Splunk the Complete course from Zero to Hero 2026

Learn how to estimate Splunk license requirements for small to large enterprises by collaboratively sizing data, accounting for log spikes, and applying a 10–20% buffer for future growth.

Learn to estimate storage for Splunk indexers using a rough EPS-based method, apply data retention policies, and size the deployment with hot, cold, archived, and frozen tiers.

Explore how to use a heavy forwarder for filtering noise, masking sensitive data, and boosting indexer performance, and evaluate deployment server, license master, and clustering needs.

Determine the optimal number of Splunk indexers from license size, using a practical rule of one indexer per 100 GB, and tailor search capacity to active users and alerts.

Learn Splunk hardware requirements, including unix-based deployments, searcher cores (2–64 at 2 GHz), indexer IOPS (minimum 200), RAM (2–64 GB), and prerequisites like disabling SELinux and transparent huge pages.

Explore single site indexer clustering in Splunk, where indexers exchange data to prevent loss and enable retrieval if a failure occurs. Review deployment server, license manager, and forwarders.

Examine a medium enterprise Splunk architecture handling 100–200 gb per day with multiple indexes and searchers, dedicating one search for premium apps, and using heavy forwarders and deployment server considerations.

Design Splunk architecture using Visio stencils, learn high availability and multi-site clustering for enterprise deployments, and map components like indexers, forwarders, deployment servers, and license managers.

Set up firewall rules for Splunk, opening web port 8000 and management port 1889, plus 8191, 8065, and 9997 for universal forwarder; disable transparent huge pages per Splunk guidance.

Disable SELinux or whitelist Splunk to enable installation, then verify IOPS with Bonnie++ (>200 IOPS) after installing C++, adjust ulimits per Splunk guidance, and prepare licenses.

Explore the Splunk directory structure, including Splunk home locations across OS and vmware, bin and scripts, and .conf configuration basics.

Learn how Splunk's configuration file hierarchy works, from system default to app local and app default, with system local taking precedence and overriding lower levels, and test the hierarchy.

install and configure the splunk universal forwarder on windows, accepting licenses, choosing directories, enabling active directory monitoring, and configuring deployment server via the splunk cli and configuration files.

Discover how to install and start Splunk search head on Windows and Linux, run as a non-root user, manage services, and understand universal forwarder data flow and generated certificates.

Install and start Splunk indexers, accept the license non-interactively, and log in to set a new admin password before verifying indexer access and basic firewall rules.

Install heavy forwarders and deployment servers, configure secure access with new passwords and https, and adjust networking security group to default setting while verifying by restarting services.

Learn to enable SSL for Splunk web using three methods: web UI, editing web.conf, and the Splunk CLI command; restart applies the changes and enables https.

Enable log reception on a Splunk indexer via CLI, web UI, or editing inputs.conf, using port 9997, restart to apply changes, and verify connections.

Create and manage Splunk indexes using Splunk Web and Splunk CLI, name Windows and Linux indexes, set sizes from 100 GB to 5000 GB, and edit indexes dot com file.

Configure a Splunk search head by editing configuration files, copying the trusted key to the indexers, and updating dest_search.conf to include all indexers, then verify health and perform internal searches.

Configure a heavy forwarder to receive data via Splunk Web and CLI, enable a port receiver, and forward logs to an indexer using multiple methods.

Configure deployment server by creating a server class .conf file under system local to centralize configuration management in Splunk infrastructure, enabling enterprise level deployment.

Configure a Splunk deployment server, enable via server class conf, restart to access the user interface, create Apps group, deploy apps, and add clients using Splunk CLI or configuration files.

Explore field extraction in Splunk, using props and transforms and the interactive field extractor (IFX) to turn raw data such as access logs into meaningful fields through delimiter-based and regex approaches.

Learn to extract fields in Splunk using rex and regex, understand temporary versus permanent field creation with props and transforms, and practice building regex to capture an IP address.

Learn to add field extraction in Splunk using regex definitions and rex to extract an IP address, then visualize its location with geo stats.

Create and refine event types in Splunk to categorize access logs by status, saving access_logs_200 to filter 200 responses and generate event_types.conf.

Create and apply manual tags in Splunk to refine searches, using event type, access, and apache logs to enrich data in the search index.

Learn to use lookups in Splunk to enrich searches with product name, price, and sale price from a csv, and locate where lookups are stored.

Explore a lookups use case in splunk by creating a status description lookup to enrich http status codes in access logs, configuring lookups, uploading a csv, and validating in search.

Learn to create and share macros in Splunk, reusing searches across apps and users, and manage macro files and permissions for private or shared use.

Explore Splunk search modes to refine queries, filter status values, and visualize results using fast, smart, and verbose modes, with field extraction and log validation.

Explains configuring Splunk alerts: schedule and trigger conditions, throttle to suppress repeats, and actions such as email, logging, scripts, and shared access permissions.

Locate, edit, and manage Splunk alerts in the alerts tab, adjusting status and trigger queries. Configure real time or cron schedules, and attach actions like email or scripts.

Create targeted Splunk reports by defining criteria and actions such as email or script execution, and explore report acceleration, permissions, and monthly IP geolocation summaries.

