Learning Splunk from Udemy

What's inside

Learning objectives

Build your own splunk development environment from scratch on a linux server—and use it!
Onboard and index multiple types of data into your splunk instance
Understand the importance of the splunk common information model (cim), and why data models make splunk a powerful tool for managing logs at volume

Normalize data using splunk apps
Develop basic reports and dashboards using your new splunk instance and the data from your linux system
Understand why leaving systems exposed to the internet is a bad idea

Build your own splunk development environment from scratch on a linux server—and use it!
Onboard and index multiple types of data into your splunk instance
Understand the importance of the splunk common information model (cim), and why data models make splunk a powerful tool for managing logs at volume
Normalize data using splunk apps
Develop basic reports and dashboards using your new splunk instance and the data from your linux system
Understand why leaving systems exposed to the internet is a bad idea

Syllabus

Introduction to Splunk

This video will give you an overview about the course.

Explore Splunk, who uses it, and what you can do with Splunk.

• Describe what Splunk is

• Discuss who uses Splunk

• Discuss what you can do with Splunk

Explore Splunk logs, the usefulness of these logs, and what you can do once you capture them.

• Explore the origin of the logs

• Discuss what the logs tell us

• Discuss why someone might want to search logs

Include first hands-on activity, where you deploy the underlying system and OS, and configure it to support the rest of the labs in the course.

• Deploy an Ubuntu Linux system in AWS

• Configure networking and security groups to allow for sample data

• Prepare the OS for the installation of Splunk

Explore the Splunk installation process on your Linux machine.

• Discuss the lab deployment methodology for Splunk

• Install Splunk on your lab system

• Confirm your Splunk installation is working with a search

Test your knowledge

Splunk Terminology

Understanding Splunk terminology and exploring definitions of unfamiliar Splunk-related terms.

• Describe what Splunk Splexicon is

• Learn where to explore definitions of Splunk terms

• Preview the rest of the section

Understanding what an “event” in Splunk is.

• Understand an event as a single piece of data in Splunk

• Learn what metadata every event has

• Demonstrate an event in the Splunk UI

Understanding the concept of search and the primary way users navigate data in Splunk.

• Understand what can be done in the search interface

• Identify the time range picker

• Identify the search bar

Understanding reports, which are saved searches.

• Understand that a report is simply a saved search

• Understand that reports can be scheduled

• Explore reports in the search interface

Exploring dashboards, which are the user interface to your data.

• Understand the dashboard terminology

• Understand that dashboards are powered by searches

• Explore a sample dashboard

Exploring SPL, the Splunk search processing language.

• Understand the structure of SPL syntax

• Understand the types of operations SPL supports

• Explore a sample SPL query

Understanding sourcetypes or how the structure of data in events is identified.

• Understand the importance of sourcetypes

• Understand some common sourcetypes

• Learning how to use sourcetypes to quickly find the data you need

Exploring indexes or how data is stored in Splunk.

• Understand what an index is

• Understand why different indexes are used

• Understand how indexes are stored in Splunk

Understanding knowledge objects and fields, which help make your data understandable.

• Identify sample knowledge objects

• Identify fields and why they are useful

• Explore sample fields in a search

Exploring lookup tables, a way to enrich the data in your logs.

• Learning what a lookup table does

• Identify why a lookup table is useful

• Understand an example lookup table

Understanding how to work with time in Splunk, and how to leverage Splunk’s relative time syntax in searches to consistently locate the data you are looking for.

• Learn how Splunk uses relative time syntax (and how you have been working with it so far)

• Experiment with the earliest and latest search commands

• Explore the Splunk’s relative time syntax

Data Onboarding

Understanding the roadmap for onboarding data into Splunk and preparing you for the hands-on activities in the next video.

• Learning how to approach data onboarding

• Learning what information you need when onboarding data

• Understanding the value of experimenting with your data

Onboarding Linux authentication logs into Splunk.

• Collect the required information to onboard data

• Configure Splunk to monitor a log file

• Search for the newly onboarded data

Understanding how to use Splunk apps to assist with field extractions for your authentication logs.

