Splunk the Complete course from Zero to Hero 2026

Learn how to estimate Splunk license requirements for small to large enterprises by collaboratively sizing data, accounting for log spikes, and applying a 10–20% buffer for future growth.

Learn to estimate storage for Splunk indexers using a rough EPS-based method, apply data retention policies, and size the deployment with hot, cold, archived, and frozen tiers.

Explore how to use a heavy forwarder for filtering noise, masking sensitive data, and boosting indexer performance, and evaluate deployment server, license master, and clustering needs.

Determine the optimal number of Splunk indexers from license size, using a practical rule of one indexer per 100 GB, and tailor search capacity to active users and alerts.

Learn Splunk hardware requirements, including unix-based deployments, searcher cores (2–64 at 2 GHz), indexer IOPS (minimum 200), RAM (2–64 GB), and prerequisites like disabling SELinux and transparent huge pages.

Explore single site indexer clustering in Splunk, where indexers exchange data to prevent loss and enable retrieval if a failure occurs. Review deployment server, license manager, and forwarders.

Examine a medium enterprise Splunk architecture handling 100–200 gb per day with multiple indexes and searchers, dedicating one search for premium apps, and using heavy forwarders and deployment server considerations.

Design Splunk architecture using Visio stencils, learn high availability and multi-site clustering for enterprise deployments, and map components like indexers, forwarders, deployment servers, and license managers.

Understand multi-site Splunk clustering and high availability, detailing site one and site two with forwarders, indexers, searchers, deployment server, license manager, cluster master, and replication and search factors.

Set up firewall rules for Splunk, opening web port 8000 and management port 1889, plus 8191, 8065, and 9997 for universal forwarder; disable transparent huge pages per Splunk guidance.

Disable SELinux or whitelist Splunk to enable installation, then verify IOPS with Bonnie++ (>200 IOPS) after installing C++, adjust ulimits per Splunk guidance, and prepare licenses.

Explore the Splunk directory structure, including Splunk home locations across OS and vmware, bin and scripts, and .conf configuration basics.

Learn how Splunk's configuration file hierarchy works, from system default to app local and app default, with system local taking precedence and overriding lower levels, and test the hierarchy.

Perform a hands-on lab renaming the Splunk hostname across system local, app local, and app default inputs, using vi or alternative editors, then restart Splunk and verify login.

Install Splunk enterprise across indexers, heavy forwarder, deployment server, and license master on Linux using rpm, with prerequisites like SELinux disabling, PHP disabling, firewall rules, and automate via a script.

install and configure the splunk universal forwarder on windows, accepting licenses, choosing directories, enabling active directory monitoring, and configuring deployment server via the splunk cli and configuration files.

Discover how to install and start Splunk search head on Windows and Linux, run as a non-root user, manage services, and understand universal forwarder data flow and generated certificates.

Install and start Splunk indexers, accept the license non-interactively, and log in to set a new admin password before verifying indexer access and basic firewall rules.

Install heavy forwarders and deployment servers, configure secure access with new passwords and https, and adjust networking security group to default setting while verifying by restarting services.

Enable ssl on Splunk enterprise instance by editing web.com to set Splunk web ssl to true, then restart Splunk to apply changes.

Learn to enable SSL for Splunk web using three methods: web UI, editing web.conf, and the Splunk CLI command; restart applies the changes and enables https.

Enable log reception on a Splunk indexer via CLI, web UI, or editing inputs.conf, using port 9997, restart to apply changes, and verify connections.

Create and manage Splunk indexes using Splunk Web and Splunk CLI, name Windows and Linux indexes, set sizes from 100 GB to 5000 GB, and edit indexes dot com file.

Edit indexes.conf to create a new index in local or system local, restart Splunk, and verify the index data remains under the default db location, checking size as needed.

Configure Splunk search using web, Splunk CLI, or configuration files and centralize settings. Add an indexer, enable distributed search, verify health with internal logs, and run a basic search.

