Splunk Certified Administrator and SPL Developer Training
0% Completed
M1 — Splunk Architecture and the Deployment Topology
Forwarders, indexers and search heads and the path an event takes
Reading
Index-time against search-time processing and what each one costs
Reading
The cluster manager, the deployer and the deployment server workflow
Reading
Search head sharding, search head clustering and the manager node
Reading
Indexer replication, search factor and the availability trade-off
Reading
Sizing an index, a bucket and the storage a retention policy needs
Reading
M2 — SPL Foundations: Search, Eval and Filtering
The search bar, timespan syntax and the order the pipeline runs in
Reading
Field extraction with the rex command and a regular expression
Reading
The eval command for calculated fields, concatenation and conditionals
Reading
where, search and the practical difference between the two commands
Reading
Field inclusion, exclusion and the renames that keep a search readable
Reading
Recovering a search from the history and editing it without breaking it
Reading
M3 — Aggregation with Stats and Timechart
stats by with count, sum, avg, dc and the values list functions
Reading
timechart with span settings, the over setting and the other setting
Reading
Binning a time field and bucketing a numeric field for a chart
Reading
streamstats for a running total and a moving average over a stream
Reading
eventstats and transaction for a count per host per time bucket
Reading
Comparing a current window against the previous one in one search
Reading
M4 — Transactions, Joins, Lookups and Subsearches
Building a transaction from a correlation id or a user and a time window
Reading
The append command and a subsearch used as a filter
Reading
Lookup files in CSV and KV Store and the fields they add to a result
Reading
join command types: inner, outer, left and the input order that matters
Reading
Searching a second index with a targeted subsearch and its cost
Reading
Handling a transaction that spans several hosts or services
Reading
M5 — Knowledge Objects and Search Reuse
Saved searches, sharing them and running one on a schedule
Reading
Alerts: scheduled, real-time and the actions each one fires
Reading
Field aliases, tags, event types and the metadata that describes data
Reading
Macros in SPL and the arguments they accept
Reading
Search and reporting apps and the folder structure inside one
Reading
Accelerated searches and the difference between summary and historical data
Reading
M6 — Data Models, Pivots and Dashboards
Data models, dataset definitions and the search that populates them
Reading
Pivot tables: accelerate, drilldown, and the column and row definitions
Reading
Dashboard panel types and the settings behind each one
Reading
Studio and the practical difference between editing and building
Reading
Drilling down from a dashboard panel into the underlying events
Reading
Building a dashboard for an audience and the questions it must answer
Reading
M7 — Administration: Users, Roles and Data Management
Users, roles and the capability model that grants a permission
Reading
Authentication methods and the order in which they are evaluated
Reading
Index and search head management, retention and archiving
Reading
Sourcetype and host based access control on an index
Reading
Deploying an app and a configuration change to a cluster manager
Reading
Monitoring the deployment: indexer queue, search head load and licence use
Reading
M8 — Capstone: Deploy a Splunk Environment and Ship an App
Install a single-host environment and point a forwarder at a log source
Reading
Index the data, set a retention policy and verify the index size
Reading
Write the five searches an on-call engineer would ask for first
Reading
Build a data model with a pivot table over the indexed events
Reading
Publish a dashboard and an app with a saved search and an alert
Reading
Document the deployment, the roles and the exam revision plan
Reading
📞
Enroll Now
Start Your Journey
Fill in your details and our team will get back to you within 24 hours