Splunk: Advance Visualization for IT Operations 2023

Explore the basics of SPL in Splunk, learning core commands, arguments, and functions. Discover tips to write better queries and combine commands to produce desired results.

Learn five basic Splunk commands—lookup, input lookup, input CSP, output CSP, and output lookup—and how file location in apps lookups or the run Splunk folder affects usage.

Upload the country dot CSP data file to Splunk, import with the input lookup command, and generate results using the output commands for its 256 events.

Learn how to use the field command in Splunk to select specific fields, exclude others with minus, and handle case sensitive names, illustrated with country, continent, and region.

Learn to export and test selected fields from two data feeds in Splunk, using output commands to generate files with country and continent fields for IT operations visualization.

Master the eval and fillnull commands in Splunk to create new fields and fill empty values with defined data, with practical examples using population and country fields.

Advance your Splunk skills by mastering complex SPL functions and queries, monitor data in real time, and create reports and dashboards, building on basic SPL revision.

Upload an IT operations data file in Splunk, including username, department, priority, urgency, impact, incident status, assigned engineer, and SLA, then verify with an inputlookup command.

Create a new dashboard by clicking the dashboard option, set the title to monthly report, keep the permissions private, and finalize the dashboard creation.

Create a monthly incident report from uploaded data, tallying total and pending incidents, incidents resolved by engineers, top engineers by incidents, and departments with the most open incidents.

Import the IT operation data, count incidents by the incident number, rename the column to total incidents, and display the single-value visualization on the monthly report dashboard with color-coded ranges.

Learn to display monthly incident counts in Splunk by converting timestamps, extracting the month, bucketing data by month, and visualizing results on a dashboard.

Learn to build yearly and monthly incident reports in Splunk by counting incidents per engineer, exporting results to a dashboard, and visualizing them as a green column chart.

Learn to calculate yearly and monthly incident counts by engineer in Splunk by converting timestamps to epoch, bucketing by month, and aggregating with stats count.

Learn to build a Splunk dashboard that displays total incidents by engineer per month, using time filters, trellis layouts, and pie charts for February and March.

Display charts showing total incidents and tickets by priority. Show closed incidents in current month with high or critical priority; show open incidents with high or critical priority.

Build a Splunk dashboard to display total closed incidents in March by priority, counting high and critical incidents and visualizing them as a bar chart.

Display incidents for March with high or critical priority, and open or pending status, refine with trellis layout for independent status, and export the chart to the dashboard.

Display total incidents by sla using stats and count, rename incident number to status, and visualize three sla levels in a bar chart on a dashboard.

Identify departments with the most incidents in Splunk using top and sort, compute percentages, filter by month with time, and export results to a dashboard for visualization.

Learn how to display the top 3 departments by incident percentage in Splunk using a radial chart, editing the dashboard and search settings, and saving the visualization.

Search the SLA column with quoted terms, then count incidents by engineers to identify who missed the most service targets, displayed on a monthly dashboard.

Add a real-time date to a Splunk dashboard by converting epoch to a readable format using STRF time, displaying last updated, and configuring a single-value panel.

turn on dark mode to improve the dashboard, update data from feb to june, switch to a line chart, fix month order, and customize axis titles and labels.

Finalize and refine a Splunk dashboard by merging two charts into one, filtering to major incidents, rearranging layouts, saving, and exploring multiple dashboards for monthly, engineers and yearly data.

Learn advanced visualization in Splunk by building interactive graphs for management, improving visualizations with source tweaks, and using single select, multi select, tokens, patterns, and time functions.

Create a new dashboard for interactive charts, name it my interactive dashboard, and click create to continue to the next lecture.

Define a token with a dropdown to control a dashboard chart, linking the token values to the query and updating the graph for March, February, or April.

Learn to add a multi select input in a Splunk dashboard to insert multiple tokens. Compare it with the single select option and choose one or more tokens.

Create an interactive line chart in Splunk by defining an engineer token for multi-select, applying the query, and using a trellis layout to split data by engineer assigned.

Create a button to let multi select and single select controls interact with search results in a Splunk dashboard with search on change.