Splunk - Beginner to Architect 2026

Learn how Splunk searches, analyzes, and visualizes machine-generated data from servers, apps, and devices, and creates dashboards in minutes. Explore Splunkbase, pre-built AWS apps, and security and PCI compliance dashboards.

Understand two Splunk installation methods: an installation package (msi or dmg) and the Splunk Enterprise docker image. Leverage Ubuntu on DigitalOcean and credits for testing.

Create your Splunk account, enable the free trial, and access apps from the marketplace, while completing email verification and navigating export compliance issues with the Splunk team.

launch and secure a splunk deployment by creating an ubuntu server, configuring ssh key-based authentication, and tightening access with firewall rules for ports 22 and 8000.

Install Splunk on Linux using a .deb package for Ubuntu, download with wget, then start Splunk, accept the license, and access the web interface on port 8000.

Install Splunk on Windows using the official .msi installer for a supported version, create a user, and access the search and reporting app in your browser on port 8000.

Learn the basics and key advantages of docker containers, including build once, run anywhere, and how to run an nginx demo from docker hub across Windows, Linux, and Mac.

Explore Docker installation methods across Windows, macOS, and Linux, and run Splunk containers with ports 8000 and 9000.

Install docker engine on Ubuntu by updating apt, installing prerequisites, adding the official GPG key, configuring the repository, and installing docker-ce and CLI.

Install docker desktop on Windows, launch the GUI to view images and containers, sign in to hub.docker.com, and learn to switch between WSL2 and Hyper-V while running docker info.

Launch and manage a Splunk docker container using the official splunk/splunk image, configure port mappings including 8000, and sign in with admin credentials to run multiple containers.

Learn how to onboard data into Splunk using three ingestion methods—Splunk agent, manual uploads, and cloud integrations—with real-time logs, dashboards, and alerts.

Explore how source types drive field extractions in Splunk, learn to assign correct source types, and install add-ons to enable regex-based parsing for accurate dashboards, searches, and alerts.

Import data into Splunk by manually uploading access and Linux secure logs, then search, visualize, and understand automatic source type detection and field extraction.

Install the Splunk add-on for Unix and Linux to enable automatic field extractions for Linux secure logs, capturing source IP, source port, and invalid user details.

Learn the basics of searching Splunk data with SPL, using time ranges, source filtering, and boolean operators to optimize queries and visualize results.

Explore Splunk SPL commands, including table, stats, top, and IP location, and learn to pipe, transform, analyze, and visualize data in production environments.

Explore the basics of visualization in Splunk by transforming events into statistics and using time charts, pie charts, and other visuals to analyze traffic by day and country.

Explore how to locate attack vectors in Splunk by analyzing Linux secure logs to identify SSH failed logins, top attacking IPs, targeted usernames, and attacker geographies for auditor-driven data requests.

Discover how the Splunk search assistant provides auto-fill suggestions from history and documentation, with modes compact, full, and none, and how to customize it per user to streamline SPL queries.

Learn how Splunk reports use a saved search query (SPL) to generate summarized results from your data, can be scheduled at intervals, and distributed via email, Slack, webhooks, or dashboards.

Build a Splunk report with an SPL query that counts failed SSH login attempts by country, save the report, and schedule daily email delivery via SMTP with attachments.

Explore how splunk alerts use saved searches to monitor in real time or on a schedule, trigger when conditions are met, and notify via Slack or email for security attacks.

Set up practical Splunk alerts that monitor a read-only file for write changes, create a real-time triggered alert, and test the workflow in a Docker-based Splunk Enterprise environment.

Understand how Splunk add-ons extend functionality with field extractions and data input, while Splunk apps provide pre-built dashboards for AWS and Linux/Unix data.

Install and configure the Splunk add-on for AWS to collect AWS data, manage credentials or IAM roles, and set inputs while respecting hardware needs and API call limits.

Learn to build dashboards and panels in Splunk, driven by SPL searches, create visualizations like pie charts and column charts, and export them as PDFs for management.

Explore how to add and configure a time range picker in Splunk dashboards, using presets, shared time pickers, and a submit button to refresh panels.

Learn to build and link a text-based input in Splunk dashboards, using a linux_secure source and dynamic fields like src port and sssd protocol for interactive filtering.

Learn to design dashboard inputs with a pre-populated dropdown to avoid needing exact field names. The video demonstrates creating a dropdown, configuring sssd_protocol and process_detail, and applying it to searches.

Explore the Splunk directory structure, including Splunk home, bin, etc, and var, with emphasis on configuration, Splunk CLI, indexing data locations, and log files for troubleshooting.

Explore splunk configuration precedence across system local and system default, and app local and app default, where dot conf files govern behavior and local overrides default.

Splunk indexes are repositories where incoming data become events stored as raw data and tsidx index files. Explore default main, internal, and audit indexes, and compare stats versus tstats performance.

Explore the Splunk bucket life cycle from hot to warm to cold to frozen, including write and read rules, archive and restore, with hands-on index configuration guidance.

Move data from warm to cold buckets in Splunk, using max warm db count to trigger migration, while keeping hot and warm on fast disks and cheaper cold storage.

Explore the bucket life cycle: data moves from cold to frozen when index size or age thresholds are met, and frozen data is archived, not deleted, with TSIDX file removed.

Learn the thawing process in Splunk, moving archive data from the frozen db to the tar db, rebuilding the index with Splunk rebuild, and restarting Splunk to restore journal.gz data.

Explore how Splunk workflow actions add interactivity between index fields and external web resources, using a client IP whois lookup via abuseipdb.com.

