Module 1 – Getting Data Into Splunk

• Overview of Splunk and the distributed model
• Data input types and metadata settings
• Configuration of initial input testing
• Testing indexes with input staging

Module 2 – Config Files and Apps

• Identification of Splunk configuration files and directories
• Understanding index-time and search-time precedence
• Validation and updating of configuration files
• Exploration of Splunk apps and app installation

Module 3 – Configuring Forwarders

• Configuration of Universal Forwarders
• Configuration of Heavy Forwarders

Module 4 – Customizing Forwarders

• Configuration of intermediate forwarders
• Identification of additional forwarder options

Module 5 – Managing Forwarders

• Description of Splunk Deployment Server (DS)
• Forwarder management using deployment apps
• Configuration of deployment clients and client groups
• Monitoring forwarder management activities

Module 6 – Monitor Inputs

• Creation of file and directory monitor inputs
• Use of optional settings for monitor inputs
• Deployment of remote monitor inputs

Module 7 – Network Inputs

• Creation of network (TCP and UDP) inputs
• Description of optional settings for network inputs

Module 8 – Scripted Inputs

• Creation of basic scripted inputs

Module 9 – Agentless Inputs

• Configuration of Splunk HTTP Event Collector (HEC) agentless input
• Description of Splunk App for Stream

Module 10 – Operating System Inputs

• Identification of Linux-specific inputs
• Identification of Windows-specific inputs

Module 11 – Fine-tuning Inputs

• Understanding default processing during the input phase
• Configuration of input phase options (source type fine-tuning, character set encoding)

Module 12 – Parsing Phase and Data Preview

• Understanding default processing during parsing
• Optimization and configuration of event line breaking
• Explanation of timestamp and time zone handling during parsing
• Use of Data Preview for event validation during parsing

Module 13 – Manipulating Input Data

• Exploration of Splunk transformation methods
• Creation of rulesets with Ingest Actions
• Data masking with Ingest Action rules and SEDCMD
• Override of sourcetype or host based on event values

Module 14 – Routing Input Data

• Data filtering and routing with Ingest Action rules and TRANSFORMS

Module 15 – Supporting Knowledge Objects

• Configuration of default and custom search time field extractions
• Pros and cons of indexed time field extractions
• Configuration of indexed field extractions
• Management of orphaned knowledge objects

Splunk Enterprise Data Administration Course Prerequisites:

• What is Splunk?
• Intro to Splunk
• Using Fields
• Introduction to Knowledge Objects
• Creating Knowledge Objects
• Creating Field Extractions

Additionally, the following courses are recommended:

• Fundamentals 1
• Fundamentals 2

It’s also beneficial for students to have an understanding of the following course:

• Splunk Enterprise System Administration (recommended)