SPLUNK Admin & Developer

Duration

6 days

Outline

Installing Splunk

• Splunking: What does it Mean
• How Should Splunk be Configured
• Identifying Splunk Instance Types
• Hardware Recommendations ñ Indexers
• Hardware Recommendations ñ Search Heads
• Splunk Install Packages
• Supported Platforms and Browsers
• Splunk Installation
• Splunk Directory Structure
• The Splunk Command Line Interface
• *NIX ñ Run Splunk at Boot
• Splunk Windows Services
• Splunk Processes : Splunkd
• Splunk Processes : Splunk Web
• Apps Installed by Default
• System Settings
• Describing General Settings
• Managing Licenses
• Splunk License Types
• Adding a License
• License Warnings and violations
• What Counts As Daily License Quota
• Viewing Alerts
• License Staking
• Master License Server
• License Pooling
• Adding an Input With Splunk Web
• How can you tell what App you are in
• Adding your Monitor Input
• Preview Data
• Specify the Source
• Select Host, Sourcetype and Index
• Restarting the Server from Splunk Web

License Management

Basic Data Input

Universal Forwarders

Introduction to Splunk's User Interface

• Understand the uses of Splunk
• Define Splunk Apps
• Learn basic navigation in Splunk

Searching

• Run basic searches
• Set the time range of a search
• Identify the contents of search results
• Refine searches
• Use the timeline
• Work with events
• Control a search job
• Save search results

Using Fields in Searches

• Understand fields
• Use fields in searches
• Use the fields sidebar

Creating Reports and Visualizations

• Save a search as a report
• Edit reports
• Create reports that include visualizations such as charts and tables

Using Pivot

• Forwarders and Indexers
• Benefits of Using Forwarders
• Splunk Universal Forwarder
• Heavy Forwarder
• Configuration Steps
• Configuring the Receiving Port
• Downloading the Universal Forwarder Installer
• Installing Universal Forwarder Manually
• Forwarder Configuration Files
• Defining Target Indexer on the Forwarder
• Testing the Connection
• Automatic Load Balancing
• Caching/Queue Size in outputs.conf
• Indexer Acknowledgement
• Configuring Forwarder Inputs
• Describe Pivot
• Understand the relationship between data models and pivot
• Select a data model object
• Create a pivot report
• Create an instant pivot from a search

Working with Dashboards

• Create a dashboard
• Add a reports to a dashboard
• Add a pivot report to a dashboard
• Edit a dashboard

Search Fundamentals

• Review basic search commands and general search practices
• Examine the anatomy of a search
• Use the following commands to perform searches:
• tables
• rename
• fields
• dedup
• sort

Transforming Commands, P1: Deriving Statistics

• Use the following commands and their functions:
• top
• rare
• stats

Transforming Commands, P2: Creating Visualizations

• Data structure requirements
• Create and format basic charts
• Create and format timecharts

Transforming Commands, P3: Enriching Visualizations

• Use the following commands and their functions:
• trendline
• iplocation
• geostats
• geom
• single values
• addtotals

Manipulating and Filtering Results

• Use the following commands and their functions:
• eval
• filnull
• search
• where

Correlating Events

• Identify transactions
• Group events using fields
• Group events using fields and time
• Search with transactions
• Report on transactions
• Determine when to use transactions vs. stats

Implementing Knowledge Objects

• Describe the Common Information Model (CIM)
• Understand the relationship between the CIM and knowledge objects
• Define naming conventions
• Review permissions

Creating Lookups

• Describe lookups
• Create a lookup file and create a lookup definition
• Configure an automatic lookup

Creating Field Aliases and Calculated Fields

• Create and use field aliases
• Create and use calculated fields

Creating Field Extractions

• Perform regex field extractions using the Field Extractor (FX)
• Perform delimiter field extractions using the FX

Creating Tags and Event Types

• Create and use tags
• Describe event types and their uses
• Create an event type

Creating Workflow Actions

• Describe the function of GET, POST, and Search workflow actions
• Create a GET workflow action
• Create a Search workflow action

Creating Alerts and Scheduled Reports

• Describe alerts
• Create alerts
• View fired alerts
• Describe scheduled reports
• Configure scheduled reports

Creating and Using Macros

• Describe macros
• Create and use a basic macro
• Define arguments and variables for a macro
• Add and use arguments with a macro

