Splunk Certified Study Guide

Make your Splunk certification easier with this exam study guide that covers the User, Power User, and Enterprise Admin certifications. This book is divided into three parts. The first part focuses on the Splunk User and Power User certifications starting with how to install Splunk, Splunk Processing Language (SPL), field extraction, field aliases and macros, and Splunk tags. You will be able to make your own data model and prepare an advanced dashboard in Splunk.

In the second part, you will explore the Splunk Admin certification. There will be in-depth coverage of Splunk licenses and user role management, and how to configure Splunk forwarders, indexer clustering, and the security policy of Splunk. You’ll also explore advanced data input options in Splunk as well as .conf file merging logic, btool, various attributes, stanza types, editing advanced data inputs through the .conf file, and various other types of .conf file in Splunk.

The concluding part covers the advanced topics of the Splunk Admin certification. You will also learn to troubleshoot Splunk and to manage existing Splunk infrastructure. You will understand how to configure search head, multi-site indexer clustering, and search peers besides exploring how to troubleshoot Splunk Enterprise using the monitoring console and matrix.log. This part will also include search issues and configuration issues. You will learn to deploy an app through a deployment server on your client’s instance, create a server class, and carry out load balancing, socks proxy, and indexer discovery.

By the end of the Splunk Certified Study Guide, you will have learned how to manage resources in Splunk and how to use REST API services for Splunk. This section also explains how to set up Splunk Enterprise on the AWS platform and some of the best practices to make them work efficiently together.

The book offers multiple choice question tests for each part that will help you better prepare for the exam.

WHAT YOU WILL LEARN

* Study to pass the Splunk User, Power User, and Admin certificate exams
* Implement and manage Splunk multi-site clustering
* Design, implement, and manage a complex Splunk Enterprise solution
* Master the roles of Splunk Admin and troubleshooting
* Configure Splunk using AWS

WHO THIS BOOK IS FOR

People looking to pass the User, Power User, and Enterprise Admin exams. It is also useful for Splunk administrators and support engineers for managing an existing deployment.

Deep Mehta is a AWS Certified Associate Architect, Docker Certified Associate, Certified Splunk Architect (ongoing), and Certified Splunk User, Power User, and Admin. He’s worked on the Splunk platform since 2017 having experience consulting in the telecommunication, aviation, and healthcare industries. Apart from being passionate about big data technologies, he also loves playing squash and badminton.

PART 1: SPLUNK ARCHITECTURE , SPLUNK SPL(SEARCH PROCESSING LANGUAGE) AND SPLUNK KNOWLEDGE OBJECTS

GOAL: In this module, readers will be given a detailed idea about current splunk architecture.They will learn how to fire splunk queries using splunk SPL(Search Processing Language) and will look into all the modules provided by splunk to analyze data and will cover all modules necessary to pass power user exam which covers splunk knowledge objects in detail.This module is basic module where we create base for candidate to pass splunk admin exam.

Chapter 1: Overview Of Splunk

Chapter 2: Splunk Search Processing Language

Chapter 3: Macros,Field Extraction and Field Aliases

Chapter 4: Tags,Lookups and Correlating Events

Chapter 5: Datamodels,Pivot and CIM in Splunk

Chapter 6: Knowledge Manager and Dashboard in Splunk

Chapter 7: Splunk User/Power User Exam set

PART 2: SPLUNK DATA ADMINISTRATION AND SYSTEM ADMINISTRATION

GOAL: In this module data & system administration are designed in a way that will focus on very important topics that will help candidates to pass splunk admin exam.We will study the roles of a splunk admin. In this module, we will understand the concepts behind splunk Licenses and role management, configuring splunk forwarders, clustering in splunk, getting advanced data input and updating .conf file.

Chapter 8: Splunk Licenses, Indexes and role Management

Chapter 9: Machine Data using Splunk forwarder and clustering

Chapter 10: Splunk Advanced Data Inputs

Chapter 11: Splunk Advanced .Conf file and Diag

Chapter12: Splunk Admin Exam set

PART 3: ADVANCED SPLUNK

GOAL: In this part we will explore some features that are very useful for splunk admins in day to day life like infrastructure planning with search head clustering , troubleshooting in splunk,Advanced Deployment, Roles of splunk architect and splunk best practices . By the end of this module, readers will gain a more advanced insight of splunk.

Chapter 13: Infrastructure planning with Indexer and Search Head Clustering

Chapter 14: Troubleshooting in Splunk

Chapter 15: Advanced Deployment in Splunk

Chapter 16: Advanced Splunk

Chapter 17: Final Practice set

Chapter 18: Setting up a Splunk Environment with AWS