• Here, some of the key advantages of using splunk which will help you in understanding key features of splunk.

• Identify and resolve issues upto 70% faster.
• Reduces costly escalations by upto 90%.
• Splunk change difficult logs to visual graphs and reports resulting simplified analysis,reporting and troubleshooting

• No separate database requirements like oracle or SQL as splunk stores all data in its index
• Supports any format and any amount of data -enables centralized log management

• Simple to implement and scale
• Continually index all of your IT data in real time.
• Automatically search helpful information inserted in your data, therefore you can’t to spot yourself.
• Search your physical and virtual IT infrastructure for virtually something of interest and find results in seconds.
• Save searches and tag helpful information, to create your system smarter.
• Set up alerts to modify the observation of your system for specific continual events.
• Provide analytical reports with interactive charts, graphs, and tables.
• Share saved searches and reports with fellow Splunk users, and distribute their results to team members and project stakeholders via email.
• Design specialised, information-rich views and dashboards that work the wide-ranging desires of your enterprise.

• The application of splunk are Monitoring, Analyzes machines, security and business performance.
• With intuitive analysis features, machine learning, packaged applications and open APIs, Splunk Enterprise is a comfortable environment that scales from focused use cases to an enterprise-wide analytics backbone.

• A Splunk application is not much more than a structured set of configurations and assets help to achieve an end goal of data collection, indexing, and visualization.
• In order to make a valid Splunk application, you must include the ability to navigate. Without navigation in the application, you would be working on an add-on.
• The performance of application can be monitor vendors Dynatrace and Extrahop have developed apps for Splunk software to help the users to visualize their deep-dive application performance data in the event of all other application data like logs, events, infrastructure performance.

• Proxy logs : It’s better for C2 analysis of files, domains, downloads of DLL/EXE files.
• Anti‐virus logs : It’s good for analysis of malware, vulnerabilities of hosts, laptops, servers, monitor for suspicious file paths.
• Server Operating System logs : These logs are good for analysis of server activities such as users, runaway services, security logs.
• Firewall logs : Logs for network traffic of source/destination ip addresses, ports, protocols.
• Mail logs : Logs for inbound/outbound mail for malicious links, targeted recipients, unauthorized file out bound, data loss, bad attachments.
• Custom apps logs : Logs could be analyze for possible buffer overflow, code injection, SQL injection analyses.

• Intrusion Prevention System logs : To alert on signatures firing off, COTS signatures, threat analysis of bad network packets.
• Database logs : It’s can be capture for authorized access to critical data tables, authorized logons, op ports, admin accounts.
• Virtual Private Network(VPN) logs : Capture logs to analyze users coming into network for situational awareness, monitored foreign ip subnets, compliance monitoring of browsers/apps of connected hosts.
• Authentication logs : To monitor authorized/unauthorized users, times of day of connection, how often, logons/logoffs, BIOS analysis.
• Vulnerability Scan Data : Import data about assets, vulnerabilities, patch data, etc.
• Web Application logs : External facing logs to monitor suspicious SQL keywords, text patterns, REGEX for threats coming in through browser.
• DNS logs: To relate IP address what domain in a client level.
• DHCP logs : To monitor what systems are assign what IP address and how long, how often.

• Active Directory/Domain Controller logs : Monitor user accounts for AD admins, privilege accounts, remote access, multiple admins across the domain, new account creation, event ID’s.
• Badge Access logs : Logs to capture to correlate insider threat, situational awareness, correlate data with authentication logs.
• Router/Switch data (net-‐flow) : Capture this critical data source for APT monitoring, network monitoring, data exfiltration, flow analysis are very important data source.
• Packet Capture logs(PCAP): Very difficult data source to capture for Advanced Persistent Threats, packet analysis, deep packet inspection, malware analysis, etc.
• FW + AV : Will help detect and respond to viruses, worm propagation.
• IPS + AV + FW : Detect/alert on network based attacks such as buffer overflow, reconnaissance scans, code injection.
• PROXY : The web based/application layer is a majority attacks to monitor like: cross-site scripting, session hacking, browse redirects.
• AV + PROXY : Monitor/detect/respond to download of bad files, remote code execution…web-based attacks.
• FW + PROXY : Detect outbound data exfiltration, detect potentially misconfig fw rules.
• IPS + FW : Network packet of signature threats to be monitored.
• AD Server : All user/group modifications, deletes, updates for administrators to be monitored.
• AD + PROXY : Monitor/Detect/Alert on post compromise analysis, lateral movement.

