Splunk Cloud Administration

Course Objectives
 

Module 1 – Splunk Cloud Overview

• Describe Cloud topology
• Describe tasks managed by the Splunk cloud administrator
• List the primary differences between Splunk Cloud and Splunk Enterprise

Module 2 – Index Management

• Define a Splunk Index
• Create indexes in cloud
• Delete data from an index
• Monitor indexing activities

Module 3 – User Authentication and Authorization

• Administer Splunk user roles
• Integrate Splunk with LDAP, Active Directory, or SAML

Module 4 – Getting Data in

• List Splunk input options
• Describe the basic settings for an input
• Review Splunk configuration files
• Use a test environment to verify data

Module 5 – Getting Data in Cloud

• List Splunk forwarder types
• Describe the role of forwarders
• Configure a forwarder to Splunk Cloud
• Test the forwarder connection
• Describe optional forwarder settings

Module 6 – Forwarder Management

• Describe Splunk Deployment Server
• Explain the use of forwarder management
• Configure forwarders to be deployment clients
• Managing forwarders using deployment apps

Module 7 – Monitor Inputs

• Describe the Splunk process for inputting data
• Create file and directory monitor inputs
• Use optional settings for monitor inputs

Module 8 – Network and Other Inputs

• Create network (TCP and UDP) inputs
• Create a basic scripted input
• Describe optional settings for network inputs
• Identify Windows input types and uses
• Use the HTTP Event Collector (HEC) to get data into Splunk

Module 9 – Fine-tuning Inputs

• Describe the default processing that occurs during the input phase
• Configure input phase options, such as sourcetype fine-tuning and character set encoding

Module 10 – Parsing Phase and Data Preview

• Describe the default processing that occurs during parsing
• Optimize and configure event line breaking
• Explain how timestamps and time zones are extracted or assigned to events
• Use Data Preview to validate event creation during the parsing phase

Module 11 – Manipulating Raw Data

• Explain how data transformations are defined and invoked
• Use transformations with props.conf and transforms.conf to modify raw data
• Use SECCMD to modify raw data

Module 12 – Installing and Managing Apps

• Describe self-service app installs vs. manual app installs
• Provide steps to install apps
• Describe how apps are managed

Module 13 – Working with Splunk Cloud Support 

• Isolate problems before contacting Splunk Cloud Support
• Define the process for working with Splunk Cloud Support