- Free Courses
-
Learning Paths
- Courses for Users
- Courses for Splunk Administrators
- Courses for Splunk Cloud Customers
-
Courses for Splunk Architects
- Overview
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Advanced Searching and Reporting
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Advanced Dashboards and Visualizations
- Architecting Splunk Enterprise Deployments
- Courses for App Developers
- Courses for Enterprise Security Administrators
- Courses for Enterprise Security End-Users
- Courses for IT Service Intelligence Administrators
- Courses for IT Service Intelligence End-Users
- Courses for Phantom Customers
- Certification Tracks
-
Courses
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Splunk Fundamentals 3
- Advanced Searching and Reporting
- Creating Dashboards with Splunk
- Advanced Dashboards and Visualizations
- Building Splunk Apps
- Splunk for Analytics and Data Science
- Splunk Infrastructure Overview
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Splunk Cloud Administration
- Architecting Splunk Enterprise Deployments
- Splunk Enterprise Practical Lab
- Developing with Splunk's REST API
- Administering Splunk Enterprise Security
- Using Splunk Enterprise Security
- Implementing Splunk IT Service Intelligence
- Using Splunk IT Service Intelligence
- Splunk User Behavior Analytics
- Introduction to Phantom
- Developing Phantom Playbooks
-
Videos
- All Videos
- Splunk Cloud Tutorial
- Installing Splunk Enterprise 6 on Linux
- Installing Splunk Enterprise 6 on Windows
- Getting Data In to Splunk Enterprise (Linux)
- Getting Data In (Windows)
- Getting Data In with Forwarders
- Basic Search in Splunk Enterprise 6.3
- Create a Dashboard in Splunk Enterprise
- Using the Splunk MINT SDK for Android
- Using the Splunk MINT SDK for iOS
- Basic Search in Splunk Light
- Create Reports in Splunk Light
- Create Dashboards in Splunk Light
- Create Alerts in Splunk Light
- Splunk Certification Candidate Journey
-
- Certification Exams
- Program Guide + FAQ
- Download Fact Sheet
Course Description
This 3 virtual-day course focuses on more advanced search and reporting commands. Scenario-based examples and hands-on challenges enable users to create robust searches, reports, and charts. Students are coached step by step through complex searches to produce final results. Major topics include optimizing searches, additional charting commands and functions, formatting and calculating results, correlating events, and using combined searches and subsearches.
Instructor-led Training Schedule
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Splunk Fundamentals 3
- Highly recommended: at least 6 months experience with the Splunk search language
- Using Search Efficiently
- More Search Tuning
- Manipulating and Filtering Data
- Working with Multivalue Fields
- Using Advanced Transactions
- Working with Time
- Combining Searches
- Using Subsearches
- Review search architecture
- Understand how the components of a bucket (.tsidx an djournal.gz files) are used
- How bloom filters are used to improve search speed
- Describe the parts of a search string
- Understand the use of centralized vs. distributable commands
- Create better searches
- Understand how segmenters are used in Splunk
- Use lispy to reduce the number of events read from disk
- Divide search results into different groups, based on values in a specified field, using the bin command
- Regroup fields of search results using untable and xyseries
- Create a template for performing additional processing on a set of related fields using foreach
- Use multivalue eval functions to analyze and format data
- Use the makemv command to convert a single value into a multivalue field
- Use the mvexpand command to create separate events for each value in a multivalue field
- Find events logged before or after a particular event occurs
- Compare complete vs. incomplete transactions
- Analyze transactions
- Use time modifiers
- Search for events using custom time ranges and time windows
- Display and use using relative dates
- Use custom time ranges in multiple subsearches
- Use the append and appendcols commands (and know the differences)
- Use join and union (and when not to use them)
- Use subsearches to provide filtering and other information to a main search
- Know when NOT to use subsearches
- Troubleshoot subsearches
- Describe the use of regular expressions
- Provide some guidance on using lookups
- Provide miscellaneous optimization tips