Description:

• Value Journey for Splunk is a solution to help jumpstart a new Splunker's journey with Splunk by mapping their Use Case and learning goals of Splunk with aligned Walkthroughs, Knowledge Content, and Example Reports/Dashboards of Splunk Value.
• The Value Journey Manager for Splunk application is for the Splunk Admins, "Owners", who will be preparing the Value Journey for Splunk application for the New Splunkers. Use the below Installation steps as a review only, and the VJM - Getting Started dashboard to perform the actual installation steps.
  Important: This solution consist of two separate, required, applications: Value Journey for Splunk, which is the application Users will use for their Value Journey. The Value Journey Manager for Splunk application is for Splunk Admins, Owners, where they will configure, manage and support the Users as they progress through their Value Journey for Splunk application.

Overview of the Installation and Configuration Steps:

Description: Below are the preperation Steps that need to be completed with the Value Journey Manager for Splunk application before the Users will be able to use the Value Journey for Splunk application:
(Important Note: The location for where the steps will be completed depend on your Splunk environment, Splunk Cloud or Splunk Enterprise)

• Step 1: Install the Value Journey for Splunk and Value Journey Manager for Splunk applications

  Description: The first step is to install both the Value Journey for Splunk and Value Journey Manager for Splunk applications on the Splunk Search Head.*

• Step 2: Create the required Sample Data index, verify/update Eventtype (vj_index) definition and (vj_user/vj_admin) Roles

  Description: Value Journey for Splunk leverages indexed sample data loaded by the Value Journey Manager for Splunk application. This section will walk you through creating the index that will hold the sample data and if needed, updating the Eventtype (vj_index) and the Roles (vj_user/vj_admin).

• Step 3: Load or verify the Value Journey Sample Data

  Description: This step will walk you through the initial enabling of the VJSampleData Modular Input, which is used to load the sample data leveraged by the example Walkthroughs, Reports and Dashboards

• Step 4: Create Initial Owner and User Accounts

  Description: Value Journey for Splunk leverages Splunk Lookups and Splunk Roles for determining who is the Owner of the Value Journey solution, and who are the Users. You will use the VJM - User Creation dashboard to create the actual Splunk Admin/Users in the required format and ensure the information is added to the required lookups. NOTE: You will also use this dashboard if the Splunk Admin/Users already exist, because the user account will only be added to the appropriate Role and lookup tables if it is a current Splunk User.

• Step 5: Review User usage, and any requests for assistance.

  Description: After the above preparation steps have been completed, and Users have started their Value Journey Owners can leverage the dashboards/reports available in the Value Journey Manager for Splunk application to ensure that the Users are successfully progressing through the walkthroughs, reports, dashboards, and review any Request for Assistance.

Splunk Components - Application Deployment - Requirements/Options:

Below is a simple outline of where the Value Journey applications need to be installed depending on the Splunk Environment (Splunk Cloud/Enterprise).

• Splunk Cloud:

  • Splunk Cloud Search Head (Required):
    • Value Journey for Splunk
    • Value Journey Manager for Splunk
  • Loading Sample Data (Required): The Value Journey Manager for Splunk application needs to be additionally installed on either of the following Splunk instances
    • Option 1: Splunk Cloud IDM instance
    • Option 2: On-Premise Splunk Heavy Forwarder instance

• Splunk Enterprise (On-Premise):

  • Search Head (Required):
    • Value Journey for Splunk
    • Value Journey Manager for Splunk
  • Loading Sample Data (Required):
    • Option 1: Splunk Heavy Forwarder:
      • You can leverage a Splunk Heavy Forwarder to load the Sample Data on a schedule basis. Just install the Value Journey Manager for Splunk application on this instance and follow guided steps in the VJM - Getting Started dashboard.
    • Option 2: Splunk Search Head or Single Splunk Instance:
      • You can leverage a Splunk Search Head/Indexer to load the Sample Data on a schedule basis, although this is not recommended for production environments as a best practice. Just install the Value Journey Manager for Splunk application on this instance and follow guided steps in the VJM - Getting Started dashboard.

