The Complete Splunk Core Certified Power User Course

Explore Splunk's base visualizations and transforming commands that turn data into statistics tables, then apply chart, time chart, and spatial visuals like scatter and bubble charts.

Explore how Splunk builds visualizations from index data using transforming commands and statistics tables—single, multi, time series—and map columns to chart axes for gauges, maps, and single value visualizations.

Learn how to generate statistics from Splunk data and create visualizations, including line, area, column, bar charts, pie, scatter, bubble charts, gauges, and maps.

Compare single, multi-series, and time series statistics tables and mappings to column, bar, and pie charts using x and y axes and legends to show partner events and time trends.

Master the chart command for single-series statistics in Splunk, using a statistics function on the y axis and over field on the x axis, with column, bar, and pie visualizations.

Master the chart command to create multi-series statistics by splitting node names with a by clause and visualizing results as column charts. Control display with limit, null, and order options.

Use the timechart command to generate time series statistics in Splunk, plotting time on the x axis and metrics like count or average duration on the y axis.

Use the timechart command to produce multi-series statistics split by a by-field like node name or partner, with line or area charts and span-based time bucketing.

Explore scatter and bubble charts to visualize relationships among discrete values in Splunk. Use category, x axis, y axis, and bubble size to reveal two- and three-dimensional patterns.

Explore formatting options for statistics tables and visualizations in Splunk, enabling totals and percentages with format summary and add totals, including row totals and column totals and labeled fields.

Explore visualization formatting in Splunk by configuring column and line charts, handling null values, axis labeling, and overlays, then create multi-series charts with overlaid percentages.

Explore advanced visualizations in Splunk, including single value visuals, gauges, maps, with chart and time chart transforming commands, IP location command for cluster and choropleth maps, and trend lines.

Explore how to create and format single value visualizations in Splunk, counting last 24 hours failures, adding captions, and applying color ranges, sparklines, and gauges.

Learn to map public IP data by adding location fields with the IP location command, create cluster maps with geo stats, and build choropleth maps using geom and geospatial lookups.

Explore moving averages in Splunk with the trend line command—simple, exponential, and weighted types over a chosen period—to reveal trends and overlay charts for stock-market-like patterns.

Learn to filter and format data in Splunk by using eval to create and calculate fields, round values, convert and concatenate strings, and filter with search and where.

Explore using the eval command in Splunk to create and overwrite fields, perform calculations, and apply conditional logic on event data and statistics tables.

Calculate fields with the eval command by multiplying duration and price to create a call price field, then derive a success percentage from a statistics table and sort by it.

Master the round function within the eval command to round total sales and total duration to integers, and success percentage to two decimals, including overwriting existing fields when needed.

Learn to format and convert fields in Splunk using the tostring function with duration, commas, and hex options, applying them in eval to transform total events, sales, and durations.

Master string concatenation in Splunk by using the plus or dot operator in eval, formatting total sales with a dollar sign and success percentage with a percent sign.

Explore the eval function in Splunk, how it differs from the eval command, and count total, failed, and successful events with a stats table, including as clause and case sensitivity.

Use the eval command with the if function to create calculated fields, such as call result (success or failure) from a 200 response code and zip code length.

Explore case function in Splunk, using eval to categorize duration into low, medium, high, and to map states to regions with a default US territory.

Explore how to use the field null command to fill null fields, including setting not applicable or zero values for the failure code field in successful events in Splunk.

Explore how to filter Splunk search results using the search command, including implied pre-pipe behavior and generating commands, with case-insensitive fields, wildcards, and region and success percentage filters.

Master using the where command to filter Splunk search results, compare it with search, and apply eval expressions and functions like isnull, match, and like for regions, cities, and IPs.

Explore how to correlate events in Splunk by grouping related pieces of information from multiple data sources using the transaction command, and learn to compare it with the stats command.

Learn to correlate events across hosts into a single user transaction using session ID or IP address as common fields, and use Splunk's transaction command to group events within time window.

Use the transaction command in Splunk to correlate events by fields such as session ID, IP, and MAC address, grouping them into transactions with event count and duration.

Learn to filter transactions in Splunk by grouping events with session ID or with user IP and device Mac, filtering for action equals purchase, using search, where, and highlight commands.

Learn to use the Splunk transaction command with max span, max pause, and max events, plus starts with and ends with, to group events by session ID and client IP.

Explore how to report on transactions by grouping events into transactions, applying chart, time chart, stats, and event stats commands, and visualizing by event count with bar and line charts.

