Splunk Basics Course
4.3 (32 ratings)
Course Ratings are calculated from individual students’ ratings and a variety of other signals, like age of rating and reliability, to ensure that they reflect course quality fairly and accurately.
6,778 students enrolled

Splunk Basics Course

Complete hands-on tutorial about the process of logging and monitoring using the amazing and agile tool Splunk
New
4.3 (32 ratings)
Course Ratings are calculated from individual students’ ratings and a variety of other signals, like age of rating and reliability, to ensure that they reflect course quality fairly and accurately.
6,778 students enrolled
Created by Ahmed Elakwah
Last updated 7/2020
English
English [Auto]
Current price: $13.99 Original price: $19.99 Discount: 30% off
5 hours left at this price!
30-Day Money-Back Guarantee
This course includes
  • 2 hours on-demand video
  • 3 articles
  • 13 downloadable resources
  • Full lifetime access
  • Access on mobile and TV
  • Certificate of Completion
Training 5 or more people?

Get your team access to 4,000+ top Udemy courses anytime, anywhere.

Try Udemy for Business
What you'll learn
  • ICT Logging and monitoring basics
  • How to make logs work for you and get notified if something went wrong
  • Visualize data received from any log source in very simple steps
  • Build a small computer LAB that consists of a Splunk server, Apache web server and Fortigate firewall virtual appliance
  • Install and configure Splunk Enterprise and Splunk Universal Forwarder
  • Know the different deployment types of Splunk
  • Collect logs from remote nodes using Splunk Universal Forwarder
  • Collect logs from Syslog devices like Fortigate firewall
  • Search and explore data on Splunk
  • Extract fields and add knowledge to data
  • Quick introduction to Splunk Search Processing language (SPL)
Requirements
  • Some prior knowledge about Linux operation system
  • You'll need a desktop computer (Windows, Mac, or Linux) capable of running 3 virtual machines. The course will walk you through installing the necessary free software.
Description

Machines are trying to tell us something through logs, so they are a very valuable resource for IT departments to ensure that everything is working as expected and to give us an idea of what is going on in our IT environments which will help to respond faster to incidents.


In this hands-on course, we will learn how to set up a small virtual LAB to simulate real-world logging and monitoring scenarios, where we will collect logs from Apache web server and Fortigate firewall and send them to Splunk for storage, analysis, visualization and alerting.


I selected these two log sources specifically because they represent the majority of log sources you will find in your environment, so you can follow the same steps in the course to integrate different log sources in the future.


There are more complicated logs sources to integrate like logs that are pulled from database but they are not suitable to be discussed in an introductory course.


After we onboard logs to Splunk, we will search and explore data we received then we will add knowledge to it by extracting interesting fields in these logs. 


At this point, our logs will be ready to be treated by Splunk Searching Processing Language (SPL) to create reports, dashboards, and alerts.


This course will make you ready to dig deep into more advanced topics of Splunk administration like,

  • High availability

  • Indexers clusters

  • Search head clusters

  • Deployments servers

  • Splunk Apps

  • Advanced SPL


But you have to walk before you run, so my vision for this course is to master the basics first to break the ice.


Who this course is for:
  • Security engineers
  • IT Administrators
  • Security operations center engineers
  • Security incident handlers
  • Systems administrators
  • Anyone wants to explore huge log files/feeds
  • Anyone interested to learn Splunk
Course content
Expand all 20 lectures 01:53:30
+ Introduction
3 lectures 05:47

A little bit about me and my story with Splunk and why am I teaching this course.

Preview 01:28

In this lecture, we will have a quick overview of the course structure and a quick look at the lab components.

Preview 03:08

Some useful tips while using course player.

Udemy 101: Getting the most from this course
01:11
+ Preparing LAB
5 lectures 27:51

In this lecture, we will download and install VMware Player as it will host all our virtual machines and virtual appliance in this course. 

Installing VMware Workstation Player
01:51

In this lecture, we will deploy the Ubuntu Linux operating system for Splunk server and Apache server.

Also, we will login for the first time to the newly deployed machines, default password for osboxes user is osboxes.org

Installing Ubuntu virtual machines
07:38

In this lecture, we will assign static IPs for our machines and we will change the default password for osboxes user.

Preview 08:03

In this lecture, we will download Splunk packages for Splunk main server and Splunk universal forwarder that will collect logs from the Apache server and forward it to Splunk main server.

Also, we will install the Apache webserver to have it ready for the next lectures.

Downloading Splunk and installing Apache server
05:45

In this lecture, we will import Fortigate virtual appliance into VMware Player, and set a static IP and default gateway for the virtual appliance.

Preview 04:34
+ Installing Splunk
3 lectures 22:39

In this lecture, we will install Splunk Enterprise software on Splunk server machine, and install Splunk Universal Forwarder on the Apache server machine.

Installing Splunk and Splunk Universal Forwarder
07:48

In this lecture, we will talk about different deployment types of Splunk.

Deployment types
04:03

In this lecture, we will upload a sample log file to Splunk and explore  this data from Splunk web interface.

Also, we configure required network ports on Splunk server to receive data from Syslog feed (Fortigate appliance) and from Apache server (using Splunk Universal Forwarder).

Preview 10:48
+ Getting data in
2 lectures 20:49

In this lecture, we will collect logs from the Apache web server and send it to Splunk server.

Collecting logs from remote nodes
17:34

In this lecture, we will login to the web interface of Fortigate firewall to configure it to send its logs to Splunk server.

Configure Syslog source
03:15
+ Searching and exploring logs
3 lectures 18:27

In this lecture, we will login to Splunk server web interface to explore the data we on sent to Splunk in previous lectures.

Preview 03:40

In this lecture, we will extract the fields of Apache access logs using:

  1. Splunk Interactive Field Extractor (IFX)

  2. Regular expressions

Extract fields and add knowledge to data
12:28

In this lecture, we will have a quick introduction to Splunk SPL "Search Processing language" with some examples.

Splunk Search Processing Language (SPL)
02:19
+ Reporting and monitoring
2 lectures 17:28

In this lecture, we will create reports based on the data we received from Fortigate firewall and Apache web server, then we will place these reports into two different dashboards:

  1. Firewall stats

  2. Apache stats

Creating reports and dashboards
10:44

In this lecture, we will learn about one of the most important features of Splunk which is the Alerting but unfortunately, it is not available in the free license of Splunk, but we can use it in the trial version for 60 days.

We will configure our alert to be sent to "Triggered Alerts" page and also to be sent to an email.

Creating alerts
06:44
+ Keep learning
2 lectures 00:28
More to explore
00:05
Don't forget to leave a rating!
00:23