : It’s can be capture for authorized access to critical data tables, authorized logons, op ports, admin accounts.
• Virtual Private Network(VPN) logs : Capture logs to analyze users coming into network for situational awareness, monitored foreign ip subnets, compliance monitoring of browsers/apps of connected hosts.
• Authentication logs : To monitor authorized/unauthorized users, times of day of connection, how often, logons/logoffs, BIOS analysis.
• Vulnerability Scan Data : Import data about assets, vulnerabilities, patch data, etc.
• Web Application logs : External facing logs to monitor suspicious SQL keywords, text patterns, REGEX for threats coming in through browser.
• DNS logs: To relate IP address what domain in a client level.
• DHCP logs : To monitor what systems are assign what IP address and how long, how often.

• Active Directory/Domain Controller logs : Monitor user accounts for AD admins, privilege accounts, remote access, multiple admins across the domain, new account creation, event ID’s.
• Badge Access logs : Logs to capture to correlate insider threat, situational awareness, correlate data with authentication logs.
• Router/Switch data (net-‐flow) : Capture this critical data source for APT monitoring, network monitoring, data exfiltration, flow analysis are very important data source.
• Packet Capture logs(PCAP): Very difficult data source to capture for Advanced Persistent Threats, packet analysis, deep packet inspection, malware analysis, etc.
• FW + AV : Will help detect and respond to viruses, worm propagation.
• IPS + AV + FW : Detect/alert on network based attacks such as buffer overflow, reconnaissance scans, code injection.
• PROXY : The web based/application layer is a majority attacks to monitor like: cross-site scripting, session hacking, browse redirects.
• AV + PROXY : Monitor/detect/respond to download of bad files, remote code execution…web-based attacks.
• FW + PROXY : Detect outbound data exfiltration, detect potentially misconfig fw rules.
• IPS + FW : Network packet of signature threats to be monitored.
• AD Server : All user/group modifications, deletes, updates for administrators to be monitored.
• AD + PROXY : Monitor/Detect/Alert on post compromise analysis, lateral movement.

• Splunk is a software environment to give search, analyze and event to machine-generated data collect from the websites, applications, sensors,devices etc.,It create for your IT environment and business.
• Splunk is an advanced,scalable and potent technology that system can be stored indexes and searches log files.It also search the machine-generated data to give operational intelligence.
• The below image will help you how to relate Splunk collects data.

• To report real time health condition.
• The patient’s health record and analyze patterns in the Delve deeper.
• When the patient’s health degrades to be Alarms/Alerts for both the doctor and patient.

• It work can be moved as the ‘Google’ for log files.
• Simpler terms to be searched with the use of Search Processing Language (SPL).
• If the Splunk file system to be store the data directly that means it does not require any back-end or any database
• It doesn’t against any single point of failure to be happened.

Some of the additional components that separately and collectively perform the major operations:

• In Cassandra, a table contain a number of rows.
• Each row is represent by a primary key, also called the row key.
• There are a number of columns in a row but the number of columns can vary in different rows.
• For example, a table contain a one row that have three columns whereas another row in the same table can have 10 columns.
• It is also important to note that in Cassandra, both column names and values have binary types.
• That means column names can have binary values, such as strings, timestamps, or an integer, etc.
• This is different from SQL databases, where each row in a SQL table has a fixed number of columns, and column names can only be text.

• The use of a partition key is to determine the partition in the cluster that stores that row.
• When data is read or written from the cluster, a function called Partitioned.It is used to calculate the hash value of the partition key.
• This hash value is used to calculate the partition in the row.
• For example, rows whose partition key values range from 1000 to 1234 may reside in node A, and rows with partition key values range from 1235 to 2000 may reside in node B.
• If a row having a partition key that contain hash value is 1233 then it will be stored in node A.

• The use of the clustering key is to store row data in a categorize order.
• The arrangement of data is based on columns, which are involved in the clustering key.
• This arrangement makes it well ordered to recover data using the clustering key.

• To make these concepts clear, we will consider to Create a key space with replication strategy ‘SimpleStrategy’ and replication_factor 1.

reate keyspace Students_Details with replication = {‘class’ : ‘SimpleStrategy’, ‘replication_factor’:1};

• Now switch to the students_details keyspace:

use students_details;

• Check the number of tables present in the keyspace:

students_details> desc TABLES;

• We will create a table, student , that contains general information about any student.

create table student (stuid int, avg_marks float, description text, 
                      primary key (stuid));

• Type the following insert statements to enter some data into this table.

insert into student (stuid, avg_marks, description) values (1,25.5,’student 1′);
insert into student (stuid, avg_marks, description) values (2,35.5,’student 2′);

• To view the details just inserted.

• Apache Cassandra is a high-performance provides database to manage large number of data among many commodity servers and then it is highly scalable.
• It is a type of NoSQL database.
• Apache Cassandra can be used for different applications.

• Numerous entertainment and media organisations use Cassandra to observe user activity based on movies, music, albums, artists or other parameters.

• Cassandra is best for heavy write systems .For example, data is logged for each request based on hits in web analytics, by type of browser, traffic sources, position, character, technology, tools, etc.

• Cassandra is used by many social media providers to recognize the data and gives recommendations to their users.

• A very popular use case of Cassandra is to show fast product catalog inputs and lookup, and in retail applications.

• Cassandra serves as the database backbone for countless mobile phone and message providers’ applications.

• Apache Cassandra is a high-performance provides database to manage large number of data among many commodity servers and then it is highly scalable.