In Splunk, compare transaction and stats commands: use transaction to correlate events with constraints, but it's resource intensive; use stats for large datasets to group by fields and perform calculations.

Create and manage fields in Splunk, use knowledge objects for field extraction and auto discovery, and apply delimiter and regex-based extractions to give your data meaning.

Explore knowledge objects in Splunk to save searches and visualizations for reuse. Learn to classify, enrich, and normalize fields, event types, tags, lookups, data models, CIM, and naming conventions.

Assign meaning to raw data by performing field extractions that map values to named fields, enabling easier analysis in splunk through index-time and search-time extractions.

Learn to distinguish structured from unstructured data, recognize CSV, JSON, and XML formats, and understand why standardized formats matter for field extraction in Splunk.

Discover field discovery in Splunk, which auto extracts field value pairs and reveals fields in smart or verbose mode. Understand metadata fields and underscore time and underscore row.

Learn how to extract fields in Splunk with the field extractor utility, creating knowledge objects for a source or source type, and choosing regular expression or delimiter methods.

Learn delimiter based field extractions in Splunk for CSV data, using the delimiters method on source type EPL info 2223, and save the extraction as a knowledge object.

Learn to perform regular expression based field extraction on unstructured data, using the field extractor utility to pull user and source IP fields from the linux secure source type.

Modify regex expressions in Splunk’s field extractor to extract additional fields and save them as a knowledge object. Preview edits, then verify results on the linux secure source type.

Explore the second set of knowledge objects in Splunk: field aliases and calculated fields, learn what they are, and how to create them for use at search time.

Understand field aliases that normalize data from web access, security, and change logs by applying aliases to extracted fields, then using them in lookups.

Learn to create field aliases in Splunk, map fields like client IP to a source type alias, and enable cross-source normalization for unified searches.

Discover how to create and save calculated fields in Splunk by using eval on extracted fields, avoiding re-evaluation, and leveraging knowledge objects with lookups and events.

Learn to create calculated fields in Splunk using the eval and substring approach, save them as knowledge objects, and use them in searches to analyze results.

Explore creating and managing tags and event types as knowledge objects in Splunk, learn how to create and tag event types, and compare event types with saved reports.

Tag field value pairs to label events, enable tag-based filtering, and search by tag; a single event may have multiple tags, and tags are case sensitive.

Learn how to create and apply tags to Splunk events by tagging state values va, md, and dc as DMV, then search with tag syntax, including field-specific searches and wildcards.

Access and manage tags through settings, listing by field value pair or by tag name. Change permissions, disable tags, and rename tag values to affect searches.

Explore how event types categorize search results in Splunk, save searches as event types, and tag events for knowledge sharing and data modeling with the common information model.

discover three methods to create event types in splunk—from a search, the settings menu, and the event type builder—then name, color, tag, and set priority to resolve overlaps.

Tag event types to support the common information model by tagging field value pairs and applying tags via edit tags or the settings menu, enabling search by tags.

Discover how event types rely on base searches, lack saved time ranges, and can be tagged. Contrast with saved reports that include time ranges, formatting, sharing, and dashboard use.

Explore macros as a knowledge object in Splunk, learn to create basic macros and macros with arguments, and validate their arguments.

Learn how to create and use macros in Splunk to reuse searches, pass one or more arguments at search time, and execute them with backticks, while understanding time range behavior.

Define a no-argument macro in Splunk under advanced search > search macros by naming it and providing a definition, then execute with backticks and set the time range at runtime.

Create a macro with three arguments—region, error code, and dimension—in Splunk, and pass arguments with dollar signs to count and percentage of errors across regions and dimensions.

Validate macro arguments in a Splunk macro using validation expressions and error messages. Ensure the error code is a three-digit integer, with examples of invalid inputs triggering feedback.

Explore three types of workflow actions in Splunk, built on knowledge objects like fields, field aliases, tags, event types, and macros, and learn to create get and post workflow actions.

Explore how workflow actions in Splunk interact with external sources to retrieve IP details, post event data, or run secondary searches. Discover get, post, and search workflow actions.

Learn how to create a get workflow action in Splunk by configuring its name, label, URI, and field references, linking to the Whois site to fetch IP details.

Create a purchase post 403 event type and apply a post workflow action to post matching events to an external resource, including post arguments and raw event body.

Create a search workflow action in Splunk to run a second search using an IP address field, show in the event and field menus, and reuse the original time range.