Splunk the Complete course from Zero to Hero 2026

Explore the capacity planning manual PDF to finalize your Splunk architecture, covering license considerations, deployment server, license manager, hardware requirements, CPU, RAM, storage, IOPS for indexers and searches.

Learn how to estimate Splunk license requirements for small to large enterprises by collaboratively sizing data, accounting for log spikes, and applying a 10–20% buffer for future growth.

Learn to estimate storage for Splunk indexers using a rough EPS-based method, apply data retention policies, and size the deployment with hot, cold, archived, and frozen tiers.

Explore how to use a heavy forwarder for filtering noise, masking sensitive data, and boosting indexer performance, and evaluate deployment server, license master, and clustering needs.

Determine the optimal number of Splunk indexers from license size, using a practical rule of one indexer per 100 GB, and tailor search capacity to active users and alerts.

Learn Splunk hardware requirements, including unix-based deployments, searcher cores (2–64 at 2 GHz), indexer IOPS (minimum 200), RAM (2–64 GB), and prerequisites like disabling SELinux and transparent huge pages.

Explore scaling splunk for large enterprise, detailing multiple indexes and indexers, dedicated search heads for premium apps, and clustering strategies for high availability across sites.

Explore single site indexer clustering in Splunk, where indexers exchange data to prevent loss and enable retrieval if a failure occurs. Review deployment server, license manager, and forwarders.

Examine a medium enterprise Splunk architecture handling 100–200 gb per day with multiple indexes and searchers, dedicating one search for premium apps, and using heavy forwarders and deployment server considerations.

Explore three Splunk architectures—small, medium, and large enterprise—emphasizing distributed deployment, license considerations, and scalable data handling with forwarders, indexers, and searchers.

Design Splunk architecture using Visio stencils, learn high availability and multi-site clustering for enterprise deployments, and map components like indexers, forwarders, deployment servers, and license managers.

Understand multi-site Splunk clustering and high availability, detailing site one and site two with forwarders, indexers, searchers, deployment server, license manager, cluster master, and replication and search factors.

Set up firewall rules for Splunk, opening web port 8000 and management port 1889, plus 8191, 8065, and 9997 for universal forwarder; disable transparent huge pages per Splunk guidance.

Disable SELinux or whitelist Splunk to enable installation, then verify IOPS with Bonnie++ (>200 IOPS) after installing C++, adjust ulimits per Splunk guidance, and prepare licenses.

Explore the Splunk directory structure, including Splunk home locations across OS and vmware, bin and scripts, and .conf configuration basics.

Learn how Splunk's configuration file hierarchy works, from system default to app local and app default, with system local taking precedence and overriding lower levels, and test the hierarchy.

Perform a hands-on lab renaming the Splunk hostname across system local, app local, and app default inputs, using vi or alternative editors, then restart Splunk and verify login.

Explore how Splunk configuration precedence selects the host by traversing system local, app local, app default, and system default, with edits and restarts revealing the active source.

Explain how Splunk determines the final configuration at startup by precedence among system local, app default, and system default, and why you should not edit default folders.

Install Splunk enterprise across indexers, heavy forwarder, deployment server, and license master on Linux using rpm, with prerequisites like SELinux disabling, PHP disabling, firewall rules, and automate via a script.

install and configure the splunk universal forwarder on windows, accepting licenses, choosing directories, enabling active directory monitoring, and configuring deployment server via the splunk cli and configuration files.

Discover how to install and start Splunk search head on Windows and Linux, run as a non-root user, manage services, and understand universal forwarder data flow and generated certificates.

Install and start Splunk indexers, accept the license non-interactively, and log in to set a new admin password before verifying indexer access and basic firewall rules.

Install heavy forwarders and deployment servers, configure secure access with new passwords and https, and adjust networking security group to default setting while verifying by restarting services.

Enable ssl on Splunk enterprise instance by editing web.com to set Splunk web ssl to true, then restart Splunk to apply changes.

Learn to enable SSL for Splunk web using three methods: web UI, editing web.conf, and the Splunk CLI command; restart applies the changes and enables https.

Explore how the Splunk indexer processes and stores data from a forwarder, with logical index blocks like Windows and Linux, and learn the roles of index, indexes, and indexer.

Learn how to configure the splunk indexer to receive logs by enabling receiving in the splunk ui settings, adding a receiving port (default 9997) and adjusting ports as needed.

Enable log reception on a Splunk indexer via CLI, web UI, or editing inputs.conf, using port 9997, restart to apply changes, and verify connections.