Configure a Splunk search head via CLI, add the indexer with remote credentials, and verify distributed search by querying logs.

Configure a Splunk search head by editing configuration files, copying the trusted key to the indexers, and updating dest_search.conf to include all indexers, then verify health and perform internal searches.

Configure a heavy forwarder to receive data via Splunk Web and CLI, enable a port receiver, and forward logs to an indexer using multiple methods.

Configure deployment server by creating a server class .conf file under system local to centralize configuration management in Splunk infrastructure, enabling enterprise level deployment.

Configure a Splunk deployment server, enable via server class conf, restart to access the user interface, create Apps group, deploy apps, and add clients using Splunk CLI or configuration files.

Configure splunk licenses with pools and quotas, assign licenses to indexer groups, and set a master license manager with slave indexers while monitoring consumption on the licensing page.

Learn to upload data into Splunk using a universal forwarder, editing configuration, and deployment server, then verify with searches and parsing to extract IP address and top country.

Explore field extraction in Splunk, using props and transforms and the interactive field extractor (IFX) to turn raw data such as access logs into meaningful fields through delimiter-based and regex approaches.

Learn to extract fields in Splunk using rex and regex, understand temporary versus permanent field creation with props and transforms, and practice building regex to capture an IP address.

Learn to add field extraction in Splunk using regex definitions and rex to extract an IP address, then visualize its location with geo stats.

Discover how to search logs with regular expressions in Splunk using Rex and the rejects command, filtering for add to cart, IP addresses, and subnets.

Learn to extract fields using props and the extract command, then use a report with transforms for bulk field extraction via regex and mapping to ip address fields.

Deploy props and transforms, manage configurations on the deployments server, and place field extractions in a local location (system local or APS local) to control visibility in Splunk.

Learn how to create event types in Splunk to group similar events, enrich data with knowledge objects, and manage permissions and sharing.

Create and refine event types in Splunk to categorize access logs by status, saving access_logs_200 to filter 200 responses and generate event_types.conf.

Create and apply manual tags in Splunk to refine searches, using event type, access, and apache logs to enrich data in the search index.

Learn to use lookups in Splunk to enrich searches with product name, price, and sale price from a csv, and locate where lookups are stored.

Explore a lookups use case in splunk by creating a status description lookup to enrich http status codes in access logs, configuring lookups, uploading a csv, and validating in search.

Learn to create and share macros in Splunk, reusing searches across apps and users, and manage macro files and permissions for private or shared use.

Explore Splunk search modes to refine queries, filter status values, and visualize results using fast, smart, and verbose modes, with field extraction and log validation.

Create alerts in Splunk by building a search query, selecting real-time or scheduled runs, and configuring alert actions, throttling, and visibility with examples of 400–500 errors.

Explains configuring Splunk alerts: schedule and trigger conditions, throttle to suppress repeats, and actions such as email, logging, scripts, and shared access permissions.

Locate, edit, and manage Splunk alerts in the alerts tab, adjusting status and trigger queries. Configure real time or cron schedules, and attach actions like email or scripts.

Create targeted Splunk reports by defining criteria and actions such as email or script execution, and explore report acceleration, permissions, and monthly IP geolocation summaries.

Schedule a monthly Splunk report on the first day at 9:00, with a 5–10 minute window and optional pdf email delivery; acceleration pre-runs speed up dashboards with last three months.

Create and customize Splunk dashboards by adding panels, editing the dashboard source, exporting as pdf, and sharing with users, with use cases like top visiting IPs by country and city.

Edit dashboards by modifying the source XML to view panel details, rows, and column elements, colors, scales, and layout, then export or schedule PDF deliveries for email sharing.

Explore using the dashboard filters in Splunk, including time tokens and a text box for source IP, applying token values across panels to refresh dashboards.

Learn to build and customize splunk dashboard filters with dropdowns and text boxes, using tokens and xml edits. Apply and save searches, and configure static options with future dynamic filters.

