Splunk 9.0 Cluster Administration

Splunk 9.0 Cluster Administration

Splunk 9.0 Cluster Administration

Upcoming Classes

Online

Instructor-led online training

Location Feb 2023 Mar 2023 Apr 2023 May 2023 Jun 2023 Jul 2023 Aug 2023
APAC Sydney - Virtual Feb 15 – Feb 17
AMER Pacific Time - Virtual Feb 15 – Feb 17
 Mar 1 – Mar 3
Mar 15 – Mar 17
Mar 29 – Mar 31
 Apr 12 – Apr 14
Apr 26 – Apr 28
AMER Eastern Time - Virtual Feb 15 – Feb 17
Feb 22 – Feb 24
 Mar 1 – Mar 3
Mar 8 – Mar 10
Mar 15 – Mar 17
Mar 22 – Mar 24
Mar 29 – Mar 31
 Apr 5 – Apr 7
Apr 12 – Apr 14
Apr 19 – Apr 21
Apr 26 – Apr 28
 May 1 – May 3
APAC Singapore - Virtual Mar 6 – Mar 8
Mar 27 – Mar 29
 Apr 17 – Apr 19
 May 8 – May 10
EMEA UK Time - Virtual Mar 8 – Mar 10
Mar 15 – Mar 17
Mar 22 – Mar 24
Mar 29 – Mar 31
 Apr 3 – Apr 5
Apr 19 – Apr 21
Apr 26 – Apr 28

Summary

This 3-virtual day course is for an experienced Splunk Enterprise administrator who is new to Splunk Clusters. The course provides the fundamental knowledge of deploying and managing Splunk Enterprise in a clustered environment. It covers installation, configuration, management, and monitoring of Splunk clusters. While Splunk Clusters are supported in Windows environments, the class lab environment is running Linux instances only.

Description

  • Large-scale Splunk Deployment Overview
  • Single-site Indexer Cluster
  • Indexer Cluster Management and Administration
  • Forwarder Configuration
  • Search Head Cluster
  • Search Head Cluster Management and Administration
  • KV Store Collection and Lookup Management
  • SmartStore Implementation Overview

Duration

3 Days

Objectives

Module 1 – Splunk Troubleshooting Methods and Tools

  • Deployment Design Factors
  • How Splunk Enterprise can scale
  • Splunk License Master
  • Splunk 9.0 Security

Module 2 – Single-site Indexer Cluster

  • How Splunk Single-Site Indexer Clusters Work
  • Indexer Cluster Components and Terms
  • Splunk single-site Indexer Cluster Configuration
  • Splunk Indexer Cluster Log Channels

Module 3 – Multisite Indexer Cluster

  • How Splunk Multisite Indexer Clusters Work
  • Multisite Indexer Cluster Terms
  • Multisite Indexer Cluster Configuration
  • Optional Multisite Indexer Cluster Configurations

Module 4 – Indexer Cluster Management and Administration

  • Peer Offline and Decommission
  • Master App Bundles
  • Indexer Cluster Storage Utilization Options
  • Site Mapping
  • Monitoring Console for Indexer Cluster Environment
  • Cluster Manager Redundancy

Module 5 – Forwarder Management

  • Indexer Discovery
  • Optional Indexer Discovery Configurations
  • Volume-Based Forwarder Load Balancing

Module 6 – Search Head Cluster

  • Search Head Cluster Architecture
  • Search Head Cluster Configuration
  • Captaincy Identification and Cluster Status
  • Search Head Cluster Settings

Module 7 – Search Head Cluster Management

  • Search Head Cluster Deployer
  • Captaincy Transfer
  • Search Head Member Addition and Decommissioning
  • Monitoring Console for Search Head Cluster

Module 8 – KV Store Collection and Lookup Management

  • KV Store Collection in Splunk Clusters
  • KV Store Monitoring with Monitoring Console

Module 9 – Introduction to Smart Store

  • SmartStore Deployment Use Cases
  • SmartStore Architecture Overview
  • Enable SmartStore in Indexer Cluster
  • Monitor SmartStore Status

Prerequisites

To be successful, students should have a solid understanding of the following courses:
  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
OR the following single-subject courses:
  • What Is Splunk?
  • Intro to Splunk
  • Using Fields
  • Scheduling Reports and Alerts
  • Visualizations
  • Leveraging Lookups and Subsearches
  • Search Under the Hood
  • Introduction to Knowledge Objects
  • Creating Knowledge Objects
  • Enriching Data with Lookups
  • Data Models
  • Introduction to Dashboards
Students should also have completed the following courses:
  • Splunk System Administration
  • Splunk Data Administration
  • Troubleshooting Splunk Enterprise

Onsite Training

For groups of three or more

Request Quote

Public Training

APAC Sydney - Virtual

AMER Pacific Time - Virtual

AMER Eastern Time - Virtual

APAC Singapore - Virtual

EMEA UK Time - Virtual


Don't see a date that works for you?

Request Class

Sitemap
Privacy
Website Terms of Use
Splunk Licensing Terms
Export Control
Modern Slavery Statement
Splunk Patents

© 2005- Splunk Inc. All rights reserved.

Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.