Duration
3 days
Overview
This course focuses more on advanced searching and reporting commands as well as on the creation of knowledge objects. Scenario-based examples and hands-on challenges coach you step-by-step through the creation of complex searches, reports, and charts. Major topics include using transforming commands and visualizations, filtering and formatting results, correlating events, creating knowledge objects, using field aliases and calculated fields, creating tags and event types, using macros, creating workflow actions and data models, and normalizing data with the Common Information Model (CIM).
Course Topics
- Transforming commands and visualization
- Filtering and formatting results
- Correlating events
- Knowledge objects
- Fields (Field aliases, field extractions, calculated fields)
- Tags and event types
- Macros
- Workflow actions
- Data models
- Splunk Common Information Model (CIM)
Module 1: Beyond Search Fundamentals
- Search fundamentals review
- Case sensitivity
- Using the job inspector to view search performance
Module 2: Using Transforming Commands for Visualizations
- Explore data structure requirements
- Explore visualization types
- Create and format charts and timecharts
Module 3: Using Mapping and Single Value Commands
- The iplocation command
- The geostats command
- The geom command
- The addtotals command
Module 4: Filtering and Formatting Results
- The eval command
- Using the search and where commands to filter results
- The fillnull command
Module 5: Correlating Events
- Identify transactions
- Group events using fields
- Group events using fields and time
- Search with transactions
- Report on transactions
- Determine when to use transactions vs. stats
Module 6: Introduction to Knowledge Objects
- Identify naming conventions
- Review permissions
- Manage knowledge objects
Module 7: Creating and Managing Fields
- Perform regex field extractions using the Field Extractor (FX)
- Perform delimiter field extractions using the FX
Module 8: Creating Field Aliases and Calculated Fields
- Describe, create, and use field aliases
- Describe, create, and use calculated fields
Module 9: Creating Tags and Event Types
- Create and use tags
- Describe event types and their uses
- Create an event type
Module 10: Creating and Using Macros
- Describe macros
- Create and use a basic macro
- Define arguments and variables for a macro
- Add and use arguments with a macro
Module 11: Creating and Using Workflow Actions
- Describe the function of GET, POST, and Search workflow actions
- Create a GET workflow action
- Create a POST workflow action
- Create a Search workflow action
Module 12: Creating Data Models
- Describe the relationship between data models and pivot
- Identify data model attributes
- Create a data model
- Use a data model in pivot
Module 13: Using the Common Information Model (CIM) Add-On
- Describe the Splunk CIM
- List the knowledge objects included with the Splunk CIM Add-On
- Use the CIM Add-On to normalize data
Course Plan
The course will be conducted in 3 days with training, labs and quizzes to help learners get to know more about Splunk advanced functionality.
Timeline
Day-1: Advanced searching, transformation, and visualization
- Morning session covers the following modules:
Module 5: Correlating Events
- Afternoon session:
- Covers lab for first 5 modules
Day-2: Event correlation, Knowledge Objects, Field Aliases and Calculated Fields, Tags and Event Types
- Morning session covers the following modules:
Module 9: Creating Tags and Event Types
- Afternoon session:
- Covers lab for next 4 modules
Day-3: CIM, Lookups, Reports and Alerts, Pivot
- Morning session covers the following modules:
Module 13: Using the Common Information Model (CIM) Add-On
- Afternoon session:
- Covers lab for last 4 modules
- 20 MCQs quiz after the course and final review
Programme scope, delivery arrangements and suitability are confirmed during enquiry.