Splunk Training Provider Authorised Learning Partner Australia

Splunk Cloud Administration

This 18-hour (4 day) hands-on Splunk Cloud Administration course prepares administrators to manage users and get data in Splunk Cloud. Modules include data inputs and forwarder configuration, data management, user accounts, and basic monitoring and problem isolation.

Splunk Cloud Administration course provides administrators with the skills, knowledge and best practices for data management and system configuration for data collection and ingestion in a Splunk Cloud environment to maintain a productive Splunk SaaS deployment.

Splunk Credit Value : 200

Duration : 18 hours over 4 days

Time : 9:00 am - 1:30 pm AEST

*Course discounts apply for Splunk Partners. Please use the currency convertor above to check for course pricing in your local currency.

The instructor was very responsive to questions and queries both private and Communal.. Final module collaborative lab walkthrough on screen was particularly helpful.

Participant, Splunk Fundamentals 2

Splunk Cloud Administration - Course Topics

Splunk Cloud overview
User Authentication and Authorization
Index Management and Data Retention
Splunk configuration files
Cloud Ingestion – Using Splunk forwarders
Forwarder management
Data inputs in detail
Cloud Ingestion – Use API, Scripted, HEC and Applications
Event Parsing with data preview
Manipulating raw data
Installing and managing applications
Problem isolation and working with Splunk Cloud support

Class Format

Instructor-led lecture with labs. Delivered via virtual classroom or at your site

Course Prerequisites

Splunk Fundamentals 1 (Required)

Splunk Fundamentals 2 (Strongly Recommended)

OR, complete the Single Subject Courses

What is Splunk?
Intro to Splunk
Using Fields
Introduction to Knowledge Objects
Creating Knowledge Objects
Creating Field Extractions

Splunk Cloud Administration - Audience

Splunk Partners having a Professional Services Practice
Splunk Cloud Customers

Related Certifications

Splunk Cloud Certified Admin

After completing Splunk Cloud Administration course you will be able to

Deploy and manage on premise components for data collection
Create and configure indexes in Splunk Cloud including archiving and restoration.
Manage data and input configuration using OnPrem and Cloud IDM
Manage Apps and Configs in Splunk Cloud

Splunk Cloud Administration - Course Objectives

Module 1 -Splunk Cloud Overview

Describe Cloud topology
Describe tasks managed by the Splunk cloud administrator
List the primary differences between Splunk Cloud and Splunk Enterprise
List differences between Self-Service Cloud and Managed Cloud

Module 2 - Index Management

Define a Splunk Index
Create indexes in cloud
Delete data from an index
Monitor indexing activities

Module 3 - User Authentication and Authorization

Administer Splunk user roles
Integrate Splunk with LDAP, Active Directory, or SAML

Module 4 -Splunk Configuration Files

Review Splunk configuration files and directories
Review configuration file precedence
Review index and search time processes

Module 5 – Cloud Ingestion – Using Splunk Forwarders

Review cloud ingestion strategies
Understand the role of forwarders in GDI
Configure forwarding to Splunk Cloud
Monitoring forwarder connectivity
Explore optional forwarder settings

Module 6 – Forwarder Management

Describe Splunk Deployment Server
Explain the use of forwarder management
Configure forwarders to be deployment clients
Managing forwarders using deployment apps

Module 7 – Monitor Inputs

Describe the Splunk process for inputting data
Create file and directory monitor inputs
Use optional settings for monitor inputs

Module 8 – Cloud Ingestion – Using API, Scripted and HEC Inputs

Understand how data is ingested using API
Know how to deploy scripted inputs
Describe how to use HEC for ingestion

Module 9 – Cloud Ingestion – Application Based Inputs

Understand how inputs are managed using in apps or add-ons
Describe how customers may use Splunk Stream app
Deploy Cloud inputs for use on an IDM

Module 10 – Fine-tuning Inputs

Describe the default processing that occurs during the input phase
Configure input phase options, such as source type fine-tuning and character set encoding

Module 11 – Parsing Phase and Data Preview

Describe the default processing that occurs during parsing
Optimize and configure event line breaking
Explain how timestamps and time zones are extracted or assigned to events
Use Data Preview to validate event creation during the parsing phase

Module 12 – Manipulating Raw Data

Explain how data transformations are defined and invoked
Use transformations with props.conf and transforms.conf to modify raw data
Use SECCMD to modify raw data

Module 13 – Installing and Managing Apps

Understand how apps and add-ons are vetted and installed in Cloud
Create apps to managing and distribute configurations

Module 14 – Splunk Cloud Support and Troubleshooting

Troubleshooting Splunk Deployments
Collecting data and use diagnostics or monitoring to investigate
Overview of how to collect the relevant data for support to troubleshoot

Splunk Course Schedules and Timezones

Ingeniq Course are delivered live and in English and provide access to customers spanning multiple timezones.

Dates and times displayed for each course are relative to Australian Eastern Time (AET).

AM Marked Splunk Courses

AM marked courses start at AET 9:00am and finish at AET 1:30pm and are optimal for customers in the following countries and areas;

UTC+10 including Australia (East Coast)
UCT+11/+12 including New Zealand and the Pacific Islands
UTC-8 including USA (West Coast), Canada (West Coast)
UTC-7 including USA (Mid West)

PM Marked Splunk Courses

PM marked courses usually starts at AEDT 12:00pm or AEST 11:00 am and are optimal for customers in the following countries and areas;

UTC+10 including Australia (East Coast)
UCT+11/+12 including New Zealand and the Pacific Islands
UTC-8 including USA (West Coast), Canada (West Coast)
UTC-7 including USA (Mid West)