Course Description

This 13 hour course supplements the Splunk Fundamentals 2 class. It focuses on more advanced search and reporting commands. Scenario-based examples and hands-on challenges enable users to create robust searches, reports, and charts. Students are coached step by step through complex searches to produce final results. Major topics include the Splunk search process, using subsearches, additional statistical commands and functions, formatting and calculating results, charting commands and options, correlating events, and creating advanced lookups, and searching tsidx files.

Instructor-led Training Schedule

Course Prerequisites


  • Splunk Tutorial (e-learning)
  • Using Splunk
  • Searching and Reporting with Splunk
  • Creating Knowledge Objects
  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
  • Highly recommended: at least 6 months experience with the Splunk search language

Course Topics

  • Beyond Search Fundamentals
  • Using Subsearches
  • Using Advanced Statistics
  • Manipulating and Filtering Data
  • Additional Charting Techniques
  • Using Advanced Transactions
  • Working with Time
  • Using Advanced Lookups
  • Searching tsidx Files
Course Objectives

Module 1 - Beyond Search Fundamentals

  • Use the proper case in searches
  • Describe Splunk’s search process
  • Use the search inspector to view search performance


Module 2 -  Using Subsearchers

  • Use subsearch to provide filtering and other information to a main search
  • Learn when to use - and when not to use - subsearches
  • Troubleshoot subsearches


Module 3 - Using Advanced Statistics

  • Use statistical functions such as list, max, standard deviation
  • Use the appendpipe command
  • Use the streamstats and eventstats commands

Module 4 - Using Data Manipulation and Filtering

  • Use the following commands and functions:
    • bin
    • xyseries
    • foreach
  • where functions: like, isnull
  • eval functions: strftime, upper, case, replace


Module 5 - Additional Chart Techniques

Use the following commands and functions:

  • addtotals
  • untable
  • append and appendcols

Module 6 - Using Advanced Transactions

  • Find events logged before or after a particular event occurs
  • Compare complete vs. incomplete transactions
  • Analyze transactions

Module 7 - Working with Time

  • Use time modifiers
  • Search for events using custom time ranges and time windows
  • Display and use using relative dates
  • Use custom time ranges in multiple subsearches

Module 8 - Using Advanced Lookups

  • Include or exclude events based on values in a lookup table
  • Build a baseline lookup table and reference its values in alerts

Module 9 - Searching tsidx Files

  • tstats vs stats
  • Use tsidx files to search: Normal index data, Data models, Data model objects