Splunk® Enterprise

Knowledge Manager Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Develop naming conventions for knowledge objects

As a best practice, develop naming conventions for your knowledge objects when it makes sense to do so. If the naming conventions you develop are followed consistently by all of the Splunk users in your organization, you will find that they become easier to use and that their purpose is much easier to discern at a glance.

You can develop naming conventions for just about every kind of knowledge object in your Splunk deployment. Naming conventions can help with object organization, but they can also help users differentiate between groups of reports, event types, and tags that have similar uses. And they can help identify a variety of things about the object that may not even be in the object definition, such as what teams or locations use the object, what technology it involves, and what it is designed to do.

Early development of naming conventions for your Splunk deployment will help you avoid confusion and chaos later on down the road.

Example - Set up a naming convention for reports

You work in the systems engineering group of your company, and as the knowledge manager for your Splunk deployment, it is your job to define a naming convention for the reports produced by your team.

You develop a naming convention that combines:

  • Group: Corresponds to the working group(s) of the user saving the search.
  • Search type: Indicates the type of search (alert, report, summary-index-populating).
  • Platform: Corresponds to the platform subjected to the search.
  • Category: Corresponds to the concern areas for the prevailing platforms.
  • Time interval: The interval over which the search runs (or on which the search runs, if it is a scheduled search).
  • Description: A meaningful description of the context and intent of the search, limited to one or two words if possible. Ensures the search name is unique.


Group Search type Platform Category Time interval Description
SEG
NEG
OPS
NOC
Alert
Report
Summary
Windows
iSeries
Network
Disk
Exchange
SQL
Event log
CPU
Jobs
Subsystems
Services
Security
<arbitrary> <arbitrary>

Possible reports using this naming convention:

  • SEG_Alert_Windows_Eventlog_15m_Failures
  • SEG_Report_iSeries_Jobs_12hr_Failed_Batch
  • NOC_Summary_Network_Security_24hr_Top_src_ip
PREVIOUS
Give knowledge objects of the same type unique names
  NEXT
Understand and use the Common Information Model Add-on

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.6.0, 6.6.1, 6.6.2, 6.6.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters