Fundamentals 3 - Splunk Courses

Splunk V6 training course, Splunk Fundamentals 3 Training course

page-template-default,page,page-id-16776,page-child,parent-pageid-9404,vcwb,ajax_fade,page_not_loaded,,qode-theme-ver-1.5,wpb-js-composer js-comp-ver-4.3.5,vc_responsive

Splunk Fundamentals 3

This course runs over 4 days and focuses on additional search commands as well as advanced use of knowledge objects. Major topics include advanced statistics and eval commands, advanced lookup topics, advanced alert actions, using regex and erex to extract fields, using spath to work with self-referencing data, creating nested macros and macros with event types, accelerating reports and data models.

Units : 4
Duration : 18 hours over 4 days
Time : 9:00 am – 1:30 pm AEST (GMT +10)
Cost : AUD 2,960.00 ex GST*

*Discounts apply for Splunk Partners.

Course Topics

Advanced Statistical Commands
Advanced eval Commands
Advanced Lookups
Alert Actions
Advanced Field Creation and Management
Working with self-Describing Data and Files
Advanced Macros
Using Acceleration Options

Class Format

Instructor-led lecture with labs. Delivered via virtual classroom or at your site.

Course Prerequisites

Splunk Fundamentals 1
Splunk Fundamentals 2

Course Objectives

Module 1: Exploring Statistical Commands

Performing statistical analysis with functions of the stat command
Using fieldsummary
Using appendpipe
Using eventstats
Using streamstats

Module 2: Exploring eval Command Functions

Using conversion functions
Using data and time functions
Using string functions
Using comparison and conditional functions
Using informational functions
Using statistical functions
Using mathematical functions
Using cryptographic functions

Module 3: Exploring Lookups

Including and excluding events based on lookup values
Using KV Store lookups
Using external lookups
Using geospatial lookups
Using database lookups
Understanding best practices for lookups

Module 4: Exploring Alerts

Referencing lookups in alerts
Outputting alert results to a lookup
Logging and indexing searchable alert events
Using a webhook alert action

Module 5: Advanced Field Creation and Management

Using regex
Using the erex command
Using the rex command
Identifying regex best practices

Module 6: Working with Self-Describing Data and Files

Using the spath command
Using the eval command with the spath function
Extracting fields from table-formatted events with multikv

Module 7: Advanced Search Macros

Using nested search Macros
Previewing search macros before executing
Using Tags and event types in search macros

Module 8: Using Acceleration Options: Reports and Summary Indexing

Using report acceleration
Using Summary indexing

Module 9: Using Acceleration Options: Data Models and tsidx Files

Exploring data models using datamodel command
Using data model acceleration
Working with tsidx files using the tstats command

Audience

Anyone whose role requires them to create complex search queries, advanced data models and reports with Splunk who have limited exposure to regular expressions. Previous attendees have included Consultants, IT Administrators and Business Intelligence/Business Analysts.

Related Certifications

Splunk Core Certified Advanced Power User
Splunk Core Certified Consultant

The instructor was willing to help out with the weird questions and to take time to help everyone thoroughly. As for the content? All the extra details and thorough config. It all helps for the real world.
Reseller

Fundamentals 3 Course Dates