Creating Knowledge Objects (CKO)

 

Course Content

This three-hour course is for knowledge managers who want to learn how to create knowledge objects for their search environment using the Splunk web interface. Topics will cover types of knowledge objects, the search-time operation sequence, and the processes for creating event types, workflow actions, tags, aliases, search macros, and calculated fields.

Who should attend

Knowledge Managers

Certifications

This course is part of the following Certifications:

Prerequisites

To be successful, students should have a solid understanding of the following:

  • How Splunk works
  • Knowledge objects

Course Objectives

  • Knowledge Objects and Search-time Operations
  • Creating Event Types
  • Using Event Type Builder
  • Creating Workflow Actions
  • Creating Tags and Aliases
  • Creating Search Macros

Outline: Creating Knowledge Objects (CKO)

Topic 1 – Knowledge Objects & Search-time Operations

  • Understand role of knowledge objects for enriching data
  • Define search-time operation sequence

Topic 2 – Creating Event Types

  • Define event types
  • Create event types using three methods
  • Tag event types
  • Compare event types and reports

Topic 3 – Creating Workflow Actions

  • Identify what are workflow actions
  • Create a GET, POST, and search workflow action
  • Test workflow actions

Topic 4 – Creating Tags and Aliases

  • Describe field aliases and tags
  • Create field aliases and tags
  • Search with field aliases and tags

Topic 5 – Creating Search Macros

  • Explain search macros
  • Create macros with and without arguments
  • Validate macro arguments
  • Use and preview macros at search time
  • Create and use nested macros
  • Use macros with other knowledge objects

Topic 6 – Creating Calculated Fields

  • Explain calculated fields
  • Create a calculated field
  • Use a calculated field in search

Prices & Delivery methods

Online Training

Duration
3 hours

Price
  • Online Training: CAD 635
  • Online Training: US $ 500
  • Splunk Training Units: 50 SPC
Classroom Training

Duration
3 hours

Price
  • Canada: CAD 635
  • Splunk Training Units: 50 SPC

Click on town name or "Online Training" to book Schedule

This is an Instructor-Led Classroom course
Instructor-led Online Training:   This computer icon in the schedule indicates that this date/time will be conducted as Instructor-Led Online Training.
This is a FLEX course, which is delivered both virtually and in the classroom.

Europe

Italy

Milan This is a FLEX course. Enroll
Online Training Time zone: Central European Time (CET) Enroll
Online Training Time zone: Central European Time (CET) Enroll
Online Training Time zone: Central European Summer Time (CEST) Enroll
Online Training Time zone: Central European Summer Time (CEST) Enroll
Online Training Time zone: Central European Summer Time (CEST) Enroll
Online Training Time zone: Central European Summer Time (CEST) Enroll
Online Training Time zone: Central European Time (CET) Enroll

United Kingdom

London, City This is a FLEX course. Enroll
Online Training Time zone: Greenwich Mean Time (GMT) Enroll
London, City This is a FLEX course. Enroll
Online Training Time zone: British Summer Time (BST) Enroll
London, City This is a FLEX course. Enroll
Online Training Time zone: British Summer Time (BST) Enroll
London, City This is a FLEX course. Enroll
Online Training Time zone: British Summer Time (BST) Enroll