This course is designed for Splunk administrators. It covers topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available with Splunk Enterprise

This lab-oriented class is designed to help you gain troubleshooting experience before attending more advanced courses. You will debug a distributed Splunk Enterprise environment using the live system.

This course does not cover the issues surrounding Splunk Cloud, Splunk Clusters, or Splunk premium apps.

Online training is typically structured in 3,4, or 4.5 hour long half-day sessions or 6-hour full-day sessions with an hour-long break for lunch.

• Splunk Troubleshooting Methods and Tools
• Indexing Problems
• Input Configuration Problems
• Deployment Problems
• License, Upgrade, and User Management Problems
• Search Management Problems
• User Search Problems

To be successful, students should have a solid understanding of the following courses:

• Splunk Fundamentals 1
• Splunk Fundamentals 2

OR the following single-subject courses:

Students should also have completed the following courses:

• Understand the Splunk Support Model and its resources
• Identify the best practices for troubleshooting Splunk Enterprise
• List ways to gather useful Splunk diagnostic information
• Use Splunk diagnostic tools
• Identify common Splunk technical issues and solve them

Module 1 – Splunk Troubleshooting Methods and Tools

Module 2 – Indexing Problems

Module 3 – Input Configuration Problems

Module 4 – Deployment and Forwarder Problems

Module 5 – License, Upgrade, and User Management Problems

Module 6 – Search Head Management Problems

Module 7 – User Search Problems