Advanced Searching and Reporting

Instructor-led Training Schedule

Module 1 - Beyond Search Fundamentals

• Use the proper case in searches
• Describe Splunk’s search process
• Use the search inspector to view search performance

Module 2 - Using Subsearches

• Use subsearch to provide filtering and other information to
  a main search
• Learn when to use - and when not to use - subsearches
• Troubleshoot subsearches

Module 3 - Using Advanced Statistics

• Use statistical functions such as list, max, standard
  deviation
• Use the appendpipe command
• Use the streamstats and eventstats commands

Module 4 - Using Data Manipulation, and Filtering

• Use the following commands and functions:
• bin
• xyseries
• foreach
• where functions: like, isnull
• eval functions: strftime, upper, case, replace

Module 5-Additional Charting Techniques

• Use the following commands and functions:
• addtotals
• untable
• append and appendcols

Module 6 - Using Advanced Transactions

• Find events logged before or after a particular event occurs
• Compare complete vs. incomplete transactions
• Analyze transactions

Module 7 - Working with Time

• Use time modifiers
• Search for events using custom time ranges and time windows
• Display and use using relative dates
• Use custom time ranges in multiple subsearches

Module 8 - Using Advanced Lookups

• Include or exclude events based on values in a lookup table
• Build a baseline lookup table and reference its values in
  alerts

Module 9 - Searching tsidx Files

• Use the tstats command to search:
• Normal index data
• Data models
• Data model objects
• tstats vs stats