• Using Search Efficiently
  
• More Search Tuning
  
• Manipulating Data
  
• Working with Multivalue Fields
  
• Manipulating transactions
  
• Working with Time
  
• Using Subsearches
  
• Combining Searches
  

Module 1 – Using Search Efficiently

• Review search architecture
  
• Understand how the components of a bucket (.tsidx an djournal.gz files) are used
• How bloom filters are used to improve search speed
  
• Understand the effect of transforming and streaming commands on search performance
  

Module 2 – More Search Tuning

• Understand how segmenters are used in Splunk
  
• Use lispy to reduce the number of events read from disk
• Use TERM directive to force Splunk to search for complete values
• Understand how search-time and aliased fields affect disk reads

Module 3 – Manipulating Data

• Divide search results into different groups, based on values in a specified field, using the bin command
• Regroup fields of search results using untable and xyseries
  
• Create a template for performing additional processing on a set of related fields using foreach

Module 4 – Working with Multivalue Fields

• Use multivalue eval functions to analyze and format data
  
• Use the makemv command to convert a single value into a multivalue field
  
• Use the mvexpand command to create separate events for each value in a multivalue field

Module 5 – Manipulating Transactions

• Find events logged before or after a particular event occurs
  
• Compare complete vs. incomplete transactions
  
• Analyze transactions

Module 6 – Working with Time

• Use time modifiers
  
• Visualize data from two different time periods in one search
  
• Search for events using custom time ranges and time windows
  
• Display and use relative dates
  

Module 7 – Using Subsearches

• Use subsearches to provide filtering and other information to a main search
  
• Know when NOT to use subsearches
  
• Troubleshoot subsearches

Module 8 – Combining Searches

• Use the append and appendcols commands (and know the differences)
  
• Use join and union (and when not to use them)

• Splunk Fundamentals 1
• Splunk Fundamentals 2
• Splunk Fundamentals 3
• Highly recommended: at least 6 months experience with the Splunk search language