• Identify Splunk apps associated with your data source

• Install a Splunk app

• Observe the benefits of using a Splunk app with your data

Understanding tips for approaching data onboarding when an app doesn’t already exist.

• Understand the value of existing apps

• Learn that apps are not required, they just make it easier

• Identify situations where a custom app may be required

Exploring how Splunk configurations are recorded in configuration files.

• Learn how Splunk configuration settings are stored

• Find the inputs.conf setting associated with your authentication logs

• Using btool to find the configuration location

Splunk Deployment Components

Understanding the core infrastructure behind a distributed Splunk environment: the indexers and search heads.

• Learn what a Splunk indexer does

• Learn what a Splunk search head does

• Understand requirements and deployments of indexers and search heads

Exploring forwarders, which are supporting infrastructure that assist with getting data into Splunk.

• Understand the use of forwarders

• Learn about the two main types of forwarders

• Learn where universal forwarders are deployed and why

Understanding how syslog data is ingested into Splunk using a syslog receiver.

• Learn why direct TCP or UDP inputs should not be used

• Learn the best practices for ingesting syslog

• Identify a file structure that works well for this data

Exploring the deployment server, which is Splunk’s configuration enforcement mechanism.

• Understand the role of the deployment server

• Learn about the deployment apps and their uses

• Observing a sample deployment server in action

Understanding an overview of Splunk’s licensing model.

• Learn how Splunk is licensed

• Learn what happens when a license violation occurs

• Investigat your license utilization and usage

Exploring the various clustering mechanisms that exist in Splunk.

• Learn about indexer replication clustering

• Learn about multisite clustering

• Learn about search head clustering

Understanding an example of a larger Splunk distributed environment and how the components we’ve reviewed throughout this section work together.

• Learn what a larger Splunk deployment looks like

• Understand how clustering is deployed for better availability

• Understand that a larger Splunk deployment typically consists of many separate systems

Understanding Splunk apps and how they’re used to customize and configure Splunk.

• Learn what constitutes a Splunk app

• Understand that apps can be very simple or very complex

• Learn about the Enterprise Security Suite – a Splunk premium app

Exploring Splunk search and understanding the steps that will result in poor search performance. Explore some common pitfalls when writing Splunk searches.

• Understand the ordering of search commands and its significant performance impact

• Identify possible options for improving the performance of a search

• Learn a few resource-intensive search commands to avoid

Data Normalization and Data Models

Exploring collection of iptables logs into your Splunk installation.

• Enable iptables logging on your Linux machine

• Modify inputs.conf to collect the firewall logs

• Search for the iptables logs in Splunk

Understanding the common information model (CIM). This is one of the most effective mechanisms for getting the most out of Splunk and working with all different types of data in a consistent way.

• Understand why data normalization is important

• Discuss the value of consistency and how it enables event correlation

• Explore some of the data models available in Splunk

Understanding how to use a Splunk app to apply CIM to your newly onboarded firewall logs.

• Identify a candidate app with the CIM version supported

• Install the candidate app

• Observe the changes in the search interface and new fields created

Using Your Splunk Environment

Understanding the Splunk UI and search interface.

• Learn what you can search in Splunk

• Identify when case sensitivity matters

• Recognize supported Boolean operations in search

Exploring fields, which help make your data more accessible.

• Identify the default fields for every event: host, source, and sourcetype

• Recall the field names are case sensitive; values are not

• Understand how to use wildcards and CIDR notation in search

Exploring some searching exercises in the Splunk WebUI.

• Search your firewall logs

• Practice using the time range picker and logical operators

• Share and export your search results

Exploring different search modes available in Splunk and common pitfalls when the wrong mode is used.

• Identify the search mode selector in the Splunk WebUI

• Understand differences between fast mode, smart mode, and verbose mode

• Understand how fields may not display as expected when fast mode is used

Understanding the differences in the Splunk search modes in a hands-on activity.

