Splunk Developer and Admin Training

Curriculum:

Module 1: Introduction to Splunk

• What is Splunk?
• Understanding Machine Data and its Importance
• Splunk Architecture & Components
• Splunk Enterprise vs. Splunk Cloud
• Splunk Use Cases: IT Operations, Security, and Analytics

Splunk Administration Track

Module 2: Splunk Installation & Configuration

• Splunk system requirements and installation steps
• Starting and stopping Splunk services
• Configuring Splunk Web, CLI, and configuration files
• Splunk directory structure and configuration hierarchy

Module 3: Data Input & Indexing

• Adding data to Splunk (files, directories, scripts, network ports)
• Universal Forwarder and Heavy Forwarder configuration
• Input types (monitor, TCP/UDP, HTTP Event Collector)
• Index management, buckets, and retention policies
• Parsing, indexing pipeline, and data flow in Splunk

Module 4: Splunk Licensing & User Management

• License types (Enterprise, Free, Trial)
• Managing license usage and violation
• Creating and managing Splunk roles and users
• Configuring authentication (LDAP, SSO, etc.)
• Managing Splunk apps and permissions

Module 5: Splunk Configuration Management

• Splunk configuration files overview
• Managing indexes.conf, inputs.conf, props.conf, transforms.conf
• Deployment server and app deployment
• Forwarder management console
• Distributed Splunk architecture: Indexers, Search Heads, Forwarders

Module 6: Splunk Distributed Environment

• Scaling Splunk with multiple instances
• Search Head Clustering
• Indexer Clustering and data replication
• Monitoring Console and Health Checks
• Troubleshooting Distributed Splunk setups

Module 7: Splunk Maintenance and Troubleshooting

• Monitoring system performance
• Using btool and diag tools
• Troubleshooting data ingestion and indexing
• Splunk backup, restore, and upgrade process

Splunk Developer Track

Module 8: Search Processing Language (SPL)

• SPL fundamentals
• Search commands: stats, eval, table, dedup, sort, where
• Filtering and transforming data
• Using lookup tables and subsearches
• Creating macros and workflow actions

Module 9: Creating Reports and Alerts

• Creating and scheduling reports
• Setting up alerts and alert actions
• Configuring alert throttling and notifications
• Report acceleration and summary indexing

Module 10: Dashboards and Visualizations

• Understanding Splunk dashboards
• Using Simple XML for dashboard customization
• Building real-time and dynamic dashboards
• Adding charts, graphs, and panels
• Dashboard permissions and sharing

Module 11: Developing Splunk Apps

• Introduction to Splunk Apps and Add-ons
• Creating custom apps for Splunk
• Using app.conf and metadata
• Packaging and publishing apps
• Splunk REST API fundamentals

Module 12: Advanced Development

• Advanced search optimization techniques
• Using KV stores and data models
• Working with Splunk SDKs (Python, JavaScript)
• Integrating Splunk with external systems
• Developing modular inputs

Hands-On Labs

• Install and configure Splunk Enterprise
• Configure Forwarders and Indexers
• Create dashboards, alerts, and scheduled reports
• Build a custom Splunk app
• Implement a distributed Splunk setup with clustering