The Splunk Fundamentals Part 3 course picks up where Splunk Fundamentals Part 2 leaves off, focusing on some more advanced searching and reporting commands as well as on advanced use cases of knowledge objects. Major topics include advanced statistics and eval commands, advanced lookup topics, advanced alert actions, using regex and erex to extract fields, using spath to work with self-referencing data, creating nested macros and macros with event types, and accelerating reports and data models.

This nine hour course provides Splunk users in-depth information about metrics, ingesting and searching metrics data, and how to use the Analytics Workspace to analyze and create visualizations.

This 2-virtual day course is designed for Splunk administrators. It covers topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available on Splunk Enterprise 8.0.1

This lab-oriented class is designed to help you gain troubleshooting experience before attending more advanced courses. You will debug a distributed Splunk Enterprise environment using the live system.

This course does not cover the issues surrounding Splunk Cloud, Splunk Clusters, or Splunk premium apps.

This 3-day (12-hour) hands-on course prepares administrators to manage users and get data in Splunk Cloud. Topics include data inputs and forwarder configuration, data management, user accounts, and basic monitoring and problem isolation. The focus in this class is the knowledge, best practices, and configuration details for Splunk Cloud.
*Search head clustered deployment topics will NOT be covered in this class.

This 13.5 hour course prepares architects and systems administrators to install, configure and manage Splunk Enterprise Security. It covers ES event processing and normalization, deployment requirements, technology add-ons, settings, risk analysis settings, threat intelligence and protocol intelligence configuration, and customizations.

This 13.5-hour course prepares security practitioners to use Splunk Enterprise Security (ES). Students identify and track incidents, analyze security risks, use predictive analytics, and discover threats.

This 1.5 hour course prepares Splunk administrators to install and configure Splunk’s App for Infrastructure (SAI). Students will learn to configure and use SAI to monitor critical IT services. Topics include SAI requirements, deployment planning, installation, configuring services and entities, and configuring alert events.

This 13.5 hour course is intended for experienced Phantom consultants who will be responsible for complex Phantom solution development, and will prepare the attendee to integrate Phantom with Splunk as well as develop playbooks requiring custom coding and REST API usage.
Potential attendees have received a passing grade in all prerequisite courses, and should ensure they can devote all of their attention to the class, as the course work is very challenging. Students will develop a custom solution with Phantom, Splunk and custom Python code. The labs provide requirements for the solution; the student must plan and execute the development. This will require thoughtful focus, experimentation and problem-solving skills.

This 9 hour course prepares IT and security practitioners to install, configure and use Phantom in their environment and will prepare developers to attend the playbook development course.

This 9 hour course prepares IT and security practitioners to plan, design, create and debug playbooks for Phantom.