• Observe the results of running searches in each search mode

• Identify the different field extraction behaviors in each mode

• Recognize the performance impact of field extractions

Understanding many of the powerful reporting functions available within the Splunk search pipeline.

• Understand usage of options in the WebUI to automatically add statistical functions to searches

• Run searches with basic statistical functions, such as top values

• Experiment with various visualization options

Understanding the use of the Splunk search pipeline in a hands-on activity.

• Create a search using your firewall logs

• Experiment with different visualizations for your data

• Save your results as a report that can be viewed later

Visualizing Data

Understanding the culmination of the course material and learn to create tables in Splunk.

• Identify popular use cases for tables in Splunk

• Explore available fields and identifying relevant ones

• Create a table from search results

Understanding the use of tables in a hands-on activity.

• Explore your firewall and authentication logs, and identify useful fields

• Create tables using your data

• Save these searches as reports to be used later

Understanding another reporting command in Splunk: chart.

• Discuss the usage of the chart command

• Identify the similarities between the chart and table command

• Create a chart using data in Splunk

Understanding Splunk’s ability to create a time-series chart using the timechart command.

• Understand when timechart is the best representation for your data

• Identify some of the available options

• Learn the differences between the timechart and chart commands

Understanding how Splunk can automatically associate geographic information to IP addresses.

• Learn the Ip Location and geostats commands

• Understand use of both the Ip Location and geostats commands

• Create tables and maps with geographic information for IP addresses

Exploring the most powerful command in the Splunk search interface – eval.

• Understand the use of eval command and some of the available functions

• Review the Splunk documentation for the eval command

• Experiment with the eval command in your search results

Understanding the rename command to make tables more presentable and user-friendly.

• Learn when to use the rename command

• Learn how to use quotes in the search interface to achieve the correct results

• Create a table and modify the headers using rename

Exploring some of the search commands and experiment with how they are used.

• Create a chart using your firewall or authentication logs

• Create a table using these same logs and use commands to modify the results

• Save these tables and charts as a report to be used later

Exploring dashboards, understanding how to create a dashboard, and how dashboards work in Splunk.

• Learn some basic dashboard terminology

• Create a dashboard and add a panel from a report

• Add additional panels to your dashboard

Creating your own dashboards in your Splunk instance.

• Create a new dashboard and adding reports created earlier

• Add additional panels to your dashboard

• Adjust the look and feel of your dashboards

Upgrading Splunk

Exploring release cycles for new versions of the Splunk software.

• Discuss the release of new versions, on a bi-annual basis

• Understand the maintenance releases and their purpose

• Identify the supported lifecycle for Splunk versions

Understanding some of the new features and changes in Splunk 8.0

• Locate the Splunk release notes in the Splunk documentation

• Understand some of the changes in Splunk 8.0

• Learn about the Python 3.7 migration

Understanding the process for planning a Splunk upgrade.

• Understand the known issues and upgrade recommendations in the Splunk documentation

• Understand configuration and apps for possible incompatibilities

• Understand app compatibility with different Splunk versions

Exploring the process of backing up the configuration of an existing Splunk instance.

• Learn how to back up the Splunk kvstore

• Learn how to back up Splunk

• Watch a demonstration of the backup process

Exploring the process of upgrading an existing Splunk installation.

• Learn the process of upgrading Splunk

• Upgrade Splunk apps in your environment

• Execute the Splunk upgrade

Learning to perform an upgrade of your Splunk environment.

• Back up your Splunk environment

• Perform the Splunk upgrade

• Validate Splunk functionality after the upgrade

Good to know

Know what's good

, what to watch for

, and possible dealbreakers

Covers advanced searching techniques, which are especially useful to those in network, security, and system administration roles, enabling them to efficiently analyze and manage data

Provides a comprehensive foundation for becoming a proficient Splunk architect and administrator, covering everything from basic terminology to advanced environment setup and data management

Includes hands-on activities, such as deploying a Linux system in AWS and configuring it to support the labs, providing practical experience with Splunk setup and configuration

