Splunk Core Certified User Masterclass

Download and install Splunk Enterprise via the free 60‑day trial, log in with admin credentials, and launch. Start ingesting data and building dashboards for a functional single deployment.

Configure and scale a splunk stack by assigning server roles (forwarder, indexer) and ensuring sufficient ram, cpu, and disk space; manage dashboards and reports in the searching and reporting app.

Upload data into Splunk using the web interface, inspect pretrained or custom source types, and adjust timestamps and field extraction to ensure accurate event ingestion.

Upload and configure data in a Splunk lab by importing three data sources—access_combined_ip, linux_secure_ip, and db_audit_csv—setting hosts, main index, and source types.

Master the Splunk search window, using the search processing language with time range filtering, pipes, wildcards, booleans, and the search assistant for efficient data analysis.

Learn to search with Splunk's search processing language, create efficient queries to detect failed ssh logins, and analyze results with time ranges, port filtering, and shared saved searches.

Master Splunk field basics to filter searches with key value pairs, utilize the fields sidebar and selected fields, understand discovery, time ranges, and efficient indexing for rapid, accurate insights.

Explore Splunk's search processing language and learn how the left-to-right pipeline, pipe separators, and commands like chart, stats, eval, and fields shape results into a table.

Learn to use common Splunk commands—fields, table, rename, and dedupe—to extract unique user sessions with successful purchases and tailor reports for marketing campaigns.

Explore transforming commands in Splunk—top, rare, and stats—to aggregate data, apply limits and by clauses, rename fields, and use count, sum, and distinct count.

Derive insights from data by transforming commands in Splunk, creating practical reports for sales, security, and IT, using top, rare, stats, and rename operations.

Create and share reports and dashboards to answer data questions. Build a 403 by client IP report and a product sales dashboard with a column chart visualization.

Create pivot dashboards in Splunk to visualize items added to cart and referrer domains, filter by cart events, switch to a line chart, and save to a dashboard.

Enrich searches with lookups, linking static data from lookup tables or definitions to events. Automate enrichment using automatic lookups and lookup tables to add fields like product name and price.

Enrich data by implementing lookups and automatic lookups to replace product IDs with human readable product names and prices, then visualize total revenue by product name on a dashboard.

Explore scheduled reports and alerts in Splunk, distinguishing saved searches, scheduled searches, and condition-driven actions with examples like failed login attempts and off-hours email deliveries.

Learn how to set permissions for knowledge objects in Splunk, controlling read and edit access to reports, dashboards, alerts, and macros via app, owner, or run-as options.

Learn how Splunk alerts trigger on predefined criteria and route actions via emails, scripts, or webhooks to Slack or Teams, and compare scheduled interval alerts to real-time alerting for efficiency.

Create visibility with alerts by building a search for 500-level http statuses and configure a scheduled alert with throttling, email or log actions, and token-based dynamic content.

Develop a real-time alert in Splunk that notifies when more than zero failed admin logins occur within one minute, using the underscore audit internal index and throttling by host.

Finish the Splunk Core User Masterclass by encouraging practice with test exams and labs, and announce the upcoming Splunk Power User Masterclass and the course catalog.