课程详情

You will learn to leverage Splunk indexing mechanics, Splunk indexers in parallel, and optimal SPL to increase your search speed/efficiency by on average over 500k times faster; search times of months or days will be reduced down to minutes or seconds. A basic understanding of Splunk SPL commands and data analytics (averages and sums) is useful, but not essential, for success in this course because basic SPL will also be covered. Comfort with Linux and with Cloud services are both helpful in following the process for installing Splunk on the Cloud (highly recommended). Much like with Google Cloud and AWS, the first year with Azure is free.The key to searching fast in Splunk is to begin with a good idea of what you are looking for and how you will render that data into a form that you will use to understand the answer. You'll need to move away from wanting to see "everything" because the human eye is not designed to look at millions and billions of complex events. You'll need to plan the kind of information and format that you want to see into a relatively small number of rows and columns or lines on a chart. Be careful to avoid wanting to look at raw data because that is the easiest way to waste a lot of your time, slow you down and miss something.

课程标签

0人关注该课程

主题相关的课程