This 3-virtual day course is for an experienced Splunk Enterprise administrator who is new to Splunk Clusters. The course provides the fundamental knowledge of deploying and managing Splunk Enterprise in a clustered environment. It covers installation, configuration, management, and monitoring of Splunk clusters. While Splunk Clusters are supported in Windows environments, the class lab environment is running Linux instances only.

• Large-scale Splunk Deployment Overview
• Single-site Indexer Cluster
• Indexer Cluster Management and Administration
• Forwarder Configuration
• Search Head Cluster
• Search Head Cluster Management and Administration
• KV Store Collection and Lookup Management
• SmartStore Implementation Overview

To be successful, students should have a solid understanding of the following courses:

• Splunk Fundamentals 1
• Splunk Fundamentals 2

OR the following single-subject courses:

Students should also have completed the following courses:

Module 1 – Splunk Troubleshooting Methods and Tools

• Deployment Design Factors
• How Splunk Enterprise can scale
• Splunk License Master
• Splunk 9.0 Security

Module 2 – Single-site Indexer Cluster

Module 3 – Multisite Indexer Cluster

Module 4 – Indexer Cluster Management and Administration

Module 5 – Forwarder Management

Module 6 – Search Head Cluster

Module 7 – Search Head Cluster Management

Module 8 – KV Store Collection and Lookup Management

Module 9 – Introduction to Smart Store