Splunk
Go from data to business outcomes faster than ever before with Splunk
About Splunk
Any Question. Any Data. One Splunk.
Splunk Inc. is an American public multinational corporation based in San Francisco, California, that produces software for searching, monitoring, and analyzing machine-generated big data, via a Web-style interface.
- Real-Time
- Machine Data
- AI and Machine Learning
Splunk Topics
The following are the things covered under Splunk.
Splunk - Environment
Setting up the Splunk environment is very straight forward. In this tutorial we will aim to install the enterprise version.
Splunk - Data Ingestion
Data ingestion in Splunk happens through the Add Data feature which is part of the search & reporting app.
Splunk - Field Searching
When Splunk reads the uploaded machine data, it interprets the data and divides it into many fields which represent a single logical fact about the entire data record.
Splunk - Sharing Exporting
When you run a search query the result is stored as a job in the Splunk server. While this job was created by one specific user, it can be shared across with other users so that they can start using this result set without the necessity of building the query for it again.
Splunk - Pivot and Datasets
Splunk can ingest many kinds of data sources and build tables which are similar to relational tables. Theses are called table dataset or just tables.
Splunk - Sparklines
A sparkline is a small representation of some statistical information without showing the axes. It generally appears as a line with bumps just to indicate how certain quantity has changed over a period of time.
Course Contents
The following are the course contents offered for Splunk
- Splunking: What does it Mean
- How Should Splunk be Configured
- Identifying Splunk Instance Types
- Hardware Recommendations ñ Indexers
- Hardware Recommendations ñ Search Heads
- Splunk Install Packages
- Supported Platforms and Browsers
- Splunk Installation
- Splunk Directory Structure
- The Splunk Command Line Interface
- *NIX ñ Run Splunk at Boot
- Splunk Windows Services
- Splunk Processes : Splunkd
- Splunk Processes : Splunk Web
- Apps Installed by Default
- System Settings
- Describing General Settings
- Restarting the Server from Splunk Web
- Managing Licenses
- Splunk License Types
- Adding a License
- Adding an Input With Splunk Web
- How can you tell what App you are in
- Adding your Monitor Input
- Preview Data
- Specify the Source
- Select Host
- Forwarders and Indexers
- Benefits of Using Forwarders
- Splunk Universal Forwarder
- Heavy Forwarder
- Configuration Steps
- Configuring the Receiving Port
- Downloading the Universal Forwarder Installer
- Installing Universal Forwarder Manually
- Forwarder Configuration Files
- Defining Target Indexer on the Forwarder
- Understand the uses of Splunk
- Define Splunk Apps
- Learn basic navigation in Splunk
- Run basic searches
- Set the time range of a search
- Identify the contents of search results
- Refine searches
- Use the timeline
- Work with events
- Control a search job
- Save search results
- Understand fields
- Use fields in searches
- Use the fields sidebar
- Save a search as a report
- Edit reports
- Create reports that include visualizations such as charts and tables
- Describe Pivot
- Understand the relationship between data models and pivot
- Select a data model object
- Create a pivot report
- Create an instant pivot from a search
- Create a dashboard
- Add a reports to a dashboard
- Add a pivot report to a dashboard
- Edit a dashboard
- Review basic search commands and general search practices
- Examine the anatomy of a search
- Use the following commands to perform searches:
- tables
- rename
- fields
- dedup
- sort
- Use the following commands and their functions:
- top
- rare
- stats
- Data structure requirements
- Create and format basic charts
- Create and format timecharts
- Use the following commands and their functions:
- trendline
- iplocation
- geostats
- geom
- single values
- addtotals
- Use the following commands and their functions:
- eval
- filnull
- search
- where
- Identify transactions
- Group events using fields
- Group events using fields and time
- Describe lookups
- Create a lookup file and create a lookup definition
- Configure an automatic lookup
- Create and use field aliases
- Create and use calculated fields
- Perform regex field extractions using the Field Extractor (FX)
- Perform delimiter field extractions using the FX
- Create and use tags
- Describe event types and their uses
- Create an event type
- Describe the function of GET
- Create a GET workflow action
- Create a Search workflow action
- Describe alerts
- Create alerts
- View fired alerts
- Describe scheduled reports
- Configure scheduled reports
- Describe macros
- Create and use a basic macro
- Define arguments and variables for a macro
- Add and use arguments with a macro
- Describe the relationship between data models and pivot
- Identify data model attributes
- Create a data model
- Use a data model in pivot
- Use the proper case in searches
- Describe Splunk’s search process
- Use the search inspector tview search performance
- Use sub-searches tcorrelate data by finding events that:
- Have matching values for a common field in the results of a sub-search
- Dnot have matching values for a common field in the results of a sub-search
- Have matching values for a field with a different name in the results of a subsearch
- Use statistical functions such as min
- Use the appendpipe command
- Use the streamstats and eventstats commands
- Use the following commands and functions:
- bin
- xyseries
- foreach
- Filtering commands - search
- Filtering commands - where
- where functions: like
- eval functions: strftime
- Use the following commands and functions:
- untable
- addtotals
- append and appendcols
- Search for events using custom time ranges
- Search for events within a window of time
- Display and use using relative dates
- Use the return command
- Include events based on values in a lookup table
- Exclude events based on values in a lookup table
- Build a baseline lookup table and reference the baseline values in alerts
- Define what is a view
- Identify best practices for creating views
- Define the common information model
- Normalize data tthe Splunk CIM
- Define data structure requirements
- Identify the primary transforming commands
- Describe methods timprove dashboard performance
- Compare and contrast types of acceleration
- Define the simple XML syntax
- Name categories of panels
- Identify types of panel objects
- Create post-process searches
- Customize charts
- Identify types of form inputs
- Use tokens and filters
- Use simple XML extensions
- Identify types of search managers
- Create custom visualizations
- Explain how autodiscovery works
- Define the web framework architecture
- Identify types of Splunk apps
- Manage apps and add-ons
- Define types of logging
- Improve app performance
- Identify security best practices
- Setup a test environment
- List types of data inputs
- Explain how monitor
- Describe the advantages of an HTTP Event Collector
- Create a data generator
- Define the simple XML syntax
- Create a simple XML app
- Use simple XML extensions
- Explain how the Splunk REST API works
- Define API endpoints
- Create an app setup screen
- Create app navigation
- Describe config file precedence
- Define the app directory structure
- Package an app
- Understand the REST API and Splunk SDKs
- Identify Other Splunk development tools
- Use REST endpoints in simple scripts
- Understand the User/App context
- Connection and Authentication
- Basic Searching
- Understand basic search language syntax and search best practices
- Execute a search using the oneshot method
- Retrieve search results and display them on screen
- Identify types of searches
- Create normal
- Create and run a saved search
- Managing jobs
- Traversing large result sets
- Count and Offset management
- Handling real-time jobs
- Managing Alerts
- Create and manage indexes
- Identify best practices for writing data
- Use Input classes to add data to indexes
- Use direct input methods to add data to indexes
- Describe modular inputs and how they differ from scripted inputs
- Identify data that is a good candidate for a modular input
- Create modular inputs
Download
Download Splunk course plan