Discover how to work with Splunk default index main, create various indexes for Windows, Linux, Mac, Apache, IaaS, or databases, and control access by teams to enable data segregation.

Create and manage Splunk indexes using Splunk Web and Splunk CLI, name Windows and Linux indexes, set sizes from 100 GB to 5000 GB, and edit indexes dot com file.

Edit indexes.conf to create a new index in local or system local, restart Splunk, and verify the index data remains under the default db location, checking size as needed.

Configure Splunk search using web, Splunk CLI, or configuration files and centralize settings. Add an indexer, enable distributed search, verify health with internal logs, and run a basic search.

Configure a Splunk search head via CLI, add the indexer with remote credentials, and verify distributed search by querying logs.

Configure a Splunk search head by editing configuration files, copying the trusted key to the indexers, and updating dest_search.conf to include all indexers, then verify health and perform internal searches.

Configure a heavy forwarder to receive data via Splunk Web and CLI, enable a port receiver, and forward logs to an indexer using multiple methods.

Configure the heavy forwarder by editing outputs.conf to define a tcpout stanza with a default indexer group, restart Splunk, and verify the new forward server.

Configure deployment server by creating a server class .conf file under system local to centralize configuration management in Splunk infrastructure, enabling enterprise level deployment.

Configure a Splunk deployment server, enable via server class conf, restart to access the user interface, create Apps group, deploy apps, and add clients using Splunk CLI or configuration files.

Configure and add Splunk clients to the deployment server using the Splunk utility or deployment client.conf, enabling forwarders, indexers, and universal forwarders to receive configurations via server class.

Configure the universal forwarder to send logs to a Splunk indexer using CLI or outputs.conf, then verify the indexer receives data by checking port 9997 and search results.

Configure the Splunk license manager on your deployment server, apply a license via web or XML upload, and verify a 10 GB learning license for a Splunk instance.

Configure splunk licenses with pools and quotas, assign licenses to indexer groups, and set a master license manager with slave indexers while monitoring consumption on the licensing page.

Upload data to Splunk and configure indexing, source types, and field extraction while simulating real-time log transfer from local to cloud using the universal forwarder, indexer, and searcher.

Add data to Splunk by editing inputs.conf to monitor a folder with the universal forwarder, restart the forwarder, and verify logs in search across hosts and sources.

Learn to add data to Splunk via the CLI by creating a new monitor input with the universal forwarder, editing inputs.conf, and confirming the configuration on both Windows and Linux.

Learn to upload data into Splunk using a universal forwarder, editing configuration, and deployment server, then verify with searches and parsing to extract IP address and top country.

Learn how to enrich Splunk data by configuring source type and host fields, rename source types with input.conf, and use them as powerful filters for analysis.

The lecture explains how the source field stores log locations and can be renamed to reflect collection methods like Bash, Python, API, or PowerShell, and modify with inputs.conf.

Explore field extraction in Splunk, using props and transforms and the interactive field extractor (IFX) to turn raw data such as access logs into meaningful fields through delimiter-based and regex approaches.

Learn to extract fields in Splunk using rex and regex, understand temporary versus permanent field creation with props and transforms, and practice building regex to capture an IP address.

Learn to add field extraction in Splunk using regex definitions and rex to extract an IP address, then visualize its location with geo stats.

Discover how to search logs with regular expressions in Splunk using Rex and the rejects command, filtering for add to cart, IP addresses, and subnets.

Learn to make field extraction permanent in Splunk by editing props and transforms, reload with extract command, and view fields like IP address and file name across searches.

Learn to extract fields using props and the extract command, then use a report with transforms for bulk field extraction via regex and mapping to ip address fields.

Deploy props and transforms, manage configurations on the deployments server, and place field extractions in a local location (system local or APS local) to control visibility in Splunk.

Learn how to create event types in Splunk to group similar events, enrich data with knowledge objects, and manage permissions and sharing.

Create and refine event types in Splunk to categorize access logs by status, saving access_logs_200 to filter 200 responses and generate event_types.conf.

Create and manage tags in Splunk by assigning field name and value pairs, link them to event types, and search and store tag configurations in settings and config files.

Create and apply manual tags in Splunk to refine searches, using event type, access, and apache logs to enrich data in the search index.

Create and share lookups in Splunk to enrich events by mapping fields from csv files like prices.csv, then apply them in searches to add product id, name, price.

