Splunk Architect Master's

Writing Splunk query for search, auto-complete to build a search, time range, refine search, working with events, identifying the contents of search and controlling a search job

Hands-on Exercise – Write a basic search query

What is a Field, how to use Fields in search, deploying Fields Sidebar and Field Extractor for REGEX field extraction and delimiting Field Extraction using FX

Hands-on Exercise – Use Fields in Search, use Fields Sidebar, use Field Extractor (FX) and delimit field Extraction using FX

Writing Splunk query for search, sharing, saving, scheduling and exporting search results

Hands-on Exercise – Schedule a search, save a search result and share and export a search result

How to create alerts, understanding alerts and viewing fired alerts.

Hands-on Exercise –Create an alert in Splunk and view the fired alerts

Describe and configure scheduled reports

Introduction to Tags in Splunk, deploying Tags for Splunk search, understanding event types and utility and generating and implementing event types in search

Hands-on Exercise – Deploy tags for Splunk search and generate and implement event types in search

What is a Macro and what are variables and arguments in Macros

Hands-on Exercise –First, you define a Macro with arguments and then use variables with in it

Creating get, post and search workflow actions

Hands-on Exercise – Create get, post and search workflow actions

Studying the search command, the general search practices, what is a search pipeline, how to specify indexes in search, highlighting the syntax and deploying the various search commands like fields, tables, sort, rename, rex and erex

Hands-on Exercise –Steps to create a search pipeline, search index specification, how to highlight syntax, using the auto complete feature and deploying the various search commands like sort, fields, tables, rename, rex and erex

Using top, rare and stats commands

Hands-on Exercise – Use top, rare and stats commands

Using following commands and their functions: addcoltotals, addtotals,top, rare and stats

Hands-on Exercise – Create reports using following commands and their functions: addcoltotals and addtotals

iplocation, geostats, geom and addtotals commands

Hands-on Exercise – Track IP using iplocation and get geo data using geostats

Explore the available visualizations, create charts and time charts, omit null values and format results

Hands-on Exercise – Create time charts, omit null values and format results

Calculating and analyzing results, value conversion, roundoff and format values, using the eval command, conditional statements and filtering calculated search results

Hands-on Exercise – Calculate and analyze results, perform conversion on a data value, roundoff numbers, use the eval command, write conditional statements and apply filters on calculated search results

How to search the transactions, creating report on transactions, grouping events using time and fields and comparing transactions with stats

Hands-on Exercise – Generate report on transactions and group events using fields and time

Learning data lookups, examples and lookup tables, defining and configuring automatic lookups and deploying lookups in reports and searches

Hands-on Exercise – Define and configure automatic lookups and deploy lookups in reports and searches

Creating search charts, reports and dashboards, editing reports and dashboards and adding reports to dashboards

Hands-on Exercise – Create search charts, reports and dashboards, edit reports and dashboards andadd reports to dashboards

Working with raw data for data extraction, transformation, parsing and preview

Hands-on Exercise – Extract useful data from raw data, perform transformation and parse different values and preview

Describe pivot, relationship between data model and pivot, select a data model object, create a pivot report, create in stant pivot from a search and add a pivot report to dashboard

Hands-on Exercise – Select a data model object, create a pivot report, create instant pivot from a search and add a pivot report to dashboard

What is a Splunk CIM and using the CIM Add-On to normalize data

Hands-on Exercise – Use the CIM Add-On to normalize data

Introduction to the architecture of Splunk, various server settings, how to set up alerts, various types of licenses, important features of Splunk tool, the requirements of hardware and conditions needed for installation of Splunk

How to install and configure Splunk, the creation of index, standalone server’s input configuration, the preferences for search, Linux environment Splunk installation and the administering and architecting of Splunk

How to install Splunk in the Linux environment, the conditions needed for Splunk and configuring Splunk in the Linux environment

Introducing Splunk distributed management console, indexing of clusters,how to deploy distributed search in Splunk environment, forwarder management, user authentication and access control

Introduction to the Splunk app, how to develop Splunk apps, Splunk app management, Splunk app add-ons, using Splunk-base for installation and deletion of apps, different app permissions and implementation and how to use the Splunk app and apps on forwarder

Details of the index time configuration file and the search time configuration file

Understanding of Index time and search time configuration filesin Splunk, forwarder installation, input and output configuration, Universal Forwarder management and Splunk Universal Forwarder highlights

Implementing the Splunk tool, deploying it on the server, Splunk environment setup and Splunk client group deployment

Understanding the Splunk Indexes, the default Splunk Indexes, segregating the Splunk Indexes, learning Splunk Buckets and Bucket Classification, estimating Index storage and creating new Index

Understanding the concept of role inheritance, Splunk authentications, native authentications and LDAP authentications

Splunk installation, configuration, data inputs, app management, Splunk important concepts, parsing machine-generated data, search indexer and forwarder

Introduction to Splunk Configuration Files, Universal Forwarder, Forwarder Management, data management, troubleshooting and monitoring

Converting machine-generated data into operational intelligence, setting up the dashboard, reports and charts and integrating Search Head Clustering and Indexer Clustering

Understanding the input methods, deploying scripted, Windows and network and agentless input types and fine-tuning them all

Splunk user authentication and job role assignment and learning to manage, monitor and optimize Splunk Indexes

Understanding parsing of machine-generated data, manipulation of raw data, previewing and parsing, data field extraction and comparing single-line and multi-line events

Distributed search concepts, improving search performance, large-scale deployment and overcoming execution hurdles and working with Splunk Distributed Management Console for monitoring the entire operation

Cluster indexing, configuring individual nodes, configuring the cluster behavior, index and search behavior, setting node type to handle different aspects of cluster like master node, peer node and search head