This two-day Splunk Fundamentals Level 2 course builds directly on our foundational Level 1 course, taking you deeper into Splunk's powerful features and capabilities. The course emphasizes practical techniques for capturing and indexing data, which enables you to generate sophisticated graphs, detailed reports, automated alerts, comprehensive dashboards, and compelling visualizations.
Prerequisites:
Participants should have completed the Splunk Fundamentals Level 1 course or possess equivalent hands-on practical experience using Splunk in a business environment.
Course Outline
Introduction and Review
- Splunk Enterprise core features and capabilities
- Advanced Splunk Enterprise features and functionality
- Search functionality review and best practices
- The search pipeline architecture
- Different search modes and when to use each
- Search optimization and best practices
Getting Data into Splunk
- Configuring data inputs
- Indexing files and directory structures
- Indexing Windows Event Logs for system monitoring
- Getting data through network ports and protocols
- Configuring scripted inputs for automated data collection
- Setting up and configuring Universal Forwarders
- Using the HTTP Event Collector (HEC) for data ingestion
- Extracting database data using DB Connect
- Regular expressions, including rex and regex commands for field extraction
- Adding structure and meaningful context to raw data
Building an Operational Intelligence Application
- Understanding application architecture patterns
- Organizing app folder structures
- Creating new applications from existing templates
- Adding assets and resources to applications
- Creating, customizing, and optimizing reports and dashboards
- Integrating geographical maps into visualizations
- Using range highlighting to emphasize data patterns
- Configuring automated PDF report delivery
Advanced Query Techniques
- The search command and its variations
- The where command for filtering and conditional logic
- The eval command for calculations and transformations
- The fields command for data selection
- The fillnull command for handling missing values
- Statistical functions, including SUM, AVG, MIN, MAX, COUNT, and others
- The join command for combining datasets
- The trendline command for time-based trend analysis
Advanced Analytics and Machine Learning
- Applying linear regression to time-series data
- Leveraging the Machine Learning Toolkit
- Detecting anomalies in your data
- Identifying clusters and patterns
- Recognizing and flagging outliers
- Forecasting future trends in time-series data
Optimizing Splunk Performance
- Implementing summary indexing for performance improvement
- Backfilling summary indexes with historical data
- Accelerating reports for faster query execution
