Splunk 8.1 Fundamentals Part 3

Splunk 8.1 Fundamentals Part 3

Splunk 8.1 Fundamentals Part 3

Upcoming Classes

Online

Instructor-led online training

Location Mar 2021 Apr 2021 May 2021 Jun 2021 Jul 2021 Aug 2021 Sep 2021
AMER Pacific Time - Virtual Mar 8 – Mar 11
Mar 22 – Mar 25
 Apr 5 – Apr 8
Apr 20 – Apr 23
 May 3 – May 6
May 17 – May 20
 Jun 1 – Jun 4
Jun 21 – Jun 24
 Jul 12 – Jul 15
 Aug 9 – Aug 12
Aug 23 – Aug 26
APAC Singapore - Virtual Mar 9 – Mar 12
 Apr 27 – Apr 30
 Jun 8 – Jun 11
 Jul 27 – Jul 30
 Aug 31 – Sep 3
AMER Eastern Time - Virtual Mar 15 – Mar 18
Mar 22 – Mar 25
Mar 29 – Apr 1
 Apr 12 – Apr 15
Apr 19 – Apr 22
Apr 26 – Apr 29
 May 3 – May 6
May 10 – May 13
May 17 – May 20
 Jun 1 – Jun 4
Jun 7 – Jun 10
Jun 14 – Jun 17
Jun 28 – Jul 1
 Jul 12 – Jul 15
Jul 19 – Jul 22
Jul 26 – Jul 29
 Aug 2 – Aug 5
Aug 16 – Aug 19
Aug 23 – Aug 26
Aug 30 – Sep 2
EMEA UK Time - Virtual Mar 15 – Mar 18
Mar 29 – Apr 1
 Apr 13 – Apr 16
Apr 26 – Apr 29
 May 4 – May 7
May 17 – May 20
 Jun 1 – Jun 4
Jun 14 – Jun 17
Jun 28 – Jul 1
 Jul 13 – Jul 16
Jul 26 – Jul 29
 Aug 3 – Aug 6
Aug 16 – Aug 19
Aug 31 – Sep 3
EMEA Central European Summer Time - Virtual May 3 – May 4

Australia

Location Mar 2021 Apr 2021 May 2021 Jun 2021 Jul 2021 Aug 2021 Sep 2021
Ingeniq - Online Mar 23 – Mar 26
 May 25 – May 28
 Jul 26 – Jul 29

Summary

The Splunk Fundamentals Part 3 course picks up where Splunk Fundamentals Part 2 leaves off, focusing on some more advanced searching and reporting commands as well as on advanced use cases of knowledge objects. Major topics include advanced statistics and eval commands, advanced lookups, advanced alert actions, using regex and erex to extract fields, using spath to work with self-referencing data, creating nested macros and macros with event types, and accelerating reports and data models.

Description

  • Statistical Commands
  • eval Command Functions
  • Lookups
  • Alert Actions
  • Extracting Fields at Search Time
  • Working with Self-Describing Data
  • Exploring Search Macros
  • Exploring Acceleration Methods
  • tsidx Files and tstats Command

Duration

4 Days

Objectives

Module 1 – Exploring Statistical Commands

  • Performing statistical analysis with functions of the stat command
  • Using fieldsummary
  • Using appendpipe
  • Using eventstats
  • Using streamstats

Module 2 – Exploring eval Command Functions

  • Using conversion functions
  • Using data and time functions
  • Using string functions
  • Using comparison and conditional functions
  • Using informational functions
  • Using statistical functions
  • Using mathematical functions

Module 3 – Exploring Lookups

  • Including and excluding events based on lookup values
  • Using KV Store, external, and geospatial lookups
  • Understanding best practices for lookups

Module 4 – Exploring Alerts

  • Using lookups in alerts
  • Outputting alert results to a lookup
  • Logging and indexing searchable alert events

    • Module 5 – Extracting Fields at Search Time

    • Using the erex command
    • Using the rex command
    • Identifying regex best practices

    Module 6 – Working with Self-Describing Data

    • Using the spath command
    • Using the eval command with the spath function
    • Extracting fields from table-formatted events with multikv

    Module 7 – Exploring Search Macros

    • Using nested search macros
    • Previewing search macros before executing
    • Using tags and event types in search macros

    Module 8 – Using Acceleration Options

    • Describing acceleration and acceleration methods
    • Determining how summaries make searches efficient

    Module 9 – Report Acceleration

    • Creating an accelerated report
    • Searching against an acceleration summary

      • Module 10 – Summary Indexing

      • Identifying when to use a summary index
      • Defining and search against a summary index

        • Module 11 – datamodel Command & Data Model Acceleration

        • Exploring data models using the datamodel command
        • Discerning between ad hoc and persistent data model acceleration

          • Module 12 – tsidx files and tstats Command

          • Work with tsidx files using the tstats command
          • Use tstats command with data models

           

Prerequisites

Splunk Fundamentals 2

 

Onsite Training

For groups of three or more

Request Quote

Public Training

AMER Pacific Time - Virtual

APAC Singapore - Virtual

AMER Eastern Time - Virtual

EMEA UK Time - Virtual

Chatswood, NSW

EMEA Central European Summer Time - Virtual


Don't see a date that works for you?

Request Class

Splunk 8.1 Fundamentals Part 3 Ratings

Training Organized
Training Objectives
Training Expectations
Training Curriculum
Training Labs
Training Overall

What do these ratings mean?

© 2005- Splunk Inc. All rights reserved.
Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © Splunk Inc. All rights reserved.