Course Description

This nine-hour course focuses on large enterprise deployments. Students will learn steps and best practices for planning, data collection and sizing for a distributed deployment.

Instructor-led Training Schedule
 Start Date  Start Time  Time Zone
09-Jul-18 09:00 AM (GMT+01:00) Brussels, Copenhagen, Madrid, Paris
09-Jul-18 09:00 AM (GMT+10:00) Canberra, Melbourne, Sydney
12-Jul-18 09:00 AM (GMT-04:00) Eastern Daylight Time
16-Jul-18 09:00 AM (GMT-04:00) Eastern Daylight Time
23-Jul-18 09:00 AM (GMT+01:00) Brussels, Copenhagen, Madrid, Paris
View Schedule

Course Prerequisites

  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
  • Splunk Enterprise System Administration
  • Splunk Enterprise Data Administration

 

Course Topics

  • Requirements definition
  • Index and infrastructure planning
  • Data collectionForwarders
  • Managing Deployments
  • Data comprehension
  • Search considerations
  • Operations and management
Course Objectives

Module 1 – Introduction

  • Overview of the Splunk deployment planning process and associated tools

Module 2 – Project Requirements

  • Identify critical information about environment, volume, users, and requirements
  • Review checklists and resources to aid in collecting requirements

Module 3 – Infrastructure Planning: Index Design

  • Design and size indexes
  • Estimate storage requirements
  • Identify relevant apps 

Module 4 – Infrastructure Planning: Resource Planning

  • List sizing factors for servers
  • Describe how reference hardware is used to scale deployments
  • Identify the impact of clustering for index replication and for search heads

Module 5 - Clustering Overview

  • Describe the different clustering capabilities
  • Introduce the concepts of indexer and search head clustering

Module 6 - Forwarder and Deployment Best Practices

  • Review types of forwarders
  • Describe how to manage forwarder installation
  • Review configuration management for all Splunk components, using Splunk deployment tools
  • Provide best practices for a Splunk deployment

Module 7 - Integration 

  • Describe integration methods
  • Identify common integration points

Module 8 – Performance Monitoring and Tuning

  • Use the Monitoring Console to track test environment performance
  • List options to fine tune performance for production environment

Module 9 – Use Cases

  • Provide example architecture topologies 
  • Discuss different architecture options based on use case