Splunk Boot Camp

Introduction to Splunk

• What’s Splunk?
• Authentication Methods
• Access Controls and Users
• Products, Licensing, and Costs
• Quick Tour Guide: User Interface

Indexes

• Splunk Data
• What are Indexes?
• What are Indexers?
• Search-Head
• Index Clusters
• Index Pipeline
• Events
• Fields and Field Extraction
• Forwarders
• Metrics
• Removing Data

Splunk Architecture

• Components of Splunk Deployments
• Deployment Scenarios

Search Processing Language

• What is Search Processing Language (SPL)?
• Searching Operators
• Search Commands
• Search Pipeline
• Sub-searches
• Commonly Used Search Commands
• Drilldowns
• Lookups
• Optimize Searches

Dashboard and Visualizations

• Dashboards in Splunk
• Creating Dashboards
• Visualization Types
• Search as Reports
• Dashboards
• Drilldown
• Forms

Alerts

• Creating Alerts
• Scheduling Alerts
• Alerts Notifications

Scheduled Reports

• Creating Scheduled Reports

Putting the Pieces Together

• In your final exercise, you’ll configure a typical scenario when using Splunk. You'll install and configure an NGINX, then the Splunk forwarder to collect logs in Splunk. The idea is that you can apply everything you've learned within the Bootcamp: creating searches, visualizations, dashboards, etc.