Intro to Splunk

This eLearning module teaches students how to use Splunk to create reports and dashboards and explore events using Splunk's Search Processing Language. Students will learn the basics of Splunk's architecture, user roles, and how to navigate the Splunk Web interface to create robust searches, reports, visualizations, and dashboards.

Topic 1 – Intro to Splunk

• Splunk components
• Basic Splunk functions

Topic 2 – Using Splunk

• Define Splunk Apps
• Understand Splunk user roles
• Searching & Reporting app
• Splunk Web interface

Topic 3 – Using Search

• Run basic searches
• Set the time range of a search
• Save search results
• Identify the contents of search results
• Work with events
• Share search jobs
• Export search results
• Select search modes
• Control a search job

Topic 4 – Exploring Events

• Refine searches
• Understand timestamps
• Use the events tab to add and remove terms from a search

Topic 5 – Search Processing Language

• Use wildcards to search for multiple terms
• Understand case sensitivity in searches
• Use booleans to include and exclude search criteria
• Use special character with search terms

Topic 6 – What Are Commands?

• Understand the anatomy of Splunk's search language:
• Search terms
• Commands
• Functions
• Arguments
• Clauses
• Understand bestpractices for writing searches

Topic 7 – What Are Knowledge Objects?

• Identify the five categories of knowledge objects:
• Data interpretation
• Data classification
• Data enrichment
• Data normalization
• Data models
• Understand types of knowledge objects

Topic 8 – Creating Reports and Dashboards

• Save a search as a report
• Edit reports
• Use transforming commands to create visualizations
• Create a dashboard
• Add a report to a dashboard
• Edit a dashboard