1
Splunk Education Services Searching and Reporting with Splunk 5.0 This nine-hour course focuses on Splunk's search and reporting commands. Scenario-based examples and hands-on challenges enable users to create robust searches, reports and charts. Major topics include statistics and reporting, formatting and calculating results, charting commands and options, correlating events, acceleration summaries, enriching data with lookups, and more. Course Topics Getting Statistics Analyzing, Calculating, and Formatting Creating Charts Correlating Events Enriching Data with Lookups Creating and Using Summaries Creating and Using Macros Course Prerequisites Using Splunk course Class Format Instructor-led lecture with labs. Delivered via virtual classroom or at your site. Course Objectives Lesson 1 – Search Fundamentals Review basic search commands and general search practices Review fields and use the fields command Create a table Lesson 2 – Getting Statistics Describe the stats command Display top and rare values for given fields Use the stats command to create a statistical reports Lesson 3 – Analyzing, Calculating, and Formatting Understand the eval command Perform calculations on field values Convert, round, and format field values Use conditional statements Lesson 4 – Creating Charts Create charts and time charts Split values into multiple series Omit null and other values from charts Apply statistical functions Lesson 5 – Correlating Events Identify transactions Correlate events Report on transactions Lesson 6 – Enrich Data with Lookups and Workflow Actions Create and use a lookup table Configure automatic and time-based lookups Add a workflow action: WHOIS lookup Lesson 7 – Report Acceleration Creating and using summaries Searching against summaries Lesson 8 – Macros Manage macros Create and use a basic macro Define and use arguments and variables for a macro Splunk Education Tracks User: For all day-to-day Splunk users including customer support staff, developers, systems administrators and management. Administrator: For administrators of Splunk itself. (Administrators of other systems who will just be using Splunk should take the User track.) Architect: For architects who will be designing Splunk deployments, including architects on staff at customer deployments as well as partner professional services personnel. Developer: For developers who will integrate, customize and extend Splunk using its XML templates and advanced configuration bundling. Support Engineer: For Splunk OEM and channel partner support staff who will be providing first line support for Splunk. Tracks User Administrator Architect Developer Support Engineer Using Splunk ✓ ✓ ✓ ✓ ✓ Searching and Reporting with Splunk ✓ ✓ ✓ ✓ Administrating Splunk ✓ ✓ ✓ Advanced Splunk Administration ✓ ✓ ✓ Architecting and Deploying Splunk ✓ ✓ Developing Apps with Splunk ✓ ✓ ✓ Splunk Architect Certification Lab ✓ Supporting Splunk ✓ About Splunk Splunk is software that indexes, manages and enables you to search data from any application, server or network device in real time. Visit our website at www.splunk.com to download your own free copy. Splunk Inc. 250 Brannan San Francisco, CA 94107 866.GET.SPLUNK (866.438.7758) [email protected] [email protected]

Splunk Searching and reporting 43course

Embed Size (px)

Citation preview

Page 1: Splunk Searching and reporting 43course

Splunk Education Services

Searching and Reporting with Splunk 5.0 This nine-hour course focuses on Splunk's search and reporting commands. Scenario-based examples and hands-on challenges enable users to create robust searches, reports and charts. Major topics include statistics and reporting, formatting and calculating results, charting commands and options, correlating events, acceleration summaries, enriching data with lookups, and more.

Course Topics Getting Statistics Analyzing, Calculating, and Formatting Creating Charts Correlating Events Enriching Data with Lookups Creating and Using Summaries Creating and Using Macros

Course Prerequisites Using Splunk course

Class Format Instructor-led lecture with labs. Delivered via virtual classroom or at your site. Course Objectives Lesson 1 – Search Fundamentals Review basic search commands and general search practices Review fields and use the fields command Create a table

Lesson 2 – Getting Statistics Describe the stats command Display top and rare values for given fields Use the stats command to create a statistical reports

Lesson 3 – Analyzing, Calculating, and Formatting Understand the eval command Perform calculations on field values Convert, round, and format field values Use conditional statements

Lesson 4 – Creating Charts Create charts and time charts Split values into multiple series Omit null and other values from charts Apply statistical functions

Lesson 5 – Correlating Events Identify transactions Correlate events Report on transactions

Lesson 6 – Enrich Data with Lookups and Workflow Actions Create and use a lookup table Configure automatic and time-based lookups Add a workflow action: WHOIS lookup

Lesson 7 – Report Acceleration Creating and using summaries Searching against summaries

Lesson 8 – Macros Manage macros Create and use a basic macro Define and use arguments and variables for a macro

Splunk Education Tracks User: For all day-to-day Splunk users including customer support staff, developers, systems administrators and management.

Administrator: For administrators of Splunk itself. (Administrators of other systems who will just be using Splunk should take the User track.)

Architect: For architects who will be designing Splunk deployments, including architects on staff at customer deployments as well as partner professional services personnel.

Developer: For developers who will integrate, customize and extend Splunk using its XML templates and advanced configuration bundling.

Support Engineer: For Splunk OEM and channel partner support staff who will be providing first line support for Splunk.

Tracks User Administrator Architect Developer Support Engineer

Using Splunk ✓ ✓ ✓ ✓ ✓

Searching and Reporting with Splunk ✓ ✓ ✓ ✓ Administrating Splunk

✓ ✓ ✓

Advanced Splunk Administration ✓ ✓ ✓ Architecting and Deploying Splunk ✓ ✓ Developing Apps with Splunk ✓ ✓ ✓ Splunk Architect Certification Lab ✓ Supporting Splunk

✓

About Splunk Splunk is software that indexes, manages and enables you to search data from any application, server or network device in real time.