• Once you’ve absorbed that the strategy should fit the kind of environment you are placing your cluster in.
• If you want to stay in one region of Amazon web services? You can either set yourself up as one dc per availability zone (AZ), or you can set up your cluster to use one dc and treat the AZs as racks.
• Then you can replicate so that if an AZ goes down you won’t have a system problem, just some downed and unavailable servers.
• If an AZ goes down (or a rack goes down) that all the copies of an important piece of data will be available.
• You also are stuck with latency issues if you want to cross into a different region.
• Your data has to replicate into the new region and if you went ‘simplestrategy’ you are going to have massive traffic trying to keep the database in sync.

• It is a Big Data framework which uses Hadoop Distributed File System to Store the data and MapReduce framework to process that data. Java is used as native language to write MapReduce programs.
• Apache Hbase and Cassandra are both NoSQL databases.
• It does not maintain the strict ACID transactions and require better data modelling to be used effectual.
• Their presentation can be calculated by benchmarking the database using a tool called YCSB(Yahoo Cloud Serving Benchmark).
• Factors examine in benchmarking can be read, write ,read-modify-write latency in executing queries.

• It is a Master -Slave NoSQL database dependent upon Hadoop cluster .
• It is good for Heavy reads and less Write applications

• It is a master less and shared-nothing, ring based architecture which does not depend upon Hadoop framework.
• It is good for Write heavy and less read applications.

• It is a collective processing framework to process the data using a language called Hive Query Language(HQL).
• HQL is a sql wrapper on top of HDFS which protect writing Mapreduce programs in Java.
• Instead one can use SQL like language to do their daily tasks.
• Apache Hive is mainly used for ETL and data warehousing feature in Hadoop.
• The process of hive is to create tables, joins, unions, aggregates etc. It develop visualization reports can be done by Tableau.

• cassandra database , cassandra architecture , learn cassandra , cassandra developer , cassandra data model , apache cassandra data model , cassandra database structure , cassandra data types , cassandra data model example , what is cassandra database , cassandra database design , cassandra database example , apache cassandra database , cassandra database type
• In contrast, using the REST API allows the Java piece to be changed or replaced without having to re-create your input process.
• Another advantage to using an API for writing is that you can queue input requests if there is a surge in usage or incoming requests to handle them as quickly as possible without message loss due to maximum connection limits or other networking issues.
• NoSQL stores are now an mandatory part of any framework, the SMACK stack (Spark, Mesos, Akka, Cassandra and Kafka) is becoming well popular.
• Its demonstrated scalability and its high write throughput create it the perfect partner to manage the flood of time series, IOT and industrial scale streams or financial data.
• This made Apache Cassandra an clear choice as a Connect API in Kafka sink.

• Cassandra is build to manage big data workloads among multiple nodes with no single point of failure.
• Its architecture is depend on the understanding of system and hardware failures can and do exist.
• Cassandra is a row-oriented database.
• Cassandra is build to manage big data.
• Cassandra’s main characteristic is to store data on multiple nodes with no single point of failure.
• The reason for this kind of Cassandra’s architecture was that the hardware failure can happened at any time. Any node can be down.

• Cassandra is build in distributed architecture.In case of failure data stored in another node can be used.
• Cassandra saves data in various nodes with a peer to peer distributed fashion framework.
• All the nodes exchange information with each other using Gossip protocol.
• Gossip is a protocol in Cassandra by which nodes can transfer with each other.

• The four components of the Cassandra Coefficient are
  1. The warning, the threat or risk in question,
  2. the decision makers or audience who must react,
  3. The predictor or possible Cassandra, and
  4. The critics who disparage or reject the warning.

• The Cassandra coefficient is the framework and it offered as a tool and all decision-makers to separate a legitimate warning from a Chicken Little.

• Technical experts in their field,
• Very driven by data,
• First principle/orthogonal thinkers,
• Have a high sense of personal management, and
• Many of them had offputting identity / high tension

• All header information variables become static attached to your primary key.
• Parcel information will become non-static variables.
• Your clustering column will identify each parcel data object.
• This way you should get all parcel information belonging to a header with just one lookup. (There are many examples out there in the web, describing this pattern).
• Generally speaking, it’s never a good idea to build relationships in Cassandra with the use of multiple tables.
• If there’s no way out use data duplication to achieve “single read get’s all” queries.

• A primary index is global, although a secondary index is local.
• To query a users by their secondary indexed value or their email every machine has to query its self target of users.
• One query, five reads from disk.

• Using SQL,after defining a table you can create an index on a column.
• You can also index a collection column.
• Secondary indexes are used to query a table using a column that is not general query table.
• Secondary indexes are difficult to use and can impact performance greatly.

• The index table is stored on every node in a cluster, so a query involving a secondary index if multiple nodes are accessed it can quickly become a performance nightmare.
• A general rule of thumb is to index a column with low cardinality of few data.
• Before creating an index, be aware of when and when not to create an index.

• Cluster is a collection of multiple data centers.

• Cassandra is a distributed database management system designed to handle large amounts of data across many commodity servers.
• Like all other distributed database systems, it provides high availability with no single point of failure.
• Is a machine where Cassandra is running.

• A keyspace in Cassandra is a namespace that defines data replication on nodes.
• A cluster contains one keyspace per node. Given below is the syntax for creating a keyspace using the statement CREATE KEYSPACE.
• It is similar to a database in Relational Database Management System, which is a group of tables, also called column families in Cassandra.