Demonstrate drill down in splunk dashboards to narrow down events by ip or host and pass selected values to other dashboards or the same dashboard for deeper logs.

Learn how to drill down from one Splunk dashboard to another (or to the same dashboard) by passing values, time, and tokens to dynamic searches and charts.

Configure a Splunk workflow to turn a client IP into one-click external lookups and internal asset checks, using event and field menus to enrich dashboards and drill-downs.

Create a Splunk workflow using workflow actions, defining a Google IP address label and mapping it to client IP and related fields, then configure a link or search action.

Explore a Splunk workflow demo that creates event actions, enriches IP data with lookups including the Google client IP, and shows blacklist checks, threat-field validation, incidents, and product pricing lookups.

Customize Splunk visualizations from filter and marker gauges to bar, column, pie, and scatter charts. Adjust color ranges, switch between line and area visuals, and use geolocation.

Edit XML to add a new panel to Splunk dashboards, configure charting options and drill-down settings, and reuse rows and panels by copying and updating the dashboard source.

Learn to build and customize Splunk dashboards with JavaScript and CSS, visualize search results, and map user journeys and traffic flow using the app’s 97 included dashboards.

Learn how to share, export, and schedule Splunk dashboards, manage permissions, and deliver PDF or print copies, including tips for dashboards with or without filters.

Understand what add-ons are and how to install them in Splunk, including downloading, registering on Splunk base, and configuring data collection, field extractions, and customization.

Install and inspect a Splunk add-on by copying apps into the Splunk etc/apps directory, restarting, and examining default versus local configuration files such as props and transforms.

Install a Splunk app by copying and extracting the zip into the Splunk apps directory, restart Splunk, and explore a dashboard-rich interface with about 97 dashboards and various visualizations.

Disable a dashboard example or any app in Splunk via web, CLI, or Linux, using the package name with the disable command and restarting to verify in manage apps.

Create your own Splunk apps by packaging configuration files for dashboards and visualizations. Learn how to install, customize, and publish your app to the Splunk portal.

Copy the sample app to a new demo app with Linux CLI, edit metadata and the app icon, enable and make it visible, then restart Splunk to load it.

Customize Splunk app navigation with multiple menus and submenus, rename or delete items, and set the dashboard as the entry view by editing the default XML in a local app.

Restart the Splunk instance to apply visualization changes, then add a demo dashboard to navigation by creating views and updating default.xml for access to collections, data sets, reports, and alerts.

Create and customize Splunk apps using Splunk web, set app label and folder, specify version and author, add assets, and compare bare bones versus sample templates for navigation.

Place static content—css, javascript, images, and xhtml—under the app server static folder, then package and submit the app to Splunk base for a 50 gb developer license.

Customize the Splunk login page by changing the background image using Splunk Web, then replace the logo with your company logo via the CLI method in the server settings.

Upload a custom login background and logo to the search app's app server static path via the Splunk web console, configure login custom logo in web.conf, and restart Splunk.

Discover how to customize a Splunk app icon by creating a static folder, copying your logo there, restarting Splunk, and seeing the new icon replace the default.

Configure deployment manager to centrally manage universal forwarders and indexes, monitor health via phoning home, and deploy apps to Windows and Linux server groups from a single console for management.

Learn to configure a Splunk deployment server with serverclass.conf by defining server groups, whitelisting hosts, and deploying apps to targeted clients, including restart behavior after deployment.

Configure server class and deployment client files, create an application server group, specify the repository location for deployable apps, and register universal forwarders as clients via the Splunk CLI.

Configure and deploy apps via a Splunk deployment server, validate universal forwarder and indexer connections, copy the Splunk dotcom app to ETSI deployment apps, reload, and manage enablement and restarts.

Create and manage server class groups in Splunk using the deployment server and Splunk Web, then whitelist or blacklist clients by IP, domain, host name, or OS.

Create a base config for inputs and outputs across all Splunk instances and deploy it with the deployment server, including ssl certificate updates.

