Splunk Essentials Course: Complete Training for Beginners

Discover what Splunk is and how machine-generated data from hosts like routers and sensors is collected, indexed, and analyzed to monitor services and improve user experiences.

Centralize data in Splunk to improve the customer experience. Detect and resolve service issues proactively across connectivity, voice, video, and conferencing.

Use Splunk to centralize logs and machine-generated data from network nodes, enabling near real-time detection of issues and faster collaboration between the network operation center and vendors.

Discover the essential skills and certifications to become an effective Splunk user and expert, from core user and power certifications to admin, architect, and security certifications, plus bridging domain expertise.

Explore the components that make up Splunk, from host data and forwarders to indexes and search heads, and the management tools that keep deployments, licensing, and monitoring running.

Explore Splunk’s core instances and components, including forwarders, indexes, search heads, deployment server, license manager, and monitoring console, and compare single instance versus distributed deployment.

Explore how Splunk instances become components from trial or commercial licenses to deploying on physical, virtual, or containerized machines; configure instance as indexer, search head, deployment server, and monitoring console.

Learn how forwarders collect data from host machines (including files and directories) and send it to Splunk for indexing, distinguishing universal vs heavy forwarders.

Discover how the Splunk indexer receives data, parses it into events, assigns metadata, and writes to hot, warm, and cold buckets with cross-bucket search, retention, archiving, thawing, and indexer clustering.

Discover how the search head in Splunk searches indexed data across indexers, with cluster concepts like search head cluster, load balancer, cluster captain, and cluster deployer ensuring seamless results.

Learn how the deployment server distributes content, configurations, and apps to deployment clients like forwarders, indexers, and search heads, using deployment apps and forwarder management in the Splunk web UI.

Understand Splunk licensing, including volume-based and infrastructure-based licenses and feature licenses, and how the license manager tracks data and vCPUs across indexes, search heads, and stacks.

Use the monitoring console to inspect Splunk's internal logs from underscore-indexed data, view deployment topology and performance, and spot issues by building dashboards of CPU, memory, and concurrent searches.

Single instance deployment runs all Splunk components on one machine, as an indexer, a search head, and a deployment server; distributed deployment scales by spreading components across multiple machines.

Discover how to assemble Splunk components into deployment solutions. Compare deployment types—from single instance departmental deployments to small, medium, and large enterprise architectures, and the factors to determine them.

Explore designing Splunk deployments by data ingestion, license, and user load, then apply indexer and search head clustering for high availability across departmental, small, and medium to large enterprises.

Explore the single instance departmental deployment in Splunk, covering indexing volume under 20 GB per day, 1–100 folders, under ten concurrent users, with indexer and search head on one machine.

Explore small enterprise deployment in Splunk essentials, handling 20–100 GB per day, 100–200 forwarders, and 10–100 concurrent users, with 2–3 indexes and a single search head.

Medium to large enterprise deployments in Splunk involve hundreds to thousands of forwarders and users, with ingestion from 100–300 gig to 2 terabytes per day and more than three indexes.

Explore two deployment architectures for Splunk: enterprise on premises with forwarders and Splunk Cloud as a SaaS service, and map Splunk Enterprise Admin and Splunk Cloud Admin to them.

Discover an overview of Splunk installation and learn how to install Splunk Enterprise on Windows, Linux, and macOS, showing how Splunk components form deployments.

Explore installing Splunk on Windows, Linux, or Mac OS; choose physical, virtual, or cloud machines; and download the Splunk Enterprise trial or Universal Forwarder with a 60-day feature window.

Install Splunk Enterprise on Windows by downloading the MSI, running the setup wizard, and creating an administrator user; then log into Splunk Web on port 8000.

Install Splunk Enterprise on Linux using rpm, deb, or tar, download with wget, install to /opt/splunk, start with license acceptance, enable boot start, and access Splunk web on port 8000.

This lecture explains installing Splunk Enterprise on Mac OS with GUI (dmg) and CLI (tar), including license acceptance, starting Splunk, and accessing Splunk Web on port 8000.

Learn to use Splunk via the web UI, explore Splunk apps, focus on the home app and the search and reporting app, and cover users and roles.

Discover how the Splunk web user interface on port 8000 acts as the admin UI, detailing user, power, and admin roles and creating knowledge objects like reports, dashboards, and alerts.

Discover how Splunk apps extend the base platform to ingest data, index with field extractions, and build dashboards, with management via the apps panel and examples like DB Connect.

Explore the home app in Splunk and navigate the Splunk logo, account, settings, messages, activity, app panels, knowledge objects for dashboards, and the monitoring console.

Explore how the Splunk search and reporting app lets you search, analyze, and visualize indexed data using SPL, with features like time range picker, search modes, history, and data summaries.

Learn how to manage access in Splunk enterprise by assigning admin, power, and user roles, creating users, and handling private versus shared knowledge objects.

Explore alternative methods to use and administer Splunk, focusing on the command line interface and configuration files, after reviewing the web user interface.

Explore three ways to use and administer Splunk: web UI, CLI, and configuration files, where admin tasks and knowledge objects like safe searches or reports are governed by backend configurations.

Learn to use the Splunk command line interface (CLI) binary in the bin folder, locate Splunk Home, and run searches, monitor status, and configure Splunk across Windows, Linux, and Mac.

Explore how Splunk configuration files govern the platform, including dot conf files in the Etsy folder and the default versus local folders for apps, users, and system settings.

Index data in Splunk by adding it to your deployment and using the upload processor to import data via Splunk web UIs, CLI, and configuration files.

Learn how to add data to Splunk via the web user interface using the Add Data icon. Compare upload, monitor, and forward data inputs, including indexing behavior and production use.

Upload data into Splunk with the upload processor, assign source, host, and index, extract timestamps and events, and choose a pre-trained or custom source type before indexing.

Explore the Splunk search processing language by examining its components, syntax, and the search pipeline, then learn streaming, transforming, and other SPL commands.

Use Splunk's search processing language to search, analyze, and visualize data stored in Splunk indexes. Apply commands and functions to indexed data, and build a pipe-driven search pipeline.

Explore how to build a Splunk search pipeline with SPL components such as pipe, eval, if, and stats. Rename fields and group results, while understanding index access and search terms.

Explore Splunk streaming commands, distinguishing distributable commands that run at the indexer for faster processing (eval, fields, rename) from centralized commands that run on the search head, where order matters.

Explore transforming commands in Splunk, such as stats, top, read, and time chart, to convert search results into statistics for visualizations like column, line, bar, pie, and area charts.

Explore generating, orchestrating, and data set processing commands in Splunk, using pipe syntax, implicit search terms, and lookups to control execution on indexers or search heads.

Extract meaningful fields in Splunk to enable analysis and insights, using knowledge objects and delimiter-based and regex-based field extractions for structured and unstructured data.

Learn to assign field names to raw data in Splunk, turning unlabeled values into meaningful fields at index time or search time using knowledge objects and the field extractor utility.

Explain structured data like CSV (comma separated values) and JSON, and contrast it with unstructured data that has no standardized format and varying event formats.

Learn to extract fields in Splunk using knowledge objects and the field extractor utility, with regex for unstructured data and delimiters for structured data, saved as knowledge objects.

Explore delimiter based field extraction in Splunk using the field extractor to derive search time fields from EPL CSV data, with comma delimiters and a knowledge object EPL 2223 data.

Learn how to extract fields from unstructured data in Splunk using the field extractor and regular expressions, deriving username and source IP from Linux authentication logs in the security index.