Install the universal forwarder on servers or laptops to collect log files and forward them to the central Splunk instance via port 9997, enabling indexing, querying, and alerts.

Learn how to install the universal forwarder on Linux, configure forwarding to a Splunk instance with two servers, monitor /var/log, and troubleshoot connectivity using outputs.conf and forward server settings.

Explore Splunk agent management to centrally deploy changes to universal forwarders and apps across agents, eliminating the need for manual command runs.

Understand how server class and deployment apps govern Splunk universal forwarders by generating inputs.conf and outputs.conf, and how deployment maps target Linux underscore logs to specific forwarders.

Create a linux logs deployment app with inputs.conf and outputs.conf for a universal forwarder, map it to a server class, and verify data in data summary.

Master the basics of regular expressions, including literal and meta characters, to extract fields from logs. Learn to use character classes, grouping, and escapes, and test patterns on regex101.com.

Learn how Splunk parses web server logs using custom regex or ready-made add-ons, and apply named capturing groups to extract fields like source_ip and request_time from nginx logs.

Define the correct source type in Splunk to ensure accurate field extractions; learn how access_combined supports regex in props.conf and transforms.conf, while a wrong source type breaks extraction.

Explore Splunk's Interactive Field Extractor (IFX) to extract fields from logs without regex, using delimiter methods and field renaming. Use this approach wisely, while regex remains preferred for production.

Explore how props.conf and transforms.conf configure source types, define regex-based extractions, and enable custom Splunk data parsing through practical, default, and local overrides.

Explore how Splunk event types categorize data to simplify log analysis, with examples like success_purchase, invalid_user, and session_open, and learn their limitations such as no pipe or subsearch.

Learn to color code Splunk events by status to show severity at a glance, using colors like green for 200 and orange for 408 and disabling unused event types.

Use the lookup knowledge object to correlate Splunk events with data from databases, directories, and csv files. Import csv lookups to map customer ids to names.

Explore Splunk access control by configuring authentication methods, managing users and roles, and assigning permissions to control access, with examples of multifactor authentication, LDAP, and a separate Splunk instance.

Explore Splunk access control by creating a custom role with restricted search terms and restricted time ranges, assign capabilities, and configure default apps to tailor user access.

Explore the distributed Splunk architecture, including indexers, search heads, deployment servers, forwarders, license masters, and monitoring consoles. Learn how clustering and high availability protect production deployments.

Explore how a Splunk license master manages a single license across multiple instances in a distributed setup, including daily data limits, expiration, and slave-master configuration.

Implement a distributed license master with two slaves using docker, convert the master to licensing server, and configure the remote master at 172.17.0.2:8089 with pooling.

Understand how Splunk license pools allocate licensing from a license master to slaves, creating dedicated pools (dev 3 GB, sre 3 GB, security 4 GB) to avoid auto-generated pool overuse.

Discover how the Splunk indexer parses and indexes data from multiple inputs, builds default fields, stores raw data and index files, and enables high availability through clustering.

Learn how to mask sensitive data at index time in Splunk by transforming credit card and SSN information before indexing, so analysts cannot view the original details.

Explore how the search head in Splunk Enterprise manages search functions, queries indexers, merges results, and powers dashboards, reports, data models, and alerts.

Utilize the Splunk monitoring console to view pre-built dashboards of indexing performance, resource usage, license usage, and search performance, including distributed search and long-running searches.

Learn how indexer clustering in Splunk ensures high availability by using a master node to coordinate configurations and replication across peer nodes, while the master does not perform data replication.

Learn to set up a three-server Splunk indexer cluster (master, two peers), with naming conventions (MIDX01, IDX01, IDX02), install and start Splunk, and test failure scenarios.

Configure the master indexer in an indexer cluster, set replication factor and search factor, secure communication with a security key, and label the cluster to enable peer node integration.

Configure peer indexer nodes 0.1 and 0.2 to join the master indexer via clustering, set the master url and replication port, apply the security key, and restart.

Test replication across a two-peer splunk indexer cluster by uploading data on one node and verifying it appears on other as searchable and replicated copies for audit and telemetry indexes.

Test failover capabilities of a Splunk indexer cluster by simulating peer node failures, verifying data remains searchable through replication, and understanding the role of the master indexer and search head.

Learn how to use configuration bundles to push common settings from the master indexer to peer indexers, avoiding manual changes and ensuring synced indexes across the cluster.

Explore how a universal forwarder sends logs to a peer indexer cluster using hard-coded addresses and the indexer discovery feature, with demonstrated failover behavior.

Learn how indexer discovery lets universal forwarders query the master indexer for peer nodes and use load balancing to forward data.

Explore search head clustering in splunk: separate indexer and search head roles, avoid heavy searches on indexers, and deploy configuration bundles to a resilient search head cluster via deployer.

Explore the search head cluster infrastructure with two cluster member servers and a deployer that pushes configuration bundles. Learn how these members connect to indexers to fetch data.

Learn to set up a Splunk search head cluster across three virtual machines by configuring the deployer, initializing cluster members, and bootstrapping a captain for robust clustering.

Explore how search head clustering replicates settings across cluster members, including users, alert actions, data models, and macros, demonstrated on SS01 and SS02.

Push bundles from the deploy machine to all search head cluster members, including apps or add-ons, via the assets cluster apps directory. Apply the search head cluster bundle with Splunk.

Connect the search head cluster to the master indexer, run Splunk edit cluster config with the master IP, and restart to verify data on all heads.