Advanced Searching and Reporting with Splunk 8.1

Advanced Searching and Reporting with Splunk 8.1

Advanced Searching and Reporting with Splunk 8.1

Upcoming Classes

Online

Instructor-led online training

Location Apr 2021 May 2021 Jun 2021 Jul 2021 Aug 2021 Sep 2021 Oct 2021
AMER Eastern Time - Virtual Apr 14 – Apr 16
Apr 28 – Apr 30
 May 5 – May 7
May 19 – May 21
 Jun 2 – Jun 4
Jun 16 – Jun 18
Jun 30 – Jul 2
 Jul 14 – Jul 16
Jul 28 – Jul 30
 Aug 4 – Aug 6
Aug 18 – Aug 20
 Sep 1 – Sep 3
Sep 15 – Sep 17
Sep 29 – Oct 1
 Oct 13 – Oct 15
EMEA UK Time - Virtual Apr 14 – Apr 16
Apr 28 – Apr 30
 May 12 – May 14
 Jun 2 – Jun 4
Jun 23 – Jun 25
 Jul 14 – Jul 16
Jul 28 – Jul 30
 Aug 11 – Aug 13
Aug 25 – Aug 27
 Sep 15 – Sep 17
 Oct 6 – Oct 8
AMER Pacific Time - Virtual Apr 21 – Apr 23
 May 12 – May 14
May 26 – May 28
 Jun 9 – Jun 11
Jun 23 – Jun 25
 Jul 21 – Jul 23
 Aug 11 – Aug 13
Aug 25 – Aug 27
 Sep 8 – Sep 10
Sep 22 – Sep 24
 Oct 6 – Oct 8
APAC Singapore - Virtual May 26 – May 28
 Jul 7 – Jul 9
 Aug 4 – Aug 6
 Oct 6 – Oct 8

Australia

Location Apr 2021 May 2021 Jun 2021 Jul 2021 Aug 2021 Sep 2021 Oct 2021
Ingeniq - Online Apr 14 – Apr 16
 Jun 7 – Jun 9
 Aug 16 – Aug 18

Summary

This 13 hour course supplements the Splunk Fundamentals 3 class. It focuses on more advanced search and reporting commands. Scenario-based examples and hands-on challenges enable users to create robust searches, reports, and charts. Students are coached step by step through complex searches to produce final results. Major topics include optimizing searches, additional charting commands and functions, formatting and calculating results, correlating events, and using combined searches and subsearches.

Description

  • Using Search Efficiently
  • More Search Tuning
  • Manipulating Data
  • Working with Multivalue Fields
  • Manipulating transactions
  • Working with Time
  • Using Subsearches
  • Combining Searches

Duration

3 Days

Objectives

Module 1 – Using Search Efficiently

  • Review search architecture
  • Understand how the components of a bucket (.tsidx an djournal.gz files) are used
  • How bloom filters are used to improve search speed
  • Understand the effect of transforming and streaming commands on search performance

Module 2 – More Search Tuning

  • Understand how segmenters are used in Splunk
  • Use lispy to reduce the number of events read from disk
  • Use TERM directive to force Splunk to search for complete values
  • Understand how search-time and aliased fields affect disk reads

Module 3 – Manipulating Data

  • Divide search results into different groups, based on values in a specified field, using the bin command
  • Regroup fields of search results using untable and xyseries
  • Create a template for performing additional processing on a set of related fields using foreach

Module 4 – Working with Multivalue Fields

  • Use multivalue eval functions to analyze and format data
  • Use the makemv command to convert a single value into a multivalue field
  • Use the mvexpand command to create separate events for each value in a multivalue field

Module 5 – Manipulating Transactions

  • Find events logged before or after a particular event occurs
  • Compare complete vs. incomplete transactions
  • Analyze transactions

Module 6 – Working with Time

  • Use time modifiers
  • Visualize data from two different time periods in one search
  • Search for events using custom time ranges and time windows
  • Display and use relative dates

Module 7 – Using Subsearches

  • Use subsearches to provide filtering and other information to a main search
  • Know when NOT to use subsearches
  • Troubleshoot subsearches

Module 8 – Combining Searches

  • Use the append and appendcols commands (and know the differences)
  • Use join and union (and when not to use them)

 

 

 

 

Prerequisites

  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
  • Splunk Fundamentals 3
  • Highly recommended: at least 6 months experience with the Splunk search language

Onsite Training

For groups of three or more

Request Quote

Public Training

AMER Eastern Time - Virtual

EMEA UK Time - Virtual

Chatswood, NSW

AMER Pacific Time - Virtual

APAC Singapore - Virtual


Don't see a date that works for you?

Request Class

© 2005- Splunk Inc. All rights reserved.
Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © Splunk Inc. All rights reserved.