Overview of Splunk Administration
Splunk Administration training includes concepts which are required for both Splunk Power Users and Splunk Administrators.
At the end of this training, participant shall learn their roles and responsibilities and would be ready for implementation. This Training helps you work with Configuration files and settings, use various Knowledge objects, create Dashboards for visualization with the help of real-life Use-Cases, and use Searching & Reporting commands.
Duration
3 Days
Prerequisite for Splunk Administration
- Knowledge on Data Analytics concepts is beneficial
- Participants Must have good knowledge of system administration
- Participants must know Basics of Linux and Windows helps.
Anyone from the analytics and IT Operations domain will have a short learning curvature while attempting the Administration with Splunk course.
Course Outline for Splunk Administration
Installing Splunk
- Splunk: What does it Mean
- How should Splunk be Configured
- Identifying Splunk Instance Types
- Hardware Recommendations Indexers
- Hardware Recommendations Search Heads
- Splunk Install Packages
- Supported Platforms and Browsers
- Splunk Installation
- Splunk Directory Structure
- The Splunk Command Line Interface
- *NIX Run Splunk at Boot
- Splunk Windows Services
- Splunk Processes: Splunkd
- Splunk Processes: Splunk Web
- Apps Installed by Default
- System Settings
- Describing General Settings
- Restarting the Server from Splunk Web
License Management
- Managing Licenses
- Splunk License Types
- Adding a License
- License Warnings and violations
- What Counts as Daily License Quota
- Viewing Alerts
- License Staking
- Master License Server
- License Pooling
Basic Data Input
- Adding an Input with Splunk Web
- How can you tell what App you are in!
- Adding your Monitor Input
- Preview Data
- Specify the Source
- Select Host, Source type and Index
Managing Apps
- What is an App
- Apps configured by Default
- Viewing All Apps
- Managing Apps
- Installing an App Manually
- Enabling and Disabling Apps
- Deleting an App
- App Permissions
Splunk Configuration Files
- Configuration Directories
- Default vs. Local Configuration
- Global Context vs. User or App Context
- Runtime Merging of Configurations
- Configuration Testing Commands
Universal Forwarders
- Forwarders and Indexers
- Benefits of Using Forwarders
- Splunk Universal Forwarder
- Heavy Forwarder
- Configuration Steps
- Configuring the Receiving Port
- Downloading the Universal Forwarder Installer
- Installing Universal Forwarder Manually
- Forwarder Configuration Files