Visit our website at www.splunk.com to download your own free copy.

Splunk Inc. 250 Brannan San Francisco, CA 94107 866.GET.SPLUNK (866.438.7758) [email protected] [email protected]

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Documents
SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

Documents
Searching & reporting earlier recent definitions of DE

Searching & reporting earlier recent definitions of DE

Education
Splunk conf2014 - Onboarding Data Into Splunk

Splunk conf2014 - Onboarding Data Into Splunk

Technology
Industrial Data Internet of Things splunk (REST API, SDKs) splunk . TESCO splunk 500 Y—Jt1-3— 41328 . SHANON 1/5 splunk . htt . (500MB/B) s lunk splunk . Created Date:

Industrial Data Internet of Things splunk (REST API, SDKs) splunk . TESCO splunk 500 Y—Jt1-3— 41328 . SHANON 1/5 splunk . htt . (500MB/B) s lunk splunk . Created Date:

Documents
searching & reporting earlier and recent definitions of de

searching & reporting earlier and recent definitions of de

Documents
Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Documents
Range Searching: Emptiness, Reporting, and Approximate Counting · Range Searching: Emptiness, Reporting, and Approximate Counting Thesis submitted for the degree “Doctor of Philosophy”

Range Searching: Emptiness, Reporting, and Approximate Counting · Range Searching: Emptiness, Reporting, and Approximate Counting Thesis submitted for the degree “Doctor of Philosophy”

Documents
Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Documents
Cisco Web Security Appliance Advanced Reporting ... · Set Cisco WSA Advanced Reporting as the default app for all users/roles. docs.splunk.com (Optional) Enable SSL within Splunk

Cisco Web Security Appliance Advanced Reporting ... · Set Cisco WSA Advanced Reporting as the default app for all users/roles. docs.splunk.com (Optional) Enable SSL within Splunk

Documents
Splunk Conf2010: Corporate Express presents Splunk with SAP

Splunk Conf2010: Corporate Express presents Splunk with SAP

Technology
Splunk conf2014 - Splunk for Data Science

Splunk conf2014 - Splunk for Data Science

Technology
Long Term Reporting with Savvius and Splunk

Long Term Reporting with Savvius and Splunk

Technology
20090324 Beat Reporting And Job Searching

20090324 Beat Reporting And Job Searching

Career
Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Technology
FILEYE DIARIES (SEARCHING, REPORTING, LETTERS) · FILEYE DIARIES (SEARCHING, REPORTING, LETTERS) BITE SIZED GUIDES A… •searching •producing reports •generating letters | FILEYE

FILEYE DIARIES (SEARCHING, REPORTING, LETTERS) · FILEYE DIARIES (SEARCHING, REPORTING, LETTERS) BITE SIZED GUIDES A… •searching •producing reports •generating letters | FILEYE

Documents
CANARIE free eLearning registration 20170331...• Searching and Reporting with Splunk (eLearning) • Creating Splunk Knowledge Objects (eLearning) • Splunk Infrastructure Overview

CANARIE free eLearning registration 20170331...• Searching and Reporting with Splunk (eLearning) • Creating Splunk Knowledge Objects (eLearning) • Splunk Infrastructure Overview

Documents
Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Documents
Searching and Reporting with Splunk 6.4 - eLearning

Searching and Reporting with Splunk 6.4 - eLearning

Documents
Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad itinnovation@contacts.bham.ac.uk Indexing 2.2.1 Searching using splunk Splunk uses

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad [email protected] Indexing 2.2.1 Searching using splunk Splunk uses

Documents
Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Documents
WEB APPLICATION MONITORING AND ANALYTICS WITH SPLUNK · > Enter Splunk: Splunk Enterprise allowed us to build a custom searching app as well as a dashboard for monitoring service

WEB APPLICATION MONITORING AND ANALYTICS WITH SPLUNK · > Enter Splunk: Splunk Enterprise allowed us to build a custom searching app as well as a dashboard for monitoring service

Documents
Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Documents
Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Documents
Search*Language*A* Beginner - SplunkConf · Agenda! Whatis*Splunk?* Geng*Started* Basic*Searching* UsingFields* Saving*and*Sharing*Reports* NextSteps* 4

Search*Language*A* Beginner - SplunkConf · Agenda! Whatis*Splunk?* Geng*Started* Basic*Searching* UsingFields* Saving*and*Sharing*Reports* NextSteps* 4

Documents
ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

Documents
Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Documents
WEBHAUST05 TALK MM - CERN · • Splunk performs (3) roles: 1) da ta ingestion, 2) indexing, 3) searching indexed data • A single Splunk instance can fulf ill all roles, however,

WEBHAUST05 TALK MM - CERN · • Splunk performs (3) roles: 1) da ta ingestion, 2) indexing, 3) searching indexed data • A single Splunk instance can fulf ill all roles, however,

Documents
Splunk For IT Operational Intelligenceuploads.integrity360.com/1425903243-Splunk-for-IT-Operations.pdf · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper

Splunk For IT Operational Intelligenceuploads.integrity360.com/1425903243-Splunk-for-IT-Operations.pdf · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper

Documents
Searching & reporting earlier and recent definitions of DE Class

Searching & reporting earlier and recent definitions of DE Class

Education