Creating Data Models

• Describe the relationship between data models and pivot
• Identify data model attributes
• Create a data model
• Use a data model in pivot

Beyond Search Fundamentals

• Use the proper case in searches
• Describe Splunk’s search process
• Use the search inspector to view search performance

Using Sub-Searches

• Use sub-searches to correlate data by finding events that:
• Have matching values for a common field in the results of a sub-search
• Do not have matching values for a common field in the results of a sub-search
• Have matching values for a field with a different name in the results of a sub-search

Using Advanced Statistics

• Use statistical functions such as min, max, mean, median, and standard deviation
• Use the appendpipe command
• Use the streamstats and eventstats commands

Using Data Manipulation, and Filtering

• Use the following commands and functions:
• bin
• xyseries
• foreach
• Filtering commands - search
• Filtering commands - where
• where functions: like, isnull
• eval functions: strftime, upper, case, replace

Using Advanced Charting

• Use the following commands and functions:
• untable
• addtotals
• append and appendcols

Sorting, Searching, and Reformatting Time

• Search for events using custom time ranges
• Search for events within a window of time
• Display and use using relative dates
• Use the return command

Using Advanced Transactions

• Find events logged before a particular event occurs
• Find events logged after a particular event occurs
• Compare complete transactions
• Analyze transactions

Using Advanced Lookups

• Include events based on values in a lookup table
• Exclude events based on values in a lookup table
• Build a baseline lookup table and reference the baseline values in alerts

Introduction to Views

• Define what is a view
• Identify best practices for creating views
• Define the common information model
• Normalize data to the Splunk CIM

Adding Content

• Define data structure requirements
• Identify the primary transforming commands
• Describe methods to improve dashboard performance
• Compare and contrast types of acceleration

Editing XML

• Define the simple XML syntax
• Name categories of panels
• Identify types of panel objects
• Create post-process searches
• Customize charts

Using Tokens

• Identify types of form inputs
• Use tokens and filters
• Create cascading menus
• Create dynamic drilldowns

Customizing Dashboards

• Use simple XML extensions
• Identify types of search managers
• Create custom visualizations
• Explain how autodiscovery works

Introduction to Apps

• Define the web framework architecture
• Identify types of Splunk apps
• Manage apps and add-ons

Planning App Development

• Define types of logging
• Improve app performance
• Identify security best practices
• Setup a test environment

Adding Data

• List types of data inputs
• Explain how monitor, scripted, and modular inputs work
• Describe the advantages of an HTTP Event Collector
• Create a data generator

XML Apps

• Define the simple XML syntax
• Create a simple XML app
• Use simple XML extensions

Using the Splunk REST API

• Explain how the Splunk REST API works
• Define API endpoints
• Create an app setup screen

Packaging Apps

• Create app navigation
• Describe config file precedence
• Define the app directory structure
• Package an app

Overview

• Understand the REST API and Splunk SDKs
• Identify Other Splunk development tools
• Use REST endpoints in simple scripts
• Understand the User/App context

Exploring the REST API and SDKs

• Install the Java SDK
• Install the Python SDK
• Explore SDK packages

Connection and Authentication

• Understand connection and authentication
• Understand the authentication process
• Use authentication tokens for multi-step operations
• Understand connection operations

Object Management

• List Splunk objects
• Create and edit Splunk objects

Basic Searching

• Understand basic search language syntax and search best practices
• Execute a search using the oneshot method
• Retrieve search results and display them on screen

Advanced Searching

• Identify types of searches
• Create normal, export, and real-time searches
• Create and run a saved search

Search Jobs and Results

• Managing jobs
• Traversing large result sets
• Count and Offset management
• Handling real-time jobs
• Managing Alerts

Writing Data to Splunk

• Create and manage indexes
• Identify best practices for writing data
• Use Input classes to add data to indexes
• Use direct input methods to add data to indexes

Creating Modular Inputs

• Describe modular inputs and how they differ from scripted inputs
• Identify data that is a good candidate for a modular input
• Create modular inputs
• List modular input introspection scheme options
• Index input error messages to the Splunk internal index
• Customize the Data Inputs form in Splunk Web Manager for your modular inputs

Programme scope, delivery arrangements and suitability are confirmed during enquiry.