What You Will Learn!
- Accelerate Splunk searches by 10k+ times. Reduce the load on your Splunk infrastructure, reduce the wait time for search results.
- Learn effective SPL usage, including effective use of reporting commands like stats and tstats to improve indexer reporting and job results loading speeds.
- Learn less known SPL and search techniques.
- Improve dashboard efficiency
Description
You will learn to leverage Splunk indexing mechanics, Splunk indexers in parallel, and optimal SPL to increase your search speed/efficiency by on average over 500k times faster; search times of months or days will be reduced down to minutes or seconds. A basic understanding of Splunk SPL commands and data analytics (averages and sums) is useful, but not essential, for success in this course because basic SPL will also be covered. Comfort with Linux and with Cloud services are both helpful in following the process for installing Splunk on the Cloud (highly recommended). Much like with Google Cloud and AWS, the first year with Azure is free.
The key to searching fast in Splunk is to begin with a good idea of what you are looking for and how you will render that data into a form that you will use to understand the answer. You'll need to move away from wanting to see "everything" because the human eye is not designed to look at millions and billions of complex events. You'll need to plan the kind of information and format that you want to see into a relatively small number of rows and columns or lines on a chart. Be careful to avoid wanting to look at raw data because that is the easiest way to waste a lot of your time, slow you down and miss something.
Who Should Attend!
- Splunk Analysts
- Splunk Developers
- Big Data Managers
- Security Analysts using Splunk Enterprise Security
