Splunk Search Expert Fast Start (SE-FS)

 

Course Overview

This "Fast Start" course covers over 60 commands and functions and prepares students to be search experts. Students will learn how to effectively utilize time in searches, work with different time zones, use transforming commands and eval functions to calculate statistics, compare field values with eval functions and eval expressions, manipulate output, normalize fields and field values, use lookups and subsearches to enrich results, and correlate and filter data from multiple sources.

This class will take place over three 6-hour days (plus a 1-hour break each day)

Prerequisites

To be successful, students should have a solid understanding of the following:

  • How Splunk Works
  • Creating Search queries
  • Knowledge objects (specifically reports, lookups, and fields)

OR have taken the following:

Outline: Splunk Search Expert Fast Start (SE-FS)

Topic 1 – Working with Time
  • Searching with Time
  • Formatting Time
  • Comparing index Time versus Search Time
  • Using Time Commands
  • Working with Time Zones
Topic 2 – Statistical Processing
  • What is a Data Series?
  • Transforming Data
  • Manipulating Data with eval
  • Formatting Data
Topic 3 – Comparing Values
  • Using eval to Compare
  • Filtering with where
Topic 4 – Result Modification
  • Manipulating Output
  • Modifying REsults Sets
  • Managing Missing Data
  • Modifying Field Values
  • Normalizing with eval
Topic 5 – Leveraging Lookups and Subsearches
  • Using Lookup Commands
  • Adding a Subsearch
  • Using the return Command
Topic 6 - Correlation Analysis
  • Caclulate Co-Occurance Between Fields
  • Analyze Multiple Datasets

Prices & Delivery methods

Online Training

Duration
3 days

Price
  • Online Training: CAD 3,810
  • Online Training: US$ 3,000
  • Splunk Training Credits: 300 SPC
Classroom Training

Duration
3 days

Price
  • Canada: CAD 3,810
  • Splunk Training Credits: 300 SPC

Click on town name or "Online Training" to book Schedule

This is an Instructor-Led Classroom course
Guaranteed date:   We will carry out all guaranteed training regardless of the number of attendees, exempt from force majeure or other unexpected events, like e.g. accidents or illness of the trainer, which prevent the course from being conducted.
Instructor-led Online Training:   This computer icon in the schedule indicates that this date/time will be conducted as Instructor-Led Online Training.

United States

Guaranteed to Run Online Training 09:00 US/Eastern Enroll
Online Training 09:00 US/Central Enroll
Online Training 09:00 US/Pacific Enroll
Online Training 09:00 US/Eastern Enroll
Online Training 09:00 US/Central Enroll
Online Training 09:00 US/Pacific Enroll
Online Training 09:00 US/Eastern Enroll
Online Training 09:00 US/Central Enroll
Online Training 09:00 US/Pacific Enroll
Online Training 09:00 US/Eastern Enroll

Canada

Guaranteed to Run Online Training 09:00 Canada/Eastern Enroll
Online Training 09:00 Canada/Central Enroll
Online Training 09:00 Canada/Pacific Enroll
Online Training 09:00 Canada/Eastern Enroll
Online Training 09:00 Canada/Central Enroll
Online Training 09:00 Canada/Pacific Enroll
Online Training 09:00 Canada/Eastern Enroll
Online Training 09:00 Canada/Central Enroll
Online Training 09:00 Canada/Pacific Enroll
Online Training 09:00 Canada/Eastern Enroll