Working with Time :
Module 1 – Searching with Time
Understand the _time field and timestamps
View and interact with the Event Timeline
Use the earliest and latest time modifiers
Use the bin command with the _time field
Module 2 – Formatting TIme
Use various date and time eval functions to format time
Module 3 – Using Time Commands
Use the timechart command
Use the timewrap command
Module 4 – Working with Time Zones
Understand how time and timezones are represented in your data
- Determine the time zone of your server
- Use strftime to correct timezones in results
Statistical Processing :
Module 1 – What is a Data Series
Introduce data series
Explore the difference between single-series, multi-series, and time series data series
Module 2 – Transforming Data
Use the chart, timechart, top, rare, and stats commands to transform events into data tables
Module 3 – Manipulating Data with eval Command
Understand dthe eval command
Explore and perform calculations using mathematical and statistical eval functions
Perform calculations and concatenations on field values
Use the eval command as a function with the stats command
Module 4 – Formatting Data
Use the rename command
Use the sort command
Comparing Values
Module 1 – Using eval to Compare
Understand the eval command
Explain evaluation functions
Identify and use comparison and conditional functions
Use the fieldformat command to format field values
Module 2 – Filtering with where
Use the where command to filter results
Use wildcards with the where command
Filter fields with the information functions, isnull and isnotnull
Result Modification
Module 1 -Manipulating Output
Convert a 2-D table into a flat table with the untable command
Convert a flat table into a 2-D table with the xyseries command
Module 2 -Modifying Result Sets
Append data to search results with the appendpipe command
- Calculate event statistics with the eventstats command
- Calculate “streaming” statistics with the streamstats command
- Modify values to segregate events with the bin command
Module 3 -Managing Missing Data
Find missing and null values with the fillnull command
Module 4 -Modifying Field Values
Understand the eval command
Use conversion and text eval functions to modify field values
Reformat fields with the foreach command
Module 5 -Normalizing with eval
Normalize data with eval functions
Identify eval functions to use for data and field normalization
Correlation Analysis
Module 1 -Calculate Co-Occurrence Between Fields
Understand transactions
Explore the transaction command
Module 2 -Analyze Multiple Data Sources
Understand subsearch
Use the append, appendcols, union, and join commands to combine, analyze, and compare multiple data sources
Creating Knowledge Objects
Topic 1 -Knowledge Objects and Search-time Operations
Understand role of knowledge objects for enriching data
Define search-time operation sequence
Topic 2 – Creating Event Types
Define event types
Create event types using three methods
Tag event types
Compare event types and reports
Topic 3 – Creating Workflow Actions
- Identify what are workflow actions
Create a GET, POST, and search workflow action
Test workflow actions
Topic 4 – Creating Tags and Aliases
Describe field aliases and tags
Create field aliases and tags
▪ Search with field aliases and tags
Topic 5 – Creating Search Macros
Create macros with and without arguments
Validate macro arguments
Use and preview macros at search time
Create and use nested macros
Use macros with other knowledge objects
Topic 6 – Creating Calculated Fields
- Explain calculated fields
- Create a calculated field
Use a calculated field in search
Creating Field Extractions
Module 1 – Using the Field Extractor
Understand types of extracted fields and when they are extracted
Explore the Splunk Web Field Extractor (FX)
Module 2 -Creating Regex Field Extractions
Identify basics of regular expressions (regex)
Understand the regex field extraction workflow
Edit regex for field extractions
Module 3 -Creating Delimited Field Extractions
Identify delimited field values in event data
Understand the delimited field extraction workflow
Data Models
Module 1 – Introducing Data Model Datasets
Understand data models
Add event, search, and transaction datasets to data models
Identify event object hierarchy and constraints
Add fields based on eval expressions to transaction datasets
Module 2 – Designing Data Models
Create a data model
Add root and child datasets to a data model
Add fields to data models
Test a data model
Define permissions for a data model
Upload/download a data model for backup and sharing
Module 3 – Creating a Pivot
Identify benefits of using Pivot
Create and configure a Pivot
Visualize a Pivot
Save a Pivot
Use Instant Pivot
- Access underlying search for Pivot
Module 4 – Accelerating Data Models
Understand the difference between ad-hoc and persistent data model acceleration
Accelerate a data model
Describe the role of tsidx files in data model acceleration
Review considerations about data model acceleration
To be successful, students should have a solid understanding of the
following:
How Splunk works
Creating search queries
Prerequisites can be obtain with free elearning :
What is Splunk (SSC): https://www.splunk.com/en_us/training/courses/what-is-splunk.html
Intro to Splunk (SSC): https://www.splunk.com/en_us/training/courses/intro-to-splunk.html
Using Fields (SSC): https://www.splunk.com/en_us/training/courses/using-fields.html
Visualizations (SSC): https://www.splunk.com/en_us/training/courses/visualizations.html
Intro to Knowledge Objects (SSC) : https://www.splunk.com/en_us/training/courses/intro-to-knowledge-objects.html
Search Under the Hood (SSC) : https://www.splunk.com/en_us/training/courses/search-under-the-hood.html
Or ask Arrow Education Team for Prerequisites Fast Start bundle (SPL_PREREQ)