Splunk 8.1 Fundamentals Part 3

Upcoming Classes

Online

Instructor-led online training

Location	Sep 2021	Oct 2021	Dec 2021
AMER Eastern Time - Virtual	Sep 27 – Sep 30	Oct 11 – Oct 14 Oct 11 – Oct 14 Oct 15 – Oct 18
EMEA UK Time - Virtual	Sep 28 – Oct 1	Oct 11 – Oct 14
AMER Pacific Time - Virtual		Oct 4 – Oct 7
EMEA Central European Summer Time - Virtual		Oct 4 – Oct 5 Oct 25 – Oct 26
EMEA Central European Time - Virtual			Dec 20 – Dec 21

Australia

Location	Sep 2021	Oct 2021	Nov 2021	Dec 2021	Jan 2022	Feb 2022	Mar 2022
Ingeniq - Online		Oct 12 – Oct 15

Summary

The Splunk Fundamentals Part 3 course picks up where Splunk Fundamentals Part 2 leaves off, focusing on some more advanced searching and reporting commands as well as on advanced use cases of knowledge objects. Major topics include advanced statistics and eval commands, advanced lookups, advanced alert actions, using regex and erex to extract fields, using spath to work with self-referencing data, creating nested macros and macros with event types, and accelerating reports and data models.

Description

Statistical Commands
eval Command Functions
Lookups
Alert Actions
Extracting Fields at Search Time
Working with Self-Describing Data
Exploring Search Macros
Exploring Acceleration Methods
tsidx Files and tstats Command

Duration

4 Days

Objectives

Module 1 – Exploring Statistical Commands

Performing statistical analysis with functions of the stat command
Using fieldsummary
Using appendpipe
Using eventstats
Using streamstats

Module 2 – Exploring eval Command Functions

Using conversion functions
Using data and time functions
Using string functions
Using comparison and conditional functions
Using informational functions
Using statistical functions
Using mathematical functions

Module 3 – Exploring Lookups

Including and excluding events based on lookup values
Using KV Store, external, and geospatial lookups
Understanding best practices for lookups

Module 4 – Exploring Alerts

Using lookups in alerts
Outputting alert results to a lookup
Logging and indexing searchable alert events

Module 5 – Extracting Fields at Search Time

Using the erex command
Using the rex command
Identifying regex best practices

Module 6 – Working with Self-Describing Data

Using the spath command
Using the eval command with the spath function
Extracting fields from table-formatted events with multikv

Module 7 – Exploring Search Macros

Using nested search macros
Previewing search macros before executing
Using tags and event types in search macros

Module 8 – Using Acceleration Options

Describing acceleration and acceleration methods
Determining how summaries make searches efficient

Module 9 – Report Acceleration

Creating an accelerated report
Searching against an acceleration summary

Module 10 – Summary Indexing

Identifying when to use a summary index
Defining and search against a summary index

Module 11 – datamodel Command & Data Model Acceleration

Exploring data models using the datamodel command
Discerning between ad hoc and persistent data model acceleration

Module 12 – tsidx files and tstats Command

Work with tsidx files using the tstats command
Use tstats command with data models

Prerequisites

Splunk Fundamentals 2

Public Training

Chatswood, NSW

Oct 12 – Oct 15

9:00 AM - 1:30 PM

$ 2000.00 USD

EMEA Central European Time - Virtual

Dec 20 – Dec 21

$ 2000.00 USD

Don't see a date that works for you?

Request Class