Learn to use lookups in Splunk to enrich searches with product name, price, and sale price from a csv, and locate where lookups are stored.

Explore a lookups use case in splunk by creating a status description lookup to enrich http status codes in access logs, configuring lookups, uploading a csv, and validating in search.

Learn to create and share macros in Splunk, reusing searches across apps and users, and manage macro files and permissions for private or shared use.

Master searching in Splunk by narrowing to the main index, filtering by host, and using free form search with and/or/not operators to refine results.

Explore Splunk search modes to refine queries, filter status values, and visualize results using fast, smart, and verbose modes, with field extraction and log validation.

Create alerts in Splunk by building a search query, selecting real-time or scheduled runs, and configuring alert actions, throttling, and visibility with examples of 400–500 errors.

Explains configuring Splunk alerts: schedule and trigger conditions, throttle to suppress repeats, and actions such as email, logging, scripts, and shared access permissions.

Locate, edit, and manage Splunk alerts in the alerts tab, adjusting status and trigger queries. Configure real time or cron schedules, and attach actions like email or scripts.

Create targeted Splunk reports by defining criteria and actions such as email or script execution, and explore report acceleration, permissions, and monthly IP geolocation summaries.

Schedule a monthly Splunk report on the first day at 9:00, with a 5–10 minute window and optional pdf email delivery; acceleration pre-runs speed up dashboards with last three months.

Embed Splunk reports into external applications by configuring embedding features, scheduling runs, and testing iframes. Access visualizations via iframe URLs and APIs to power third-party dashboards.

Create and customize Splunk dashboards by adding panels, editing the dashboard source, exporting as pdf, and sharing with users, with use cases like top visiting IPs by country and city.

Add and arrange panels in Splunk dashboards using bar, column, statistics, and pie charts. Learn to add panels from reports, clone dashboards, and schedule reports.

Edit dashboards by modifying the source XML to view panel details, rows, and column elements, colors, scales, and layout, then export or schedule PDF deliveries for email sharing.

Enhance your Splunk dashboard by adding time range filters and drill-down options, using XML editing and tokens to pass values to panels and auto reload with synchronized time.

Explore using the dashboard filters in Splunk, including time tokens and a text box for source IP, applying token values across panels to refresh dashboards.

Learn to build and customize splunk dashboard filters with dropdowns and text boxes, using tokens and xml edits. Apply and save searches, and configure static options with future dynamic filters.

Create dynamic dropdown filters in Splunk dashboards by configuring edit mode, adding input, and using tokens with a static all option; demonstrates refreshing panels with IP-based searches.

Demonstrate drill down in splunk dashboards to narrow down events by ip or host and pass selected values to other dashboards or the same dashboard for deeper logs.

Configure drill down in Splunk dashboards using edit mode or the web console, linking to another dashboard and passing tokens via form data with the click value.

Learn how to drill down from one Splunk dashboard to another (or to the same dashboard) by passing values, time, and tokens to dynamic searches and charts.

Configure a Splunk workflow to turn a client IP into one-click external lookups and internal asset checks, using event and field menus to enrich dashboards and drill-downs.

Create a Splunk workflow using workflow actions, defining a Google IP address label and mapping it to client IP and related fields, then configure a link or search action.

Explore a Splunk workflow demo that creates event actions, enriches IP data with lookups including the Google client IP, and shows blacklist checks, threat-field validation, incidents, and product pricing lookups.

Explore the built-in visualization options in Splunk, from single value metrics to radial and marker gauges, and learn to customize color ranges, filters, and drill-downs in a demo dashboard.

Customize Splunk visualizations from filter and marker gauges to bar, column, pie, and scatter charts. Adjust color ranges, switch between line and area visuals, and use geolocation.

Edit Splunk dashboards with xml, mastering raw elements, tokens, and panel structures to configure multiple panels, filters, and submit actions, including chart queries and time settings.

Edit XML to add a new panel to Splunk dashboards, configure charting options and drill-down settings, and reuse rows and panels by copying and updating the dashboard source.

Explore out-of-the-box Splunk dashboards with dashboard examples app and customize visualizations using JavaScript and CSS, including charts, tables, single values, map elements, raw events, and HTML displays in the lab.

Learn to build and customize Splunk dashboards with JavaScript and CSS, visualize search results, and map user journeys and traffic flow using the app’s 97 included dashboards.

Learn how to share, export, and schedule Splunk dashboards, manage permissions, and deliver PDF or print copies, including tips for dashboards with or without filters.

