Implementing Splunk Data Stream Processor (DSP) (ISDSP)

Target group

This 4-day module is designed for the experienced Splunk
administrators who are new to Splunk DSP.

Course structure

Topic 1 – Introduction to DSP

• Review Splunk deployment options and challenges
• Describe the purpose and value of Splunk DSP
• Understand DSP concepts and terminologies

Topic 2 – Deploying a DSP Cluster

• List DSP core components and system requirements
• List DSP core components and system requirements
• Describe installation options and steps
• Check DSP service status
• Learn to navigate in DSP UI
• Use scloud

Topic 3 – Prepping Sources and Sinks

• Ingest data with DSP REST API service
• Configure DSP source connections for Splunk data
• Configure DSP sink connections for Splunk indexers
• Create Splunk-to Splunk pass-through pipelines

Topic 4 – Building Pipelines – Basics

• Describe the basic elements of a DSP pipeline
• Create data pipelines with the DSP canvas and SPL2
• List DSP pipeline commands
• Use scalar functions to convert data types and schema
• Filter and route data to multiple sinks

Topic 5 – Building Pipelines – Deep Dive

• Manipulate pipeline options:
• Extract
• Transform
• Obfuscate
• Aggregate and conditional trigger

Topic 6 – Working with 3rd party Data Feeds

• Read from and write data to pub-sub systems like Kafka
• List sources supported with the collect service
• Transform data from Kafka and normalize