The Splunk Interface - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 22

The options are organized into logical groupings, as follows:
• Apps : This interface allows you to easily add new apps and manage apps that
are currently installed. If you installed the ImplementingSplunkDataGenerator
app, you have already seen this interface.
• Knowledge : Each of the links under Knowledge allows you to control one of
the many object types that are used at search time. The following screenshot
shows an example of one object type, workflow actions.
Let's cover the administration of each object type that we will cover in later chapters:
• System : The options under this section control system-wide settings.
° System settings covers network settings, the default location to
store indexes, outbound e-mail server settings, and how much
data Splunk logs about itself
° Server controls contains a single page that lets you restart Splunk
from the web interface
° Licensing lets you add license files or configure Splunk as a slave
to a Splunk license server
• Data : This section is where you manage data flow.
° Data Inputs : Splunk can receive data by reading files (either in batch
mode or in real time), listening to network ports, or running scripts
• Forwarding and receiving : Splunk instances don't typically stand
alone. Most installations consist of at least one Splunk indexer and
many Splunk forwarders. Using this interface, you can configure each
side of this relationship and more complicated setups (we will discuss
this in a more detail in Chapter 11 , Advanced Deployments ):