Value Journey Solution – Installation Step Details:

Below are the specific steps that you will be guided through using the VJM - Getting Started dashboard. Use the following information as a guidance only, the Getting Started dashboard will walk you through the preperation steps based off the instance where the steps are being performed.
Note: If you are going to use the Splunk Cloud IDM instance for loading the sample data, instead of an on-premise Heavy Forwarder, then you can use the outlined steps in section Step 3 - Option 1: Use the Splunk Cloud IDM (Inputs Data Manager) to load Sample Data:” below for opening a Splunk Cloud Support request to have the Value Journey Manager for Splunk installed on the IDM instance.
Note: The following steps will use the legend below for the type of instance(s) the step will be performed on, depending on your Splunk Environment or selected options:

Step 1 - ( SH ) - Install Value Journey applications :
- Description: Install both the Value Journey for Splunk and Value Journey Manager for Splunk applications on the Splunk Search Head.

• 1.1 Open the Application Management view.
• 1.2 Click the Browse More Apps button.
• 1.3 Type in the Search box, Value Journey
• 1.4 Click the Install button on the Value Journey Manager for Splunk application (Repeat these steps for the Value Journey for Splunk application.)

Step 2 - ( Cloud SH or Enterprise Indexer ) - Create the Sample Data Index :
- Description: This section will walk you through creating the index that will hold the sample data used by the Value Journey for Splunk application. Note: if you plan to use a different index name than vj_ex , you will perform the Extra Steps for updating the Eventtype (vj_index) and Roles (vj_user/vj_admin).

• 2.1 In the Splunk UI, navigate to the Settings - - > Indexes

• 2.2 Click New Index and use one of the below Index Options for the new index settings:

  • Index Option 1 - Recommended - Create new index with vj_ex as the name:
    • Index Name\: vj_ex
    • Max Size of Entire Index\: 2 GB
    • Skip to Step 3 after saving new index
  • Index Option 2: Create a new index with a name that is different than vj_ex\:
    • Index Name\: Enter your custom index name
    • Max Size of Entire Index\: 2 GB
    • Complete the Extra Steps 2.3-2.9 after saving the new index

• Extra Steps for Index Option 2 Only - ( Important Perform these steps on the SH Only ):

  • 2.3 Update the Eventtype (vj_index), by navigating in the Splunk UI to Settings - - > Eventtypes and searching for vj_index
  • 2.4 Change the search string From index=vj_ex To index=custom_index, replaceing custom_index with the index name created in step 2.2
  • 2.5 Click Save
  • 2.6 Update the Roles (vj_user & vj_admin) by navigating to Settings - - > Access Control - - > Roles
  • 2.7 Click vj_user Role and then click Indexes
  • 2.8 Check Included and Default boxes for the index name created in step 2.2.
  • 2.9 Click Save (Repeat 2.7-2.9 Steps for the vj_admin role)

Step 3 - ( IDM or HF ) - Load Value Journey Sample Data :
- Description: The Value Journey for Splunk application leverages sample data for its example reports, dashboards and interactive Walkthroughs. Choose one of the options below for loading this required sample data, depending on your Splunk Environment and preference. - Note: Data Inputs are not allowed on a Splunk Cloud Search Head, so use one of the below options to load the required Sample Data.

• Option 1 - (IDM) - Use Splunk Cloud IDM (Inputs Data Manager) to load the Sample Data :
  - Description: If your Splunk Cloud environment has a Splunk Cloud IDM (Inputs Data Manager) instance and you want to use it for loading the Sample Data, then follow the below steps: :

