The Splunk Platform

SPLK-DSRAPI : Developing with Splunk's REST API

Course Duration

2 Days

Delivery

ILT VILT

Overview

Overview Course Curriculum Training Schedule Exam & Certification FAQs

This 9-hour course is for developers who want to use the Splunk REST API to interact with Splunk servers. In this course, use curl and Python to send requests to Splunk REST endpoints and learn how to parse and use the results. Create a variety of objects in Splunk, learn how to change properties, work with and apply security to Splunk objects, run different types of searches and parse its results, ingest data using the HTTP Event Collector and manipulate collections and KV Stores.

What You'll Learn

Introduction to the Splunk REST API
Namespaces and Object Management
Parsing Output
Oneshot Searches
Normal and Export Searches
Advanced Searching and Job Management
Working with KV Stores
Using the HTTP Event Collector (HEC)

Who Should Attend

Splunk Administrator
Developer
User
Knowledge Manager
Architect

Prerequisites

To be successful, students should have a solid understanding of the following:

Splunk Fundamentals 1 and 2

Or the following single-subject courses:

What is Splunk?
Intro to Splunk
Using Fields
Working with Time
Statistical Processing
Search Under the Hood
Introduction to Knowledge Objects

Students should also understand the following courses:

Splunk Enterprise Data Administration (Recommended)

Learning Journey

Coming Soon...

Module 1 – Introduction to the Splunk REST API

Introduce the Splunk development environment and its REST endpoints
Connect to the appropriate Splunk server to accomplish a desired task
Authenticate with a Splunk server, with and without a session

Module 2 – Namespaces and Object Management

Understand general CRUD with the REST API
Identify how a namespace affects access to objects
Use the servicesNS node and a namespace to access objects
Understand how the sharing level and access control lists affect access to objects
Modify the sharing level and the permissions on an object

Module 3 – Parsing Output

Understand the general structure of Atom-based output
Format Atom-based XML and JSON output
Write code that uses the API and parse responses

Module 4 – Oneshot Searches

Review search language syntax and search best practices
Execute oneshot searches
Get search results and parse them

Module 5 – Normal and Export Searches

Identify types of searches
Execute normal and export searches
Get search results, job status and search job properties.

Module 6 – Advanced Searching and Job Management

Execute real-time searches
Work with saved searches
Manage search jobs

Module 7 – Working with KV Stores

Define the function of a KV Store
Define collections and records
Perform CRUD operations on collections and records

Module 8 – Using the HTTP Event Collector (HEC)

Create and use HEC tokens
Input data using HEC endpoints
Get indexer event acknowledgements

Module 9 – Useful Admin REST APIs

Get system information
Manage Splunk configuration files
Manage Indexes

Module 10 – Custom REST Endpoints

Extending the Splunk REST API
Publish your own endpoints
Using custom REST API endpoints

Frequently Asked Questions (FAQs)

Why get Splunk certified?

Splunk certifications validate your expertise in data analytics and your proficiency in using the Splunk platform.
These certifications demonstrate your ability to leverage Splunk's powerful tools for data collection, analysis, and visualization, making you a valuable asset to organizations seeking to gain actionable insights from their data.
Splunk-certified professionals are in high demand across various industries, including IT, security, and business analytics.
What to expect for the examination?

Splunk offers a variety of certification exams at different levels, covering various domains and products within the Splunk platform.
Exams typically consist of multiple-choice and scenario-based questions that assess your knowledge and skills in using Splunk to solve real-world problems.
Note: Certification requirements and policies may be updated by Splunk from time to time. We apologize for any discrepancies; do get in touch with us if you have any questions.
How long is Splunk certification valid for?

All Splunk certifications are valid for three years from the date of passing the highest-level certification exam.
To maintain your certification, you will need to recertify before it expires. You have three options for recertification:
- Pursue a higher-level certification (including any required prerequisite courses), in which case your lower-level certifications would also be renewed on the date of passing the next-level certification exam.
- Retake a certification exam within the final year of their recertification window to renew their certifications at that level (and any applicable downstream certifications).
- Complete continuing education courses at any point in the three year recertification window beginning the date of badge issuance.
Note: Certification requirements and policies may be updated by Splunk from time to time. We apologize for any discrepancies; do get in touch with us if you have any questions.
