Build a Splunk instance, and learn the concepts and terminology you need to produce insightful data reports and dashboard from data
About This Video
In Detail
Maybe you've heard about Splunk, but don't …
Build a Splunk instance, and learn the concepts and terminology you need to produce insightful data reports and dashboard from data
About This Video
In Detail
Maybe you've heard about Splunk, but don't know how to use it to take control of big data? Have you used Splunk, but want to learn how to set it up and use it properly? If so, this course is for you.
In this course, you will work with Splunk from the ground up. You'll learn the basics of Splunk terminology, and how to use the Splunk web interface to find data. You'll also build your own Splunk environment, add data to the Common Information Model (CIM), create dashboards, and find events within data. Finally, you'll master advanced searching techniques that are especially useful to those in network, security, and system administration roles.
The course also covers the latest additions brought in for Splunk 8 and helps you quickly perform an upgrade. By the end of the course, you will be confident about using Splunk and will be well on the road to becoming a proficient Splunk architect and administrator as quickly as possible!
Audience
This course is for IT professionals and data analysts who want to get started with Splunk and rapidly take their skills to the point where they can get hands-on and fully proficient with its features and benefits.
Requirement: No prior knowledge of Splunk is needed for taking this course, but a Splunk account (free of charge) will be required for the lab activities. Knowledge of Unix/Linux command line will be helpful.
Chapter 1 : Introduction to Splunk
Course Overview
What Is Splunk
What Are Logs and Why They Matter
Setting Up an AWS Environment
Splunk Installation
Chapter 2 : Splunk Terminology
Splunk - Splexicon
What Data Looks Like in Splunk - Events
Getting Data Out of Splunk - Search
Saved Searches - Report
Visualizing Data - Dashboard
Splunk’s Search Language - Search Processing Language
What Type of Data Do We Have - Sourcetype
How is Data Stored - Index
Making Data Useful with Knowledge Objects and Fields
Enriching Data - Lookup Table
Chapter 3 : Data Onboarding
How to Approach Data Onboarding
Hands-On Lab: Onboarding Linux Authentication Logs
Field Extractions Using Splunk Apps
What If There Is Not an App Available
Splunk Configuration Files
Chapter 4 : Splunk Deployment Components
Core Splunk Infrastructure - Indexes and Search Heads
Supporting Infrastructure - Forwarders
Supporting Infrastructure - Syslog Receiver
Supporting Infrastructure - Deployment Server
Splunk Licensing - How It Works and How to Investigate Your License Utilization
Splunk Clustering - Building Splunk for Fault Tolerance
Distributed Splunk Environments
Splunk Apps - The Building Blocks of Any Splunk Deployment
Chapter 5 : Data Normalization and Data Models
Onboarding Iptables Logs
Normalizing Data Using the Splunk Common Information Model (CIM)
Applying the Common Information Model to Your Firewall Logs
Chapter 6 : Using Your Splunk Environment
Overview of Splunk UI
Using Fields
Hands-on Lab: Working with the Splunk UI
Splunk Search Models
Hands-On Lab: Splunk Search Modes
The Search Pipeline
Hands-On Lab: Search Pipeline
Chapter 7 : Visualizing Data
Reporting Log Data - Tables
Hands-On Lab: Tables - Displaying Search Results
Advanced Searching Concepts - Chart - Graphing Search Results
Advanced Searching Concepts - Timechart - Results Over Time
Advanced Searching Concepts - Geostats and IP Location
Advanced Searching Concepts: Eval - Manipulating and Reformatting Data
Advanced Searching Concepts: Rename – Making Table Headers More Accessible
Advanced Searching Concepts: Relative Time Syntax
Advanced Searching Concepts: Search Performance - Gotchas to Avoid
Advanced Searching Concepts: Time to Experiment – Expanding Your Splunk Knowledge
Creating Splunk Dashboards
Hands-On Lab: Dashboards
Chapter 8 : Upgrading Splunk
Splunk Release Cycles
What’s New in Splunk 8.0
Planning for an Upgrade
Backing up Your Splunk Instance
Performing a Splunk Upgrade
Hands-on Lab: Upgrading Your Lab System