Splunk 8.0 Fundamentals Part 2

Splunk 8.0 Fundamentals Part 2

Upcoming Classes

Online

Instructor-led online training

Location Apr 2020 May 2020 Jun 2020 Jul 2020 Aug 2020 Sep 2020 Oct 2020
Ingeniq Apr 6 – Apr 9
May 5 – May 8
Jun 1 – Jun 4
AMER Pacific Time - Virtual Apr 7 – Apr 10
Apr 14 – Apr 17
Apr 20 – Apr 23
May 4 – May 7
May 12 – May 15
May 18 – May 21
May 26 – May 29
Jun 1 – Jun 4
Jun 9 – Jun 12
Jun 15 – Jun 18
Jun 22 – Jun 25
Jul 6 – Jul 9
Jul 13 – Jul 16
Jul 21 – Jul 24
Jul 27 – Jul 30
Aug 3 – Aug 6
Aug 11 – Aug 14
Aug 17 – Aug 20
Aug 25 – Aug 28
Aug 31 – Sep 3
Sep 8 – Sep 11
Sep 14 – Sep 17
Sep 21 – Sep 24
Sep 28 – Oct 1
AMER Eastern Time - Virtual Apr 13 – Apr 16
Apr 20 – Apr 23
May 5 – May 8
May 11 – May 14
May 19 – May 22
May 26 – May 29
Jun 1 – Jun 4
Jun 2 – Jun 5
Jun 9 – Jun 12
Jun 15 – Jun 18
Jun 22 – Jun 25
Jul 7 – Jul 10
Jul 13 – Jul 16
Jul 14 – Jul 17
Jul 21 – Jul 24
Jul 28 – Jul 31
Aug 4 – Aug 7
Aug 10 – Aug 13
Aug 18 – Aug 21
Aug 25 – Aug 28
Aug 31 – Sep 3
Sep 1 – Sep 4
Sep 8 – Sep 11
Sep 14 – Sep 17
Sep 21 – Sep 24
Sep 29 – Oct 2
EMEA UK Time - Virtual Apr 14 – Apr 17
Apr 21 – Apr 24
May 4 – May 7
May 11 – May 14
May 18 – May 21
May 26 – May 29
Jun 1 – Jun 4
Jun 8 – Jun 11
Jun 15 – Jun 18
Jun 22 – Jun 25
Jun 29 – Jul 2
Jul 6 – Jul 9
Jul 13 – Jul 16
Jul 20 – Jul 23
Jul 27 – Jul 30
Aug 3 – Aug 6
Aug 4 – Aug 7
Aug 11 – Aug 14
Aug 18 – Aug 21
Sep 1 – Sep 4
Sep 8 – Sep 11
Sep 14 – Sep 17
Sep 15 – Sep 18
Sep 22 – Sep 25
Sep 29 – Oct 2
APAC Singapore - Virtual Apr 21 – Apr 24
May 18 – May 21
Jun 9 – Jun 12
Jun 22 – Jun 25
Jul 6 – Jul 9
Jul 20 – Jul 23
Aug 17 – Aug 20
Sep 8 – Sep 11
Sep 21 – Sep 24

Japan

Location Apr 2020 May 2020 Jun 2020 Jul 2020 Aug 2020 Sep 2020 Oct 2020
Japan Third Party Co.,Ltd. Apr 20 – Apr 22
Jun 17 – Jun 19
Aug 19 – Aug 21

Germany

Location Apr 2020 May 2020 Jun 2020 Jul 2020 Aug 2020 Sep 2020 Oct 2020
Munich Germany (Arrow) May 25 – May 26
Sep 14 – Sep 15

Summary

This course picks up where Splunk Fundamentals Part 1 leaves off, focusing on more advanced searching and reporting commands as well as on the creation of knowledge objects. Scenario-based examples and hands-on challenges coach you step-by-step through the creation of complex searches, reports, and charts. Major topics include using transforming commands and visualizations, filtering and formatting results, correlating events, creating knowledge objects, using field aliases and calculated fields, creating tags and event types, using macros, creating workflow actions and data models, and normalizing data with the Common Interface Model (CIM).

Description

  • Transforming commands and visualization
  • Filtering and formatting Results
  • Correlating events
  • Knowledge objects
  • Fields (Field aliases, field extractions, calculated fields)
  • Tags and event types
  • Macros
  • Workflow actions
  • Data models
  • Splunk Common Information Model (CIM)

Duration

4 Days

Objectives

Module 1 - Introduction

  • Overview of Buttercup Games Inc.
  • Lab environment

Module 2 - Beyond Search Fundamentals

  • Search fundamentals review
  • Case sensitivity
  • Using the job inspector to view search performance

Module 3 - Using Transforming Commands for Visualizations

  • Explore data structure requirements
  • Explore visualization types
  • Create and format charts and timecharts

Module 4 - Using Mapping and Single Value Commands

  • The iplocation command
  • The geostats command
  • The geom command
  • The addtotals command

Module 5 - Filtering and Formatting Results

  • The eval command
  • Using the search and where commands to filter results
  • The filnull command

Module 6 - Correlating Events

  • Identify transactions
  • Group events using fields
  • Group events using fields and time
  • Search with transactions
  • Report on transactions
  • Determine when to use transactions vs. stats

Module 7 - Introduction to Knowledge Objects

  • Identify naming conventions
  • Review permissions
  • Manage knowledge objects

Module 8 - Creating and Managing Fields

  • Perform regex field extractions using the Field Extractor (FX)
  • Perform delimiter field extractions using the FX

Module 9 - Creating Field Aliases and Calculated Fields

  • Describe, create, and use field aliases
  • Describe, create and use calculated fields

Module 10 - Creating Tags and Event Types

  • Create and use tags
  • Describe event types and their uses
  • Create an event type

Module 11 - Creating and Using Macros

  • Describe macros
  • Create and use a basic macro
  • Define arguments and variables for a macro
  • Add and use arguments with a macro

Module 12 - Creating and Using Workflow Actions

  • Describe the function of GET, POST, and Search workflow actions
  • Create a GET workflow action
  • Create a POST workflow action
  • Create a Search workflow action

Module 13 - Creating Data Models

  • Describe the relationship between data models and pivot
  • Identify data model attributes
  • Create a data model
  • Use a data model in pivot

Module 14 - Using the Common Information Model (CIM) Add-On

  • Describe the Splunk CIM
  • List the knowledge objects included with the Splunk CIM Add-On
  • Use the CIM Add-On to normalize data

Prerequisites

Splunk Fundamentals 1

 

Onsite Training

For groups of three or more

Request Quote

Public Training

Ingeniq

AMER Pacific Time - Virtual

AMER Eastern Time - Virtual

EMEA UK Time - Virtual

Tokyo

APAC Singapore - Virtual

Munich


Don't see a date that works for you?

Request Class