Course Description

This 13 hour course supplements the Splunk Fundamentals 2 class. It focuses on more advanced search and reporting commands. Scenario-based examples and hands-on challenges enable users to create robust searches, reports, and charts. Students are coached step by step through complex searches to produce final results. Major topics include the Splunk search process, using subsearches, additional statistical commands and functions, formatting and calculating results, charting commands and options, correlating events, and creating advanced lookups, and searching tsidx files.

Instructor-led Training Schedule

Course Prerequisites

  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
  • Highly recommended: at least 6 months experience with the Splunk search language

Course Topics

  • Beyond Search Fundamentals
  • Using Subsearches
  • Using Advanced Statistics
  • Manipulating and Filtering Data
  • Additional Charting Techniques
  • Using Advanced Transactions
  • Working with Time
  • Using Advanced Lookups
  • Searching tsidx Files
Course Objectives

Module 1 - Beyond Search Fundamentals

  • Use the proper case in searches
  • Describe Splunk’s search process
  • Use the search inspector to view search performance

Module 2 - Using Subsearches

  • Use subsearch to provide filtering and other information to
    a main search
  • Learn when to use - and when not to use - subsearches
  • Troubleshoot subsearches

Module 3 - Using Advanced Statistics

  • Use statistical functions such as list, max, standard
  • Use the appendpipe command
  • Use the streamstats and eventstats commands

Module 4 - Using Data Manipulation, and Filtering

  • Use the following commands and functions:
  • bin
  • xyseries
  • foreach
  • where functions: like, isnull
  • eval functions: strftime, upper, case, replace

Module 5-Additional Charting Techniques

  • Use the following commands and functions:
  • addtotals
  • untable
  • append and appendcols

Module 6 - Using Advanced Transactions

  • Find events logged before or after a particular event occurs
  • Compare complete vs. incomplete transactions
  • Analyze transactions

Module 7 - Working with Time

  • Use time modifiers
  • Search for events using custom time ranges and time windows
  • Display and use using relative dates
  • Use custom time ranges in multiple subsearches

Module 8 - Using Advanced Lookups

  • Include or exclude events based on values in a lookup table
  • Build a baseline lookup table and reference its values in

Module 9 - Searching tsidx Files

  • Use the tstats command to search:
  • Normal index data
  • Data models
  • Data model objects
  • tstats vs stats