• Splunk is a software environment to give search, analyze and event to machine-generated data collect from the websites, applications, sensors,devices etc.,It create for your IT environment and business.
• Splunk is an advanced,scalable and potent technology that system can be stored indexes and searches log files.It also search the machine-generated data to give operational intelligence.
• The below image will help you how to relate Splunk collects data.

• To report real time health condition.
• The patient’s health record and analyze patterns in the Delve deeper.
• When the patient’s health degrades to be Alarms/Alerts for both the doctor and patient.

• It work can be moved as the ‘Google’ for log files.
• Simpler terms to be searched with the use of Search Processing Language (SPL).
• If the Splunk file system to be store the data directly that means it does not require any back-end or any database
• It doesn’t against any single point of failure to be happened.

Some of the additional components that separately and collectively perform the major operations:

• A task has been executing for longer than the runaway time interval (defined by the ICVR operand on the system initialization table macro, DFHSIT) without giving up control.
• The runaway task condition indicates a possible loop in the application.

• The task is terminated with an AICA transaction dump.

• DFHSRP

• An EXEC CICS command has been issued that is not supported by the EXEC interface program DFHEIP.
• A transaction has issued an EXEC CICS command which is supported in principle by the EXEC interface program DFHEIP, but for which the prerequisite function has not been included in the current CICS start-up.
• A non-CICS command has been issued by an application stub (expansion of a DFHRMCAL macro), and the program DFHERM has detected that the required non-CICS support is not available. For example, an attempt to access DB2 when a DB2CONN resource is not enabled results in this abend.
• An attempt has been made to use remote resources, but the local SYSID has been specified in an EXEC CICS command, or vice versa.
• An attempt has been made to use remote resources, but ISC is not supported.
• An EXEC CICS command contains an invalid AID or CONDITION identifier. This abend indicates that the EXEC CICS command has become corrupted.

• The transaction is abnormally terminated with a CICS transaction dump.

• DFHEIP, DFHEEI

• The TYPE=DSECT assembly is used to produce a series of data structures, collectively called the symbolic map set.
• The output of a TYPE=DSECT assembly is a series of data structures, coded in the source language specified in the LANG option. There is a structure for each map used for input, called the symbolic input map, and one for each map used for output, called the symbolic output map.
• Symbolic map sets are used at compile (assembly) time. You copy them into your program, and they allow you to refer to the fields in the maps by name and to pass the variable data in the form dictated by the physical map set.
• Symbolic map sets are typically stored in the library your installation defines for source code that gets copied into programs. Member names are typically the same as the map set names, but they need not be.
• You need the TYPE=DSECT assembly before you compile or assemble your program. You can defer the TYPE=MAP assembly and link-edit until you are ready to test, because the physical map set is not used until execution time. But, you must do both eventually, many installations provide a cataloged procedure to do this automatically.
• The procedure copies the source file for the map set and processes it once using TYPE=MAP and again using TYPE=DSECT. You also can use the SYSPARM option in your assembler procedure to override the TYPE value in a particular assembly.

• BMS is known as Basic Mapping Support. An application consists of formatted screens which act as a link between the terminal and the CICS programs. For communication to occur between the terminal and the CICS programs, we use CICS terminal input/output services. We use BMS to create screen designs with proper positions and attributes. Following are the functions of BMS,
  • BMS acts as an interface between the terminal and the CICS programs.
  • The design and format of the screen is separate from the logic of application.
  • BMS makes the application hardware independent.

• Value of Eibcalen=0

• In this CICS reserved word we use usually in the subroutine, that say, we are calling a sub-program, and passing some data.
• We don’t know whether data is received or not. So, I am getting some data from the screen passing to first main program and next to sub-program. With this variable we can test it and control the program logic.

EVALUATE TRUE

     IF  EIBCALEN = 0

           EXEC  CICS

           RECEIVE  INTO(WS-RECORD)

           END-EXEC

    END-IF

END-EVALUATE

• And, we can continue writing the code, If EIBCALEN = 1 to throw abend.