Understand what add-ons are and how to install them in Splunk, including downloading, registering on Splunk base, and configuring data collection, field extractions, and customization.

Install and configure the Splunk add-on via Splunk web or Splunk base, restart requirements, and understand its role in Windows data inputs like Windows event logs and PowerShell scripts.

Install and inspect a Splunk add-on by copying apps into the Splunk etc/apps directory, restarting, and examining default versus local configuration files such as props and transforms.

Install a Splunk app by copying and extracting the zip into the Splunk apps directory, restart Splunk, and explore a dashboard-rich interface with about 97 dashboards and various visualizations.

Disable a dashboard example or any app in Splunk via web, CLI, or Linux, using the package name with the disable command and restarting to verify in manage apps.

Create your own Splunk apps by packaging configuration files for dashboards and visualizations. Learn how to install, customize, and publish your app to the Splunk portal.

Copy the sample app to a new demo app with Linux CLI, edit metadata and the app icon, enable and make it visible, then restart Splunk to load it.

Customize Splunk app navigation with multiple menus and submenus, rename or delete items, and set the dashboard as the entry view by editing the default XML in a local app.

Restart the Splunk instance to apply visualization changes, then add a demo dashboard to navigation by creating views and updating default.xml for access to collections, data sets, reports, and alerts.

Create and customize Splunk apps using Splunk web, set app label and folder, specify version and author, add assets, and compare bare bones versus sample templates for navigation.

Learn to customize a Splunk web app by editing the navigation using Splunk Web, adding a main menu and submenu via XML, and validating the XML on save.

Place static content—css, javascript, images, and xhtml—under the app server static folder, then package and submit the app to Splunk base for a 50 gb developer license.

Customize the Splunk login page by changing the background image using Splunk Web, then replace the logo with your company logo via the CLI method in the server settings.

Upload a custom login background and logo to the search app's app server static path via the Splunk web console, configure login custom logo in web.conf, and restart Splunk.

Discover how to customize a Splunk app icon by creating a static folder, copying your logo there, restarting Splunk, and seeing the new icon replace the default.

Configure deployment manager to centrally manage universal forwarders and indexes, monitor health via phoning home, and deploy apps to Windows and Linux server groups from a single console for management.

Learn to configure a Splunk deployment server with serverclass.conf by defining server groups, whitelisting hosts, and deploying apps to targeted clients, including restart behavior after deployment.

Configure server class and deployment client files, create an application server group, specify the repository location for deployable apps, and register universal forwarders as clients via the Splunk CLI.

Configure and deploy apps via a Splunk deployment server, validate universal forwarder and indexer connections, copy the Splunk dotcom app to ETSI deployment apps, reload, and manage enablement and restarts.

Deploy apps with the Splunk deployment server by creating a server group, adding a custom app, and whitelisting Windows and Linux clients. Verify deployment on indexers after saving.

Create and manage server class groups in Splunk using the deployment server and Splunk Web, then whitelist or blacklist clients by IP, domain, host name, or OS.

Create a base config for inputs and outputs across all Splunk instances and deploy it with the deployment server, including ssl certificate updates.

Deploy apps with a deployment server by creating a base config, updating outputs, and pushing an app to the universal forwarder; verify logs flow from forwarder to indexer and search.

Push updates to universal forwarders and other Splunk instances via the deployment server, modify base configs, reload deployments, and verify changes reflect across forwarders.

Forward data from Splunk to third-party devices by configuring forwarding, specifying target IP and port, and using props and transforms for selective routing to syslog servers or data storage.

Learn to manage Splunk users and roles, create and delete users, assign role-based privileges, and configure access controls across local, LDAP, and SAML authentication.

Create a custom Splunk role with a descriptive name and default app, and configure search restrictions, time limits, concurrent searches, real-time searches, and disk usage quotas.

Learn how to assign Splunk roles with inheritance from the default user, manage capabilities, and restrict searches to the Linux index by default.

Learn to create users in Splunk by navigating settings > access control > users, add a new user, choose a role, and fill optional details.

Learn how to create users in Splunk by accessing settings, adding a new user, assigning a role, and saving to enable login with restricted Linux access.

Discover how clustering in Splunk ensures high availability, data integrity, and performance by replicating data across indexers, including indexer, search, and forward clustering use cases.

Analyze the consequences of not using search head clustering in Splunk, showing how a failed search disrupts communication and blocks access to report dashboards, scheduled reports, and alerts across clusters.

