Splunk Operational Intelligence Training

Syllabus of Splunk Operational Intelligence Training

• Identify the functions and abilities of Splunk
• Identify the types of Splunk licenses and choose what best suits your requirements
• Install Splunk on several Linux platforms
• Install Splunk on Windows systems
• Identify the components of the Splunk user interface
• Use Splunk without administrator access
• Start the Splunk service on multiple operating systems
• Compare Splunk data forwarders
• Add the tutorial sample data to your Splunk install
• Configure data sources for Splunk
• Import data from files and monitor local files and folders
• Change the type of data source used by Splunk to index your data
• Improve Splunk's processing of events
• Configure how Splunk stores the date and time with your data
• Import data from network ports and Splunk forwarders
• Install the universal forwarder in Windows
• Install the universal forwarder in Unix environments
• Implement load balancing on a Splunk forwarder
• Implement data cloning on a Splunk forwarder
• Implement a heavy Splunk forwarder
• Install a Splunk instance

• Prepare to run a search in Splunk
• View the data sources available to you for searching
• Specify a time range for the results of your search
• Navigate the results of your Splunk search
• Control search job progress and mode in Splunk
• Navigate the search result tabs
• Save reports and view saved reports
• Find the saved reports and share them
• Save a search as a dashboard and edit panels in dashboards
• Work with Splunk dashboards
• Add an input to a dashboard
• Describe the data models and objects in Splunk
• Create a new data model in Splunk
• Edit and add model objects and root objects in Splunk
• Add the attributes that were automatically extracted to your Splunk data model object
• Add attributes from lookup tables to your Splunk data model object
• Create child objects under Splunk parent objects
• Recognize the components of the pivot interface
• Create and save a Splunk Pivot
• Create and save a pivot table
• Create a Splunk pivot chart
• Save pivots to the dashboard
• Use the Search features to find data

• Log into and identify Splunk Web Administration components
• Identify the default Splunk dashboards and customize the banner messages
• Add and manage users and roles in Splunk
• Work with Splunk configuration files
• Identify the order in which Splunk applies configuration directives and attributes
• Copy and edit the Splunk configuration files
• Access the Splunk command line interface or CLI
• Utilize the built-in help functions of the Splunk command line interface or CLI
• Administer the remote Splunk deployments using administrative commands
• Start and stop the Splunk service on multiple platforms, and configure Splunk to start at boot
• Change the default values in a Splunk installation and apply a license
• Bind Splunk to an IPv4 and/or IPv6 address
• Upgrade an existing Splunk instance on a Unix or Windows system
• Migrate indexes and data to a new server
• Identify the different types of alerts in Splunk
• Utilize throttling to limit the Splunk alerts and set alert permissions
• Construct per-result and rolling-window alerts in Splunk
• Create scheduled alerts in Splunk
• Edit and expand the functionality of a Splunk alert
• Configure Splunk to send an e-mail during an alert condition
• Configure the alternate alert modes in Splunk
• Construct triggered alerts
• Identify the data performance issues in Splunk
• Identify the other performance issues in Splunk
• Determine the Splunk storage requirements
• Scale a Splunk deployment to meet requirements
• Create users and roles in Splunk

• Access the visualizations of Splunk events
• Create tables from a Splunk search
• Visualize data as bar and line charts in Splunk
• Display data as pie, scatter, and bubble charts
• Utilize the other chart types in Splunk
• Work with visualization drilldown
• Configure visualization on additional chart types
• Define the dynamic drilldown behavior
• Specify the context-driven drilldown behavior
• Configure control features on visualizations
• Access the dashboard editor in Splunk
• Create a Splunk dashboard
• Modify the existing dashboards in Splunk
• Generate PDF reports from Splunk dashboards
• Modify a dashboard by editing simple XML
• Implement searches in simple XML dashboards
• Save the base searches from which to build dashboard searches
• Configure the dynamic drilldowns in charts using simple XML
• Utilize the Splunk tokens in Dashboards using simple XML
• Create charts from Splunk data

• Configure multiple indexes in Splunk
• Remove data that has been indexed or indexes entirely
• Change the location of the Splunk index database
• Configure the size and disk usage of Splunk indexes
• Identify the Splunk backup requirements
• Configure how Splunk handles aged data
• Archive the indexed Splunk data for storage
• Restore previously archived Splunk data
• Describe the steps in deploying indexer clusters
• Enable the Splunk indexer cluster master node
• Enable the Splunk peer nodes
• Configure a Splunk node as a search head
• Configure Splunk to use forwarders with the Indexer Cluster
• Access the dashboard of the Splunk cluster master
• Access the Splunk dashboard of the peers and the search head
• Remove a Splunk peer from operation for maintenance
• Restart a single Splunk node or an entire cluster
• Use the Splunk search command to find events
• Use the data fields to find Splunk events
• Control the indexes used to perform a search and who has access to them
• Utilize the timeline view to analyze Splunk events
• Define the types of events for data classification
• Create Splunk macros to simplify searches
• Create a secondary search on Splunk results
• Use the Splunk patterns tab to identify data patterns
• Manage multiple nodes in Splunk