This course focuses on additional search commands as well as advanced use of knowledge objects. Major topics include advanced statistics and eval commands, advanced lookup topics, advanced alert actions, using regex and erex to extract fields, using spath to work with self-referencing data, creating nested macros and macros with event types, and accelerating reports and data models.
As of Oct. 25, 2021, Splunk Education has replaced this course with the new Single-Subject Courses. Please refer to this page for more information on the new offerings. This course will continue to be offered by our Authorized Learning Partners (ALPs) only until approximately April 30, 2022.