• Here, some of the key advantages of using splunk which will help you in understanding key features of splunk.

• Identify and resolve issues upto 70% faster.
• Reduces costly escalations by upto 90%.
• Splunk change difficult logs to visual graphs and reports resulting simplified analysis,reporting and troubleshooting

• No separate database requirements like oracle or SQL as splunk stores all data in its index
• Supports any format and any amount of data -enables centralized log management

• Simple to implement and scale
• Continually index all of your IT data in real time.
• Automatically search helpful information inserted in your data, therefore you can’t to spot yourself.
• Search your physical and virtual IT infrastructure for virtually something of interest and find results in seconds.
• Save searches and tag helpful information, to create your system smarter.
• Set up alerts to modify the observation of your system for specific continual events.
• Provide analytical reports with interactive charts, graphs, and tables.
• Share saved searches and reports with fellow Splunk users, and distribute their results to team members and project stakeholders via email.
• Design specialised, information-rich views and dashboards that work the wide-ranging desires of your enterprise.

• The application of splunk are Monitoring, Analyzes machines, security and business performance.
• With intuitive analysis features, machine learning, packaged applications and open APIs, Splunk Enterprise is a comfortable environment that scales from focused use cases to an enterprise-wide analytics backbone.

• A Splunk application is not much more than a structured set of configurations and assets help to achieve an end goal of data collection, indexing, and visualization.
• In order to make a valid Splunk application, you must include the ability to navigate. Without navigation in the application, you would be working on an add-on.
• The performance of application can be monitor vendors Dynatrace and Extrahop have developed apps for Splunk software to help the users to visualize their deep-dive application performance data in the event of all other application data like logs, events, infrastructure performance.

• Proxy logs : It’s better for C2 analysis of files, domains, downloads of DLL/EXE files.
• Anti‐virus logs : It’s good for analysis of malware, vulnerabilities of hosts, laptops, servers, monitor for suspicious file paths.
• Server Operating System logs : These logs are good for analysis of server activities such as users, runaway services, security logs.
• Firewall logs : Logs for network traffic of source/destination ip addresses, ports, protocols.
• Mail logs : Logs for inbound/outbound mail for malicious links, targeted recipients, unauthorized file out bound, data loss, bad attachments.
• Custom apps logs : Logs could be analyze for possible buffer overflow, code injection, SQL injection analyses.

• Intrusion Prevention System logs : To alert on signatures firing off, COTS signatures, threat analysis of bad network packets.
• Database logs : It’s can be capture for authorized access to critical data tables, authorized logons, op ports, admin accounts.
• Virtual Private Network(VPN) logs : Capture logs to analyze users coming into network for situational awareness, monitored foreign ip subnets, compliance monitoring of browsers/apps of connected hosts.
• Authentication logs : To monitor authorized/unauthorized users, times of day of connection, how often, logons/logoffs, BIOS analysis.
• Vulnerability Scan Data : Import data about assets, vulnerabilities, patch data, etc.
• Web Application logs : External facing logs to monitor suspicious SQL keywords, text patterns, REGEX for threats coming in through browser.
• DNS logs: To relate IP address what domain in a client level.
• DHCP logs : To monitor what systems are assign what IP address and how long, how often.

• Active Directory/Domain Controller logs : Monitor user accounts for AD admins, privilege accounts, remote access, multiple admins across the domain, new account creation, event ID’s.
• Badge Access logs : Logs to capture to correlate insider threat, situational awareness, correlate data with authentication logs.
• Router/Switch data (net-‐flow) : Capture this critical data source for APT monitoring, network monitoring, data exfiltration, flow analysis are very important data source.
• Packet Capture logs(PCAP): Very difficult data source to capture for Advanced Persistent Threats, packet analysis, deep packet inspection, malware analysis, etc.
• FW + AV : Will help detect and respond to viruses, worm propagation.
• IPS + AV + FW : Detect/alert on network based attacks such as buffer overflow, reconnaissance scans, code injection.
• PROXY : The web based/application layer is a majority attacks to monitor like: cross-site scripting, session hacking, browse redirects.
• AV + PROXY : Monitor/detect/respond to download of bad files, remote code execution…web-based attacks.
• FW + PROXY : Detect outbound data exfiltration, detect potentially misconfig fw rules.
• IPS + FW : Network packet of signature threats to be monitored.
• AD Server : All user/group modifications, deletes, updates for administrators to be monitored.
• AD + PROXY : Monitor/Detect/Alert on post compromise analysis, lateral movement.

• Splunk is a software environment to give search, analyze and event to machine-generated data collect from the websites, applications, sensors,devices etc.,It create for your IT environment and business.
• Splunk is an advanced,scalable and potent technology that system can be stored indexes and searches log files.It also search the machine-generated data to give operational intelligence.
• The below image will help you how to relate Splunk collects data.

• To report real time health condition.
• The patient’s health record and analyze patterns in the Delve deeper.
• When the patient’s health degrades to be Alarms/Alerts for both the doctor and patient.

• It work can be moved as the ‘Google’ for log files.
• Simpler terms to be searched with the use of Search Processing Language (SPL).
• If the Splunk file system to be store the data directly that means it does not require any back-end or any database
• It doesn’t against any single point of failure to be happened.

Some of the additional components that separately and collectively perform the major operations:

• Magic code is used to describe the code which handles the critical task without showing the complexity to present a simple interface.
• Some special characters is called magic code, as single quote( ‘ ), double quote (“), amperson (&) etc. It’s useful for beginner programmer.

• Error handling is the process of catching errors elevated from program and then taking correct action. If you would handle errors then the most common error checking methods given in PHP.
  • die() function
  • Custom errors and error triggers
  • Error reporting

• To write the PHP program you should check all possible error condition before checking and take appropriate action when required.
• The following example without having /tmp/test.xt file and with this file.

<?php
   if(!file_exists("/tmp/test.txt")) {
      die("File not found");
   }else {
      $file = fopen("/tmp/test.txt","r");
      print "Opend file sucessfully";
   }
   // Test of the code here.
?>

• We can write own function to handling any error. PHP provides a framework to define error handling function.
• This function must be able to handle a minimum of two parameters (error level and error message) but can accept up to five parameters (optionally: file, line-number, and the error context)

• These error report levels are the different types of error the user-defined error handler can be used.
• The errors are .E_ERROR, E_WARNING, E_PARSE, E_NOTICE, E_CORE_ERROR, E_CORE_WARNING, E_USER_ERROR, E_USER_WARNING, E_USER_NOTICE, E_STRICT, E_RECOVERABLE_ERROR, E_ALL
• These all errors handle to using set_error_handler function.

• We add a counter in that page.
• When a page load that counter value will increase.
• For storing its previous value we can use session, database etc.