Deploy apps with a deployment server by creating a base config, updating outputs, and pushing an app to the universal forwarder; verify logs flow from forwarder to indexer and search.

Push updates to universal forwarders and other Splunk instances via the deployment server, modify base configs, reload deployments, and verify changes reflect across forwarders.

Forward data from Splunk to third-party devices by configuring forwarding, specifying target IP and port, and using props and transforms for selective routing to syslog servers or data storage.

Learn to manage Splunk users and roles, create and delete users, assign role-based privileges, and configure access controls across local, LDAP, and SAML authentication.

Create a custom Splunk role with a descriptive name and default app, and configure search restrictions, time limits, concurrent searches, real-time searches, and disk usage quotas.

Learn how to assign Splunk roles with inheritance from the default user, manage capabilities, and restrict searches to the Linux index by default.

Learn to create users in Splunk by navigating settings > access control > users, add a new user, choose a role, and fill optional details.

Learn how to create users in Splunk by accessing settings, adding a new user, assigning a role, and saving to enable login with restricted Linux access.

Discover how clustering in Splunk ensures high availability, data integrity, and performance by replicating data across indexers, including indexer, search, and forward clustering use cases.

Analyze the consequences of not using search head clustering in Splunk, showing how a failed search disrupts communication and blocks access to report dashboards, scheduled reports, and alerts across clusters.

Explore multisite indexer clustering with high availability on Amazon, enabling data replication across site one and site two indexers to ensure availability.

Set up search head clustering to replicate reports, dashboards, and alerts across searchers, including custom and premium apps.

Explore configuring indexer clustering with replication and search factors for single-site setups, and site replication and site search factors for multi-site environments, including their overrides and data copies.

Evaluate search head clustering requirements and dedicate resource-intensive premium apps to a single search for optimal performance, as clustering is hard to manage during upgrades or patch releases.

Heavy forwarder clustering prevents UDP log loss by buffering when indexers or forwarders are unavailable, enabling logs to resume; use syslog NJI with a shared IP or OS cluster.

Learn to configure Splunk indexer clustering across indexers, including single-site and multi-site setups with high availability, using a deployment server for seamless replication and searchable data.

Demonstrates hands-on multisite indexer clustering, configuring a cluster master and indexers via a six-line system local server file, with site replication factor and site search factor overriding single-site factors.

Initialize the search head cluster with the init parameter, configure management uri and replication factor, set the replication port (for example 9091), restart, and verify in the UI.

Configure Splunk search head clustering by initializing cluster members, bootstrapping a captain, and validating the captain manages servers for configuration replication, with deployment server enabling scaling across ten searches.

Bind Splunk to a specific IP address to limit listening to a chosen interface, by editing the Splunk configuration and restarting Splunk across instances and forwarders.

Learn selective restarting of the Splunk web service via the Splunk CLI. Use status, start, restart, and stop under Splunk home bin to apply UI changes quickly.

Learn to use the Splunk cli add, enable, and disable commands to configure inputs, forwarders, deployment clients, and maintenance mode during upgrades, migrations, and scaling.

Explore Splunk CLI show commands to quickly check cluster status, maintenance mode, and data locations, including Splunk DB location, server name, default hostname, and port 1889.

Use the btool utility to list and verify Splunk configurations, locate exact files, and identify syntax errors across default, apps, and local settings.

Learn quick hacks to restart only Splunk web components and refresh the user interface. Use shortcut commands and targeted URL options to reload props and transforms without full restarts.

Learn how to create data models in Splunk to speed up searches and enable richer visualizations, including root event setup, base searches, and child events for Windows and Apache logs.

Explore building and using data models to run searches without writing queries, then edit tables to select fields, apply aggregations, and save lookups for reports.

Build a scalable Splunk enterprise architecture on Amazon AWS in under 60 minutes by configuring deployment server, ssl, site-based indexer clustering, and multi-site search.