Skip to main content


Splunk Training + Certification

Search Under the Hood

QUICK LINKS   

My Training Profile | Splunk Education Student Handbook

Course Description

This eLearning course gives students additional insight into how Splunk processes searches. Students will learn about Splunk architecture, how components of a search are broken down and distributed across the pipeline, and how to troubleshoot searches when results are not returning as expected.
Download Course Description
eLearning

Learn at your own pace through these free, video-only online courses accessible anytime, anywhere.

Register
eLearning with Labs

The best of both delivery methods. Self-paced eLearning videos accessible anytime, anywhere, plus access to the interactive lab environment to sharpen your skills.

Register

Course Prerequisites

Recommended:

  • Intro to Splunk eLearning course

Course Topics

  • Understanding Splunk architecture
  • Understanding how search terms are tokenized
  • Using streaming and non-streaming commands
  • Using troubleshooting commands and functions

Course Objectives
 

Topic 1 – Investigating Searches
  • Use the Search Job Inspector to examine how a search was processed and troubleshoot performance
  • Use SPL commenting to help identify and isolate problems

 

Topic 2 – Splunk Architecture
  • Understand the role of search heads, indexers, and forwarders in a Splunk deployment
  • Understand how the components of a bucket (.tsidx and journal.gz files) are used
  • Understand how bloom filters are used to improve search speed

 

Topic 3 – Streaming and Non-Streaming Commands
  • Describe the parts of a search string
  • Understand the use of centralized vs. distributable commands
  • Create more efficient searches

 

Topic 4 – Breakers and Segmentation
  • Understand how segmenters are used in Splunk
  • Use lispy to reduce the number of events read from disk
     

 

Topic 5 – Commands and Functions for Troubleshooting
  • Using the fieldsummary command
  • Using the makeresults command
  • Using information functions with the eval command
    • the isnull function
    • the typeof function
WHY SPLUNK?
WHY SPLUNK?
SUPPORT
SUPPORT
RESOURCES
RESOURCES
FOR DEVELOPERS
FOR DEVELOPERS
COMPANY
COMPANY
SPLUNK SITES
SPLUNK SITES
Sitemap
Privacy
Website Terms of Use
Splunk Licensing Terms
Export Control
Modern Slavery Statement
Splunk Patents

© 2005 - 2022 Splunk Inc. All rights reserved.

Splunk, Splunk>, Turn Data Into Doing, and Data-to-Everything are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.