Intro to Splunk

Course structure

Topic 1 – Intro to Splunk

• Splunk components
• Basic Splunk functions

Topic 2 – Using Splunk

• Define Splunk Apps
• Understand Splunk user roles
• Searching & Reporting app
• Splunk Web interface

Topic 3 – Using Search

• Run basic searches
• Set the time range of a search
• Save search results
• Identify the contents of search results
• Work with events
• Share search jobs
• Export search results
• Select search modes
• Control a search job

Topic 4 – Exploring Events

• Refine searches
• Understand timestamps
• Use the events tab to add and remove terms from a search

Topic 5 – Search Processing Language

• Use wildcards to search for multiple terms
• Understand case sensitivity in searches
• Use booleans to include and exclude search criteria
• Use special character with search terms

Topic 6 – What Are Commands?

• Understand the anatomy of Splunk’s search language:
• Search terms
• Commands
• Functions
• Arguments
• Clauses
• Understand bestpractices for writing searches

Topic 7 – What Are Knowledge Objects?

• Identify the five categories of knowledge objects:
• Data interpretation
• Data classification
• Data enrichment
• Data normalization
• Data models
• Understand types of knowledge objects

Topic 8 – Creating Reports and Dashboards

• Save a search as a report
• Edit reports
• Use transforming commands to create visualizations
• Create a dashboard
• Add a report to a dashboard
• Edit a dashboard