Splunk Developer Topics
Splunk Development concepts
Introduction to Splunk, Splunk developer roles and responsibilities
Writing Splunk query for search, Autocomplete to build a search, time range, refine search, work with events, identify the contents of search, control a search jobHands-on Exercise – Write a basic search query
Using Fields in Searches
Understand Fields, Use Fields in Search, Use Fields Sidebar, regex field extraction using Field Extractor (FX), delimiter field Extraction using FXHands-on Exercise – Use Fields in Search, Use Fields Sidebar, Use Field Extractor (FX), delimit field Extraction using FX
Saving and Scheduling Searches
Writing Splunk query for search, sharing, saving, scheduling and exporting search resultsHands-on Exercise – Schedule a search, Save a search result, Share and export a search result
Creation of alert, explaining alerts and viewing fired alertsHands-on Exercise – Create an alert, view fired alerts
Describe and Configure Scheduled Reports
Tags and Event Types
Introduction to Tags in Splunk, deploying Tags for Splunk search, understanding event types and utility, generating and implementing event types in SearchHands-on Exercise – Deploy tags for Splunk search, generate and implement event types in Search
Creating and Using Macros
Define Macros, Arguments and Variables in a MacroHands-on Exercise – Define a Macro with arguments and use variables in it
GET, POST, and Search workflow actionsHands-on Exercise – Create GET, POST, and Search workflow
Splunk Search Commands
Search Command study, search practices in general, search pipeline, specify indexes in search, syntax highlighting, autocomplete, search commands like tables, fields, sort, multikv, rename, rex & erexHands-on Exercise – Create search pipeline, specify indexes in search, highlight syntax, use autocomplete feature, use search commands like tables, fields, sort, multikv, rename, rex & erex
Using Top, Rare, Stats CommandsHands-on Exercise – Use Top, Rare, Stats Commands
Using following commands and their functions: addcoltotals, addtotals,top, rare,statsHands-on Exercise – Create reports using following commands and their functions: addcoltotals, addtotals
Mapping and Single Value Commands
iplocation, geostats, geom, addtotals commandsHands-on Exercise – Track ip using iplocation, get geo data using geostats
Splunk Reports & visualizations
Explore the available visualizations, create charts and time charts, omit null values and format resultsHands-on Exercise – Create time charts, omit null values and format results
Analyzing, Calculating and Formatting Results
Calculating and analyzing results, value conversion, roundoff and format values, using eval command, conditional statements, filtering calculated search resultsHands-on Exercise – Calculate and analyze results, perform coversion on a data value, roundoff a numbers, use eval command, write conditional statements,apply filters on calculated search results
Search with Transactions, Report on Transactions, Group events using fields and time, Transaction vs StatsHands-on Exercise – Generate Report on Transactions, Group events using fields and time
Enriching Data with Lookups
Learn about data lookups, example, lookup table, defining and configuring automatic lookup, deploying lookup in reports and searchesHands-on Exercise – Define and configure automatic lookup, deploy lookup in reports and searches
Creating Reports and Dashboards
Creating search charts, reports and dashboards, Editing reports and Dashboard, Adding reports to dashboardHands-on Exercise – Create search charts, reports and dashboards, Edit reports and Dashboard, Add reports to dashboard
Getting started with Parsing
Working with raw data for data extraction, transformation, parsing and previewHands-on Exercise – Extract useful data from raw data, perform transformation, parse different values and preview
Describe Pivot, Relationship between data model and pivot, select a data model object, create a pivot report, instant pivot from a search, add a pivot report to dashboardHands-on Exercise – Select a data model object, create a pivot report, create instant pivot from a search, add a pivot report to dashboard
Common Information Model (CIM) Add-On
What is Splunk CIM, Using the CIM Add-On to normalize dataHands-on Exercise – Use the CIM Add-On to normalize data
Splunk Administration Topics
Overview of Splunk
Introduction to the Splunk 3 tier architecture, understanding the Server settings, control, preferences and licensing, managing & pooling license, setting up alerts, the types & usage of license, the most important components of Splunk tool, the hardware requirements, conditions for installation of Splunk.
Understanding how to install and configure Splunk, index creation, input configuration in standalone server, the search preferences, installing Splunk in the Linux environment, practical administration and architect class.
Splunk Installation in Linux
Installing Splunk in the Linux environment, the various prerequisites, configuration of Splunk in Linux.
Distributed Management Console
Introduction to the Splunk Distributed Management Console, index clustering, forwarder management and distributed search in Splunk environment, providing the right authentication to users, access control.
Introduction to Splunk App
Introducing the Splunk app, developing Splunk apps, managing the Splunk app, the various add-ons in Splunk app, deleting and installing apps from SplunkBase, deploying the various app permissions, deploying the Splunk app, apps on forwarder.
Splunk indexes and users
Understanding the index time configuration file and search time configuration file.
Splunk configuration files
Learning about the index time and search time configuration files in Splunk, installing the forwarders, configuring the output and inputs.conf, managing the Universal Forwarders, additional features of Splunk Universal Forwarder.
Splunk Deployment Management
Deploying the Splunk tool, the Splunk deployment Server, setting up the Splunk deployment environment, deploying the clients grouping in Splunk.
Understanding the Splunk Indexes, the default Splunk Indexes, segregating the Splunk Indexes, learning about Splunk Buckets and Bucket Classification, estimating index storage, creating new index.
User roles and authentication
Understanding the concept of role inheritance, Splunk authentications, native authentications, LDAP authentications.
Splunk Administration Environment
Splunk installation, configuration, data inputs, app management, Splunk important concepts, parsing machine-generated data, search indexer and forwarder.
Basic Production Environment
Introduction to Splunk Configuration Files, Universal Forwarder, Forwarder Management, data management, troubleshooting and monitoring.
Splunk Search Engine
Converting machine-generated data into operational intelligence, setting up Dashboard, Reports and Charts, integrating Search Head Clustering & Indexer Clustering.
Various Splunk Input Methods
Understanding the input methods, deploying scripted, Windows, network and agentless input types, fine-tuning it all.
Splunk User & Index Management
Splunk User authentication and Job Role assignment, learning to manage, monitor and optimize Splunk Indexes.
Machine Data Parsing
Understanding parsing of machine-generated data, manipulation of raw data, previewing and parsing, data field extraction, comparing single line and multi-line events.
Search Scaling and Monitoring
Distributed search concepts, improving search performance, large scale deployment and overcoming execution hurdles, working with Splunk Distributed Management Console for monitoring the entire operation.
Splunk Cluster implementation
Cluster indexing, configuring individual nodes, configuring the cluster behavior, index and search behavior, setting node type to handle different aspects of cluster like master node, peer node and search head.
Splunk Developer Project
Topics : This project gives you hands-on experience in working with the Splunk tool. You will have the data set of employee details in a text file based on which you will create a dashboard and report. Then you will deploy the various Splunk commands to perform row operations, extract certain data fields, edit the event, add tags, search with tag name for event and then save the tag search. Upon completion of this project you will learn to create a searchable repository using data that is captured, correlated and indexed in real time and ultimately visualize it using dashboard, report and alert.
Splunk Administration Project
ProjectType – Field ExtractionTopics : In this project you will learn to extract fields from events using the Splunk field extraction technique. You will gain knowledge in the basics of field extractions, understand the use of field extractor, the field extraction page in Splunk web and field extract configuration in files. Learn about the regular expression and delimiters method of field extraction. Upon completion of the project you will gain expertise in building Splunk dashboard and use the extracted fields data in it to create rich visualizations in an enterprise setup.