This 9-hour course is designed for Splunk administrators. It covers topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available with Splunk Enterprise

This lab-oriented class is designed to help you gain troubleshooting experience before attending more advanced courses. You will debug a distributed Splunk Enterprise environment using the live system.

This course does not cover the issues surrounding Splunk Cloud, Splunk Clusters, or Splunk premium apps.

• Splunk Troubleshooting Methods and Tools
• Indexing Problems
• Input Configuration Problems
• Deployment Problems
• License, Upgrade, and User Management Problems
• Search Management Problems
• User Search Problems

To be successful, students should have a solid understanding of the following courses:

• Splunk Fundamentals 1
• Splunk Fundamentals 2

OR the following single-subject courses:

Students should also have completed the following courses:

• Understand the Splunk Support Model and its resources
• Identify the best practices for troubleshooting Splunk Enterprise
• List ways to gather useful Splunk diagnostic information
• Use Splunk diagnostic tools
• Identify common Splunk technical issues and solve them

Module 1 – Splunk Troubleshooting Methods and Tools

Module 2 – Indexing Problems

Module 3 – Input Configuration Problems

Module 4 – Deployment and Forwarder Problems

Module 5 – License, Upgrade, and User Management Problems

Module 6 – Search Head Management Problems

Module 7 – User Search Problems