Skip to main content


Splunk Training + Certification

Creating Knowledge Objects

QUICK LINKS   

My Training Profile | Splunk Education Student Handbook

Course Description

This three-hour course is for knowledge managers who want to learn how to create knowledge objects for their search environment using the Splunk web interface. Topics will cover types of knowledge objects, the search-time operation sequence, and the processes for creating event types, workflow actions, tags, aliases, search macros,
and calculated fields.
Download Course Description

Instructor-led Training Schedule
View Schedule
eLearning with Labs

The best of both delivery methods. Self-paced eLearning videos accessible anytime, anywhere, plus access to the interactive lab environment to sharpen your skills.

Register

Course Prerequisites

To be successful, students should have a solid understanding of the following:

  • How Splunk works
  • Knowledge objects

Course Topics

  •  Knowledge Objects and Search-time Operations
  •  Creating Event Types
  • Using Event Type Builder
  • Creating Workflow Actions
  • Creating Tags and Aliases
  • Creating Search Macros

Course Objectives
 

Topic 1 – Knowledge Objects & Search-time Operations
  • Understand role of knowledge objects for enriching data
  • Define search-time operation sequence
 
Topic 2 – Creating Event Types
  • Define event types
  • Create event types using three methods
  • Tag event types
  • Compare event types and reports
 
Topic 3 – Creating Workflow Actions
  • Identify what are workflow actions
  • Create a GET, POST, and search workflow action
  • Test workflow actions
 
Topic 4 – Creating Tags and Aliases
  • Describe field aliases and tags
  • Create field aliases and tags
  • ▪ Search with field aliases and tags
 
Topic 5 – Creating Search Macros
  • Explain search macros
  • Create macros with and without arguments
  • Validate macro arguments
  • Use and preview macros at search time
  • Create and use nested macros
  • Use macros with other knowledge objects
 
Topic 6 – Creating Calculated Fields
  • Explain calculated fields
  • Create a calculated field
  • Use a calculated field in search
WHY SPLUNK?
WHY SPLUNK?
SUPPORT
SUPPORT
RESOURCES
RESOURCES
FOR DEVELOPERS
FOR DEVELOPERS
COMPANY
COMPANY
SPLUNK SITES
SPLUNK SITES
Sitemap
Privacy
Website Terms of Use
Splunk Licensing Terms
Export Control
Modern Slavery Statement
Splunk Patents

© 2005 - 2022 Splunk Inc. All rights reserved.

Splunk, Splunk>, Turn Data Into Doing, and Data-to-Everything are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.