Fundamentals 3 - Splunk Courses
Splunk V6 training course, Splunk Fundamentals 3 Training course
page-template-default,page,page-id-16776,page-child,parent-pageid-9404,vcwb,ajax_fade,page_not_loaded,,qode-theme-ver-1.5,wpb-js-composer js-comp-ver-4.3.5,vc_responsive

Splunk Fundamentals 3

This course runs over 4 days and focuses on additional search commands as well as advanced use of knowledge objects. Major topics include advanced statistics and eval commands, advanced lookup topics, advanced alert actions, using regex and erex to extract fields, using spath to work with self-referencing data, creating nested macros and macros with event types, accelerating reports and data models.

Units : 4
Duration : 18 hours over 4 days
Time : 9:00 am – 1:30 pm AEST (GMT +10)
Cost : AUD 2,960.00 ex GST*

*Discounts apply for Splunk Partners.

Course Topics
  • Advanced Statistical Commands
  • Advanced eval Commands
  • Advanced Lookups
  • Alert Actions
  • Advanced Field Creation and Management
  • Working with self-Describing Data and Files
  • Advanced Macros
  • Using Acceleration Options
Class Format

Instructor-led lecture with labs. Delivered via virtual classroom or at your site.


Course Prerequisites
  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
Course Objectives

Module 1: Exploring Statistical Commands

  • Performing statistical analysis with functions of the stat command
  • Using fieldsummary
  • Using appendpipe
  • Using eventstats
  • Using streamstats

Module 2: Exploring eval Command Functions

  • Using conversion functions
  • Using data and time functions
  • Using string functions
  • Using comparison and conditional functions
  • Using informational functions
  • Using statistical functions
  • Using mathematical functions
  • Using cryptographic functions

Module 3:  Exploring Lookups

  • Including and excluding events based on lookup values
  • Using KV Store lookups
  • Using external lookups
  • Using geospatial lookups
  • Using database lookups
  • Understanding best practices for lookups

Module 4: Exploring Alerts

  • Referencing lookups in alerts
  • Outputting alert results to a lookup
  • Logging and indexing searchable alert events
  • Using a webhook alert action

Module 5: Advanced Field Creation and Management

  • Using regex
  • Using the erex command
  • Using the rex command
  • Identifying regex best practices

Module 6: Working with Self-Describing Data and Files

  • Using the spath command
  • Using the eval command with the spath function
  • Extracting fields from table-formatted events with multikv

Module 7:  Advanced Search Macros

  • Using nested search Macros
  • Previewing search macros before executing
  • Using Tags and event types in search macros

Module 8: Using Acceleration Options: Reports and Summary Indexing

  • Using report acceleration
  • Using Summary indexing

Module 9:  Using Acceleration Options: Data Models and tsidx Files

  • Exploring data models using datamodel command
  • Using data model acceleration
  • Working with tsidx files using the tstats command

Anyone whose role requires them to create complex search queries, advanced data models and reports with Splunk who have limited exposure to regular expressions. Previous attendees have included Consultants, IT Administrators and Business Intelligence/Business Analysts.

Related Certifications

Fundamentals 3 Course Dates

Splunk Fundamentals 3 – 3-6 November

This course runs over 4 days and focuses on additional search commands as well as advanced use of knowledge objects.…

Training Calendar