Zeppelin enables data scientists and senior analysts to create workbooks for junior
analysts that can be used as runbooks for recreatable investigations. These runbooks can be
static, which require no input from the junior analyst, or dynamic, which require the junior
analyst to enter or choose information. You can see an example of a static type of notebook in
the Metron - YAF Telemetry note. This section provides instructions for creating both kinds of
runbooks.
Click Create new note on the welcome page, or click the
Notebook menu and choose + Create new
note.
Type your commands into the blank paragraph in the new note.
To make your runbook dynamic, use one or more of the dynamic forms that Zeppelin
supports:
Text input form
Text input form with default value
Select form
Checkbox form
When you create a note, it appears in the list of notes on the left side of the
home page and in the Notebook menu. By default, Zeppelin
stores notes in the $ZEPPELIN_HOME/notebook folder.
Run your new code by clicking the triangle button in the cell that contains your
code.
Zeppelin attempts to run the code and displays the status near the triangle
button: PENDING, RUNNING, ERROR, or FINISHED. Zeppelin also displays another empty
paragraph so you can add another command.
Continue adding commands until you've completed the runbook.
Choose the appropriate type of visualization for your code results from the
settings toolbar below the code section of the paragraph.
If appropriate, notify the junior analyst about the runbook that he can clone and
use.
The following examples provide sample paragraphs you might want to include in
a runbook:
Top Talkers - Internal
This paragraph is static and requires no input from the
user.
Flows by hour
This paragraph is static and requires no input from the user.