Explores the Common Information Model (CIM) and data models, which are essential for effectively managing logs at volume and normalizing data for consistent analysis

Teaches how to use Splunk apps to assist with field extractions and data normalization, streamlining the process of preparing data for analysis

Covers the latest additions brought in for Splunk 8 and helps learners quickly perform an upgrade, ensuring they are up-to-date with the latest features and improvements

Activities

Be better prepared before your course. Deepen your understanding during and after it. Supplement your coursework and achieve mastery of the topics covered in Learning Splunk with these activities:

Review Linux Fundamentals

Show steps

Strengthen your understanding of Linux, which is essential for setting up and managing the Splunk environment used in this course.

Browse courses on Linux Command Line

Show steps

Review basic Linux commands like ls, cd, mkdir, rm, and grep.
Practice navigating the file system and managing files.
Familiarize yourself with user permissions and file ownership.

Mastering Splunk

Show steps

Expand your knowledge of Splunk administration and advanced features by reading 'Mastering Splunk'.

View Mastering Splunk 8 on Amazon

Show steps

Obtain a copy of 'Mastering Splunk'.
Read the chapters that cover topics relevant to your interests and learning goals.
Experiment with the techniques and examples presented in the book.

Set up a personal log aggregation system

Show steps

Gain hands-on experience with log management by setting up a simple system to collect and analyze logs from your own devices.

Show steps

Choose a few devices or applications to collect logs from.
Configure those devices to forward logs to a central location.
Use Splunk to analyze the collected logs and identify patterns.

Four other activities

Expand to see all activities and additional details

Show all seven activities

Document your Splunk learning journey

Show steps

Reinforce your understanding of Splunk concepts by creating a blog or journal to document your learning process and share your insights.

Show steps

Create a blog or journal to document your Splunk learning journey.
Write about the concepts you're learning and the challenges you're facing.
Share your insights and discoveries with others.

Splunk SPL Practice

Show steps

Master Splunk's Search Processing Language (SPL) through regular practice exercises to improve your search and analysis skills.

Show steps

Find practice SPL exercises online or in Splunk documentation.
Work through the exercises, focusing on different SPL commands.
Test your solutions and review the correct answers.

Build a Splunk Dashboard for Security Monitoring

Show steps

Apply your Splunk knowledge to create a practical dashboard that monitors security events and provides valuable insights into potential threats.

Show steps

Identify key security metrics to monitor, such as failed login attempts and suspicious network activity.
Write SPL queries to extract the necessary data from your logs.
Design and build a dashboard that visualizes the security metrics in a clear and concise way.

Contribute to a Splunk App on GitHub

Show steps

Enhance your Splunk skills and collaborate with other developers by contributing to an open-source Splunk app on GitHub.

Show steps

Find a Splunk app on GitHub that you're interested in contributing to.
Review the app's code and documentation to understand its functionality.
Identify a bug or feature that you can contribute to.
Submit a pull request with your changes.

Career center

Learners who complete Learning Splunk will develop knowledge and skills that may be useful to these careers:

Splunk Administrator

A Splunk Administrator is responsible for the health and maintenance of the Splunk environment itself, and this course will help one understand what goes into this task. This involves installing, configuring, and maintaining the Splunk platform, ensuring its availability and performance. The course provides a comprehensive understanding of Splunk architecture, data onboarding, and configuration, all of which are core skills for a Splunk administrator. This course is very much geared towards those who wish to become a Splunk administrator. Learning to build a Splunk environment and mastering advanced search techniques in this course directly contribute to the skills needed in this role. The course also discusses upgrading, which is important for long-term maintenance.

See salaries and explore the career path for Splunk Administrator

Information Security Analyst

An Information Security Analyst helps protect an organization's information assets from various threats, and this course provides a solid foundation to use Splunk. This position includes tasks such as monitoring security alerts, investigating security incidents, and implementing security measures. This course is applicable because it provides opportunities to learn Splunk from the ground up. This course covers how to use the Splunk web interface, build dashboards, and create a Splunk environment. The focus on data normalization and advanced searching techniques directly contributes to the skills needed for this role. Learning how to find events within data is also important.

