Skip to main content


Splunk Training + Certification

Troubleshooting Splunk Enterprise

QUICK LINKS   

My Training Profile | Splunk Education Student Handbook

Course Description

This 9-hour virtual course is designed for Splunk administrators. It covers topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available on Splunk Enterprise.

 

This lab-oriented class is designed to help you gain troubleshooting experience before attending more advanced courses. You will debug a distributed Splunk Enterprise environment using the live system.  case logs.

 

This course does not cover the issues surrounding Splunk Cloud, Splunk Clusters, or Splunk premium apps.

 
Download Course Description

Instructor-led Training Schedule
View Schedule

Prerequisite Knowledge

To be successful, students should have a solid understanding of the following courses:

  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
Or the following single-subject courses:
  • What is Splunk?
  • Intro to Splunk
  • Using Fields
  • Scheduling Reports and Alerts
  • Visualizations
  • Leveraging Lookups and Sub-searches
  • Search Under the Hood
  • Introduction to Knowledge Objects
  • Creating Knowledge Objects
  • Enriching Data with Lookups
  • Data Models
  • Introduction to Dashboards
Student should also have completed the following courses:
  • Splunk Enterprise System Administration
  • Splunk Enterprise Data Administration

Course Topics

  • Splunk Troubleshooting Methods and Tools
  • Indexing Problems
  • Input Configuration Problems
  • Deployment Problems
  • License, Upgrade, and User Management Problems
  • Search Management Problems
  • User Search Problems

Course Objectives
 

Module 1 – Splunk Troubleshooting Methods and Tools
  • Describe the Splunk Troubleshooting Approach
  • List Splunk Diagnostic Resources and Tools
  • Create and Splunk a Diag
  • Use RapidDiag
 
Module 2 – Indexing Problems
  • Discover Splunk deployment Topology and its Server Roles
  • Identify Where to Check the Index-Time Pipeline Status
  • Use the metrics.log to Clarify the Index-Time Problem
 
Module 3 – Input Configuration Problems
  • Data Input issues
  • Troubleshooting Inputs with the Monitoring Console
 
Module 4 – Input Deployment Problems
  • Deployment server issues
  • Forwarding and Receiving Issues
Module 5 – Indexer Cluster Management Administration
  • Peer Offline and Decommission
  • Master App Bundles
  • Indexer Cluster Storage Utilization Options
  • Site Mapping
  • Monitoring Console for Indexer Cluster Environment
Module 6 – License, Upgrade, and User Management Problems
  • Installation Issues
  • Upgrade Considerations
  • Splunk Licensing Issues
  • Splunk Roles and User Management issues
 
Module 7 – Search Management Problems
  • Troubleshoot Distributed Search Issues
  • Identify Job Scheduling Problems
  • Learn to Diagnose Crashing Problems
  • Describe How to Prioritize Resources for Critical Splunk Processes
 
Module 7 – KV Store Collection and Lookup Management
  • Identify the Types of Search Problems
  • Isolate and Troubleshoot Search Problems
WHY SPLUNK?
WHY SPLUNK?
SUPPORT
SUPPORT
RESOURCES
RESOURCES
FOR DEVELOPERS
FOR DEVELOPERS
COMPANY
COMPANY
SPLUNK SITES
SPLUNK SITES
Sitemap
Privacy
Website Terms of Use
Splunk Licensing Terms
Export Control
Modern Slavery Statement
Splunk Patents

© 2005 - 2022 Splunk Inc. All rights reserved.

Splunk, Splunk>, Turn Data Into Doing, and Data-to-Everything are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.