Demonstrate drill down in splunk dashboards to narrow down events by ip or host and pass selected values to other dashboards or the same dashboard for deeper logs.

Configure a Splunk workflow to turn a client IP into one-click external lookups and internal asset checks, using event and field menus to enrich dashboards and drill-downs.

Create a Splunk workflow using workflow actions, defining a Google IP address label and mapping it to client IP and related fields, then configure a link or search action.

Explore a Splunk workflow demo that creates event actions, enriches IP data with lookups including the Google client IP, and shows blacklist checks, threat-field validation, incidents, and product pricing lookups.

Customize Splunk visualizations from filter and marker gauges to bar, column, pie, and scatter charts. Adjust color ranges, switch between line and area visuals, and use geolocation.

Learn to build and customize Splunk dashboards with JavaScript and CSS, visualize search results, and map user journeys and traffic flow using the app’s 97 included dashboards.

Understand what add-ons are and how to install them in Splunk, including downloading, registering on Splunk base, and configuring data collection, field extractions, and customization.

Install a Splunk app by copying and extracting the zip into the Splunk apps directory, restart Splunk, and explore a dashboard-rich interface with about 97 dashboards and various visualizations.

Disable a dashboard example or any app in Splunk via web, CLI, or Linux, using the package name with the disable command and restarting to verify in manage apps.

Create your own Splunk apps by packaging configuration files for dashboards and visualizations. Learn how to install, customize, and publish your app to the Splunk portal.

Create and customize Splunk apps using Splunk web, set app label and folder, specify version and author, add assets, and compare bare bones versus sample templates for navigation.

Place static content—css, javascript, images, and xhtml—under the app server static folder, then package and submit the app to Splunk base for a 50 gb developer license.

Customize the Splunk login page by changing the background image using Splunk Web, then replace the logo with your company logo via the CLI method in the server settings.

Configure deployment manager to centrally manage universal forwarders and indexes, monitor health via phoning home, and deploy apps to Windows and Linux server groups from a single console for management.

Learn to configure a Splunk deployment server with serverclass.conf by defining server groups, whitelisting hosts, and deploying apps to targeted clients, including restart behavior after deployment.

Configure server class and deployment client files, create an application server group, specify the repository location for deployable apps, and register universal forwarders as clients via the Splunk CLI.

Configure and deploy apps via a Splunk deployment server, validate universal forwarder and indexer connections, copy the Splunk dotcom app to ETSI deployment apps, reload, and manage enablement and restarts.

Deploy apps with a deployment server by creating a base config, updating outputs, and pushing an app to the universal forwarder; verify logs flow from forwarder to indexer and search.

Push updates to universal forwarders and other Splunk instances via the deployment server, modify base configs, reload deployments, and verify changes reflect across forwarders.

Forward data from Splunk to third-party devices by configuring forwarding, specifying target IP and port, and using props and transforms for selective routing to syslog servers or data storage.

Learn to manage Splunk users and roles, create and delete users, assign role-based privileges, and configure access controls across local, LDAP, and SAML authentication.

Create a custom Splunk role with a descriptive name and default app, and configure search restrictions, time limits, concurrent searches, real-time searches, and disk usage quotas.

Learn to create users in Splunk by navigating settings > access control > users, add a new user, choose a role, and fill optional details.

Discover how clustering in Splunk ensures high availability, data integrity, and performance by replicating data across indexers, including indexer, search, and forward clustering use cases.

Analyze the consequences of not using search head clustering in Splunk, showing how a failed search disrupts communication and blocks access to report dashboards, scheduled reports, and alerts across clusters.

Explore multisite indexer clustering with high availability on Amazon, enabling data replication across site one and site two indexers to ensure availability.

Set up search head clustering to replicate reports, dashboards, and alerts across searchers, including custom and premium apps.

Explore configuring indexer clustering with replication and search factors for single-site setups, and site replication and site search factors for multi-site environments, including their overrides and data copies.

Heavy forwarder clustering prevents UDP log loss by buffering when indexers or forwarders are unavailable, enabling logs to resume; use syslog NJI with a shared IP or OS cluster.

Learn to configure Splunk indexer clustering across indexers, including single-site and multi-site setups with high availability, using a deployment server for seamless replication and searchable data.

Initialize the search head cluster with the init parameter, configure management uri and replication factor, set the replication port (for example 9091), restart, and verify in the UI.

Configure Splunk search head clustering by initializing cluster members, bootstrapping a captain, and validating the captain manages servers for configuration replication, with deployment server enabling scaling across ten searches.

Bind Splunk to a specific IP address to limit listening to a chosen interface, by editing the Splunk configuration and restarting Splunk across instances and forwarders.

Learn to use the Splunk cli add, enable, and disable commands to configure inputs, forwarders, deployment clients, and maintenance mode during upgrades, migrations, and scaling.

Learn how to create data models in Splunk to speed up searches and enable richer visualizations, including root event setup, base searches, and child events for Windows and Apache logs.

Explore building and using data models to run searches without writing queries, then edit tables to select fields, apply aggregations, and save lookups for reports.

Build a scalable Splunk enterprise architecture on Amazon AWS in under 60 minutes by configuring deployment server, ssl, site-based indexer clustering, and multi-site search.