See salaries and explore the career path for Information Security Analyst

Cybersecurity Engineer

Cybersecurity Engineers design, implement, and manage security systems to protect an organization from cyber threats, and this course helps by building skills with Splunk, a tool frequently used by those in the field. They focus on building and maintaining systems that can detect, prevent, and respond to security incidents. This course is well-suited as it teaches network, security, and system administration concepts, including how to build from the ground up, use the web interface, and perform advanced searches. Cybersecurity engineers need to be able to work with data, and this course focuses on that. The course also teaches how to create dashboards for security monitoring.

See salaries and explore the career path for Cybersecurity Engineer

Security Operations Center Analyst

A Security Operations Center Analyst monitors security systems and responds to security incidents that happen in real time, and this course will help build skills with Splunk, a tool commonly used in this field. This role involves analyzing security alerts, investigating potential threats, and coordinating incident response efforts. The course teaches how to use Splunk for data analysis and identifying events within data, and how to use the Splunk web interface. This is highly relevant for a Security Operations Center analyst who is constantly working with security data. This course is a good fit in particular for those who wish to learn more about using Splunk in a security context. The course teaches advanced searching techniques, useful for investigating complex security events.

See salaries and explore the career path for Security Operations Center Analyst

Security Analyst

A Security Analyst uses various tools to monitor and protect an organization's systems and data, and this course will help one learn how to monitor system logs. This role involves analyzing security events, identifying threats, and responding to incidents, requiring a deep understanding of security logs and the ability to quickly identify and investigate anomalies. As this course covers Splunk from the ground up, including how to use the web interface to explore data, and advanced search techniques, it directly helps build a foundation in this field. A security analyst benefits greatly from experience with Splunk. The course covers how to normalize data using the Common Information Model, which is also valuable when working with many sources and types of data.

See salaries and explore the career path for Security Analyst

System Administrator

System Administrators are responsible for the upkeep, configuration, and reliable operation of computer systems. This course can help a system administrator by teaching them how to monitor system logs. This role includes installing and configuring systems, monitoring system performance, and troubleshooting issues. This course offers hands-on learning for building a Splunk environment and learning to use it to monitor logs, which is directly relevant to a system administrator's daily tasks. This course will help build a foundation in data normalization. System administrators who take this course gain skills in using Splunk to find events within data and creating effective dashboards.

See salaries and explore the career path for System Administrator

Network Engineer

Network Engineers design, implement, and maintain an organization’s network infrastructure, and this course will help one learn how to monitor a network. This includes tasks such as configuring network devices, monitoring network performance, and troubleshooting network issues. The course will be particularly helpful in learning how to analyze network logs for performance issues using Splunk. This course also helps build skills in creating dashboards to visualize network performance data. The course's focus on advanced searching techniques and the Common Information Model is directly applicable to identifying network anomalies and optimizing network performance.

See salaries and explore the career path for Network Engineer

IT Architect

An IT Architect is responsible for the overall design and planning of an organization's technology infrastructure, and this course will help them understand one important technology, Splunk. The role involves making strategic technology decisions and guiding IT projects. To be effective, they must evaluate potential technology tools and understand their capabilities. This course provides a deep understanding of Splunk, including its architecture, data onboarding, and deployment. Taking this course helps an IT architect learn how Splunk plays a role in an enterprise environment, enabling them to make better decisions about its use and integration of it into their own infrastructure.

See salaries and explore the career path for IT Architect

Cloud Engineer

Cloud Engineers implement, configure, and manage cloud-based systems, and this course will help by teaching how to use Splunk to monitor cloud resources. This role includes tasks such as designing cloud infrastructure, deploying applications, and ensuring system reliability. This course teaches how to use Splunk to monitor logs, and this is directly relevant when using cloud-based systems. Cloud engineers benefit from the knowledge of how to analyze event data in Splunk, create dashboards, and use the Common Information Model to normalize diverse logs. The hands-on approach will be directly applicable to engineers looking to monitor resources hosted in the cloud.

