This course　is designed for system administrators and administrators who are responsible :

• for managing the Splunk Enterprise environment. The course provides the fundamental

knowledge of Splunk license manager, indexers and search heads. It covers configuration,

management, and monitoring core Splunk Enterprise components.

• for getting data into Splunk Indexers. The course provides the fundamental knowledge of Splunk forwarders and methods to get remote data into Splunk indexers. It covers installation, configuration, management, monitoring, and troubleshooting of Splunk forwarders and Splunk Deployment Server components.

ONLY for customers with Splunk on-prem

Splunk Enterprise System Administration

Module 1 -　　Splunk Server Deployment

• Provide an overview of Splunk
• Identify Splunk Enterprise components

Module 2 -　　Splunk Server Monitoring

Module 3 -　　Splunk Apps

Module 4 - Splunk Configuration Files

Module 5 - Splunk Indexes

Module 6 -　Splunk Index Management

Module 7 -　Splunk User Management

Module 8 -　Configuring Basic Forwarding

• Identify forwarder configuration steps
• Configure a Universal Forwarder
• Understand the Deployment Server

Module 9 -　Distributed Search

Splunk Enterprise Data Administration

Module 1 -Introduction to Data Administration

Module 2 - Getting Data In - Staging

Module 3 - Configuring Forwarders

Module 4 - Forwarder Management

Module 5 - Monitor Inputs

Module 6 - Network and Scripted Inputs

Module 7 - Agentless Inputs

• Create a basic scripted input

Module 8 - Fine Tuning Inputs

Module 9 - Parsing Phase and Data

Module 10 - Manipulating Raw Data

Module 11 - Supporting Knowledge Objects

Module 12 - Creating a Diag

• Mask or delete raw data as it is being indexed
• Override sourcetype or host based upon event values
• Route events to specific indexes based on event content
• Prevent unwanted events from being indexed

Module 13 - Supporting Knowledge Objects

To be successful, students should have a solid understanding of the following courses :

Or the following single-subject courses:

System Administration

Splunk Deployment Overview

License Management

Splunk Apps

Splunk Configuration Files

Users, Roles, and Authentication

Getting Data In

Distributed Search

Data Administration

Understand sourcetypes

Manage and deploy forwarders

Configure data inputs

Fire monitors

Network inputs (TCP/UDP)

Scripted inputs

HTTP inputs (via the HTTP Event Collector)

Customize the input phase parsing process

Define transformations to modify data before indexing

Define search time knowledge object configurations

Splunk Enterprise Certified Admin (Prereq for this cert is the: Splunk Core Certified Power User)

NOTE: Make sure to complete a module within a 4 hour time range, do not start a module one day and then end the next day)

Network Secu

Data Intelligence AI

Cloud