Splunk Advanced Power User Fast Start (English) (Partnercursus)

• Multivalue Fields (SMV)
  • Topic 1 – What are Multivalue Fields?
  • Topic 2 – Creating Multivalue Fields
  • Topic 3 – Evaluating Multivalue Fields
  • Topic 4 – Manipulating Multivalue Data
• Search Optimization (SSO)
  • Topic 1 – Optimizing Search
  • Topic 2 – Report Acceleration
  • Topic 3 – Data Model Acceleration
  • Topic 4 – Using the tstats Command

• Introduction to Dashboards (ITD)
  • Topic 1 – Dashboard Framework
  • Topic 2 – Create a Prototype
  • Topic 3 – Use Dynamic Coloring
• Dynamic Dashboards (SDD)
  • Topic 1 – Selecting a Data Source
  • Topic 2 – Adding Inputs
  • Topic 3 – Improving Performance

Bekijk meer onderwerpenBekijk minder onderwerpen

• Multivalue Fields (SMV)
  • Topic 1 – What are Multivalue Fields?
    • Understand multivalue fields
    • Define self-describing data
    • Understand how JSON data is handled in Splunk
    • Use the spath command to interpret self-describing data
    • Use the mvzip and mvexpand commands to manipulate multivalue fields
    • Convert single-value fields to multivalue fields with specific commands and functions
  • Topic 2 – Creating Multivalue Fields
    • Create multivalue fields with the makemv command and the split function of the eval command
  • Topic 3 – Evaluating Multivalue Fields
    • Use the mvcount, mvindex, and mvfilter eval functions to evaluate multivalue fields
  • Topic 4 – Manipulating Multivalue Data
    • Use the mvsort, mvzip, mvjoin, mvmap, and mvappend eval functions and the mvexpand command to analyze multivalue data
• Search Optimization (SSO)
  • Topic 1 – Optimizing Search
    • Understand how search modes affect performance
    • Examine the role of the Splunk Search Scheduler
    • Review general search practices
  • Topic 2 – Report Acceleration
    • Define acceleration and acceleration types
    • Understand report acceleration and create an accelerated report
    • Reveal when and how report acceleration summaries are created
    • Search against acceleration summaries
  • Topic 3 – Data Model Acceleration
    • Understand data model acceleration
    • Accelerate a data model
    • Use the datamodel command to search data models
  • Topic 4 – Using the tstats Command
    • Explore the tstats command
    • Search acceleration summaries with tstats
    • Search data models with tstats
    • Compare tstats and stats

• Introduction to Dashboards (ITD)
  • Topic 1 – Dashboard Framework
    • Describe the dashboard definition
    • Compare classic and dashboard studio dashboards
    • Manage view
    • Use dashboard best practices
  • Topic 2 – Create a Prototype
    • Describe dashboard workflows
    • Compare layout types
    • Identify layout fields
    • Add visualizations
  • Topic 3 – Use Dynamic Coloring
    • Describe dynamic coloring
    • Contrast visualization types
    • Set global time parameters
    • Apply dynamic coloring
• Dynamic Dashboards (SDD)
  • Topic 1 – Selecting a Data Source
    • Identify dataSources stanza fields
    • Name search types
    • Use a secondary data source
  • Topic 2 – Adding Inputs
    • Identify types of inputs
    • Describe how inputs worK
    • Create a dynamic input
    • Add cascading inputs
  • Topic 3 – Improving Performance
    • Identify performance improvement methods
    • Use tstats and accelerated data models
    • Create chain searches
    • Set defaults