See salaries and explore the career path for Cloud Engineer

Data Analyst

Data Analysts examine data to identify trends, draw conclusions, and provide actionable insights, and this course will be useful in learning how to work with data. This role involves using tools such as Splunk to analyze data, and the course offers a comprehensive foundation in Splunk. This role involves using tools to collect, organize, and analyze data. The course will help data analysts by providing important skills in data onboarding, normalization, and creating visualizations. The course teaches data analysis with Splunk through its focus on the Splunk Common Information Model and building dashboards. Learning how to find events within data and mastering advanced searching techniques is also helpful.

See salaries and explore the career path for Data Analyst

DevOps Engineer

DevOps Engineers work to streamline the software development and deployment process, and this course will help them by learning how to use Splunk for logging and monitoring. This position includes tasks such as automating infrastructure, monitoring application performance, and troubleshooting issues. Splunk is a tool widely used for logging, and this course provides a strong foundation for learning how to use it. This course is useful because it teaches how to onboard different types of data, how to normalize data using the Common Information Model, and how to create dashboards. For those in DevOps, Splunk is a powerful tool to monitor applications and infrastructure.

See salaries and explore the career path for DevOps Engineer

Security Consultant

A Security Consultant provides expert advice and guidance to organizations on their security posture, and this course will help a consultant who uses Splunk. This role involves assessing security risks, designing security strategies, and helping organizations implement effective security controls. This course provides a strong foundation in how to use Splunk for security monitoring. A security consultant with a background in Splunk can provide better advice and guidance related to the tool. The course’s focus on data normalization and event analysis is relevant for consultants who need to work with varied data sources.

See salaries and explore the career path for Security Consultant

Technical Support Engineer

A Technical Support Engineer provides technical assistance to customers, and this course may be useful in learning how to troubleshoot with system logs. This role involves diagnosing issues and providing technical solutions. This course provides a useful introduction to Splunk that includes how to use the web interface to find data and how to create dashboards. This is particularly helpful because Splunk is often used to monitor system logs. This course can help a technical support engineer gain experience in using Splunk to find events as well as normalize data to gain improved insights into customer issues.

See salaries and explore the career path for Technical Support Engineer

IT Support Specialist

An IT Support Specialist provides technical assistance to users, and this course may be useful in troubleshooting by analyzing system logs. This can include various tasks such as answering helpdesk tickets, diagnosing issues, and providing technical solutions. This course provides an introduction to Splunk that includes the basics, such as how to use the web interface to find data. This is a useful platform when working with any kind of system log. This course can help IT support specialists better understand system logs and how to find specific information from the data. Gaining experience in creating reports and dashboards in this course may also be useful for providing helpful overviews of system status.

See salaries and explore the career path for IT Support Specialist

Database Administrator

Database Administrators are responsible for the maintenance, performance, and security of an organization's databases. This course may be useful to a database administrator seeking to use Splunk to monitor database logs. This role includes tasks such as designing database structures, implementing security measures, and troubleshooting performance issues. While the course does not focus on database administration itself, learning how to use Splunk to collect and analyze logs is helpful. Learning from this course how to onboard data and create dashboards will provide a database administrator valuable experience. The advanced search techniques covered in the course may also be useful for troubleshooting.

See salaries and explore the career path for Database Administrator

Reading list

We've selected one books that we think will supplement your learning. Use these to develop background knowledge, enrich your coursework, and gain a deeper understanding of the topics covered in Learning Splunk.

Mastering Splunk 8

Save

Mastering Splunk provides a comprehensive guide to Splunk administration, data analysis, and dashboard creation. It covers advanced topics such as clustering, security, and performance optimization. valuable resource for students who want to deepen their understanding of Splunk and become proficient Splunk administrators. It serves as a useful reference tool for tackling complex Splunk deployments.

Learning Splunk

What's inside

Learning objectives

Syllabus

Good to know

Save this course

Activities

Career center

Reading list

Share

Similar courses