  • 3.1 Opening a Splunk Support Request to have the Value Journey Manager for Splunk installed on the IDM instance.
    • 3.1.1 Login to your Splunk Support Portal and click the Submit a New Case button.
    • 3.1.2 Use the below values for populating the request fields\:
      • From the Splunk installation is?: Select the state of your deployment.
      • Subject: Enter IDM - Deployment of Value Journey Manager for Splunk (appid: 4566)
      • What Product are you having trouble with?: Enter Splunk Cloud
      • In What OS are you using?: Leave blank
      • In I need help with: Select Installation - Splunk Cloud
      • Business Priority: Select S4
      • Case Priority: Select P4
      • In the Problem Description: Enter Request for Installation of the application Value Journey Manager for Splunk (appid: 4566) on our Splunk Cloud IDM Instance
    • 3.1.3 Click Submit
      • The portal directs you to a screen with a case number and sends you an email containing the case number.
      • Proceed to step 3.2 when you are notified by Cloud Support that the Value Journey Manager for Splunk application has been installed on the Splunk Cloud IDM instance.
  • 3.2 After the Value Journey Manager for Splunk app has been installed on the IDM instance, follow the below steps to enable the VJSampleData (LoadSampleData) modular input:
    • 3.2.1 Login to the IDM's Splunk UI
    • 3.2.2 Navigate to Settings - - > Data Inputs
    • 3.2.3 Click on the VJSampleData input link
      • Extra Steps - Custom Index Name: If you created an index with a name different than vj_ex in Step 2 above then complete the following additional sub-steps:
        • 3.2.3.1 Click on the LoadSampleData preconfigured Input link
        • 3.2.3.2 Click on the More Settings checkbox and select the created sample index from the Index drop down.
        • 3.2.3.2 Click Save
    • 3.2.4 Click the Enable link for the LoadSampleData input.
    • After Enabling the LoadSampleData input, and waiting about 2minutes, you can referesh the page to see the status of the first data load.

• Option 2 - ( HF ) - Use an On-Premise Splunk Heavy Forwarder to load the Sample Data :
  - Description: Install Value Journey Manager for Splunk app on the Splunk Heavy Forwarder and enable VJSampleData modular input:

  • 3.1 Login to the Splunk UI on the Splunk Heavy Forwarder
  • 3.2 Click on the Apps menu dropdown and select Manage Apps
  • 3.3 Click the Browse For More Apps button.
  • 3.4 In the Search box type Value Journey Manager and click Enter
  • 3.5 Click the Install button for the Value Journey Manager for Splunk application.
  • 3.6 After installation has completed, navigate to Settings - - > Data Inputs.
  • 3.7 Click on the VJSampleData input link
    • Extra Steps - Custom Index Name: If you created an index with a name different than vj_ex in Step 2 above then complete the following additional sub-steps:
      • 3.7.1 Click on the LoadSampleData preconfigured Input link
      • 3.7.2 Click on the More Settings checkbox and select the created sample index from the Index drop down.
      • 3.7.2 Click Save
  • 3.8 Click the Enable link for the LoadSampleData input.
  • After Enabling the LoadSampleData input, and waiting about 2minutes, you can referesh the page to see the status of the first data load.

Step 4 - ( SH ) - Create Value Journey Owner and User Accounts :
- Description: Value Journey for Splunk leverages Splunk Lookups and Splunk Roles for determining who is the Owner of the Value Journey solution, and who are the Users. In order to populate the lookup table with the correct information, and to create the actual Splunk Users in the required format, you will use the VJM - User Creation dashboard to do this
- Note: At least one Admin/Owner Account and one User is required for the Value Journey solution.
- Note: Complete the following steps even if the target Owner/User account already exist, so the account will be added to the required lookups and roles.

• 4.1 Enter Company, Initial Password and Splunk Owner Information:
  • 4.1.1 Enter the Company Name and Default Password for new Admin/User accounts that will be created.
    • Note: If using an existing Splunk User account for the Owner or User, then the password will not be changed.
  • 4.1.2 Enter the admin’s information (ie Name, Email, Login):
  • 4.1.3 Click the Create Owner button.
    • Note: You can create multiple Admin/Owner accounts by repeating this step
    • Note: After the Admin/Owner account has been created, they will automatically receive an email with their login credentials.
• 4.2 Enter New User Contact Information:
  • 4.2.1 Enter in the new, or existing, “Value Journey” users information (ie Name, Email, Login,etc)
  • 4.2.2 Click the Create User button.
    • Note: You can create multiple User accounts by repeating this step
• 4.3 Email Settings for Sending "Getting Started" Information:
  • Optionally send an email to the Owner, or User with the created User Account credentials and getting started steps.