Explore single site indexer clustering in Splunk, where data is replicated across multiple indexers to ensure availability. Even if one indexer fails, the remaining indexers preserve complete search results.

Explore multisite indexer clustering with high availability on Amazon, enabling data replication across site one and site two indexers to ensure availability.

Set up search head clustering to replicate reports, dashboards, and alerts across searchers, including custom and premium apps.

Explore configuring indexer clustering with replication and search factors for single-site setups, and site replication and site search factors for multi-site environments, including their overrides and data copies.

Evaluate search head clustering requirements and dedicate resource-intensive premium apps to a single search for optimal performance, as clustering is hard to manage during upgrades or patch releases.

Heavy forwarder clustering prevents UDP log loss by buffering when indexers or forwarders are unavailable, enabling logs to resume; use syslog NJI with a shared IP or OS cluster.

Explore configuring a Splunk environment with four instances, including a cluster master and two indexers, enabling an indexer cluster, and setting up a masternode for single-site and multi-site high availability.

Log in to set up Splunk indexer clustering with a master node and slave indexers. Configure management and replication ports, add indexers, and ensure the replication factor meets cluster requirements.

Learn to configure Splunk indexer clustering across indexers, including single-site and multi-site setups with high availability, using a deployment server for seamless replication and searchable data.

Explore hands-on indexer clustering setup in Splunk, examining auto-generated configuration files for cluster master and slave nodes, replication factors, and index replication concepts.

Enable replication across the indexer cluster by setting the replication factor on all members, then monitor the indexer cluster status as data replicates.

Demonstrates hands-on multisite indexer clustering, configuring a cluster master and indexers via a six-line system local server file, with site replication factor and site search factor overriding single-site factors.

configure multisite indexer clustering by defining site one as the master, enabling multi site mode, and setting site replication factor and site search factor across two indexers.

Configure a multisite Splunk indexer cluster by editing system local configurations to add peers, set site names and ports, and verify replication factor and search factor across two sites.

Configure single-site search head clustering on AWS, designate a captain, and prepare for multi-site clustering and high availability with Splunk CLIA and replicated data.

Initialize the search head cluster with the init parameter, configure management uri and replication factor, set the replication port (for example 9091), restart, and verify in the UI.

Configure Splunk search head clustering by initializing cluster members, bootstrapping a captain, and validating the captain manages servers for configuration replication, with deployment server enabling scaling across ten searches.

Validate search head clustering by creating a test user and verifying replication across cluster members, including dashboards, so configurations persist even if a search head goes down.

Bind Splunk to a specific IP address to limit listening to a chosen interface, by editing the Splunk configuration and restarting Splunk across instances and forwarders.

Rename splunk web and splunk daemon processes by stopping all splunk processes, editing the splunk launch configuration, and restarting with company-specific process names.

Learn how to disable and re-enable the Splunk web component from the web settings and from the configuration file, then restart the service to apply changes and restore access.

Learn selective restarting of the Splunk web service via the Splunk CLI. Use status, start, restart, and stop under Splunk home bin to apply UI changes quickly.

Learn to use the Splunk cli add, enable, and disable commands to configure inputs, forwarders, deployment clients, and maintenance mode during upgrades, migrations, and scaling.

Explore Splunk CLI show commands to quickly check cluster status, maintenance mode, and data locations, including Splunk DB location, server name, default hostname, and port 1889.

Use the btool utility to list and verify Splunk configurations, locate exact files, and identify syntax errors across default, apps, and local settings.

Learn quick hacks to restart only Splunk web components and refresh the user interface. Use shortcut commands and targeted URL options to reload props and transforms without full restarts.

Learn how to create data models in Splunk to speed up searches and enable richer visualizations, including root event setup, base searches, and child events for Windows and Apache logs.

Explore how to auto extract fields from logs, accelerate data models, and build instant reports and dashboards with pivots in Splunk data models, including managing acceleration status.

Explore building and using data models to run searches without writing queries, then edit tables to select fields, apply aggregations, and save lookups for reports.

Deploy universal forwarder across a large Windows and Linux environment using scripted MSI and bash installers, configure deployment server details, start Splunk, enable logging, and change the default admin password.

Build a Splunk enterprise multi-site architecture with indexer clustering, deployment server, and license manager, enabling cross-site data replication from a universal forwarder.

Build a scalable Splunk enterprise architecture on Amazon AWS in under 60 minutes by configuring deployment server, ssl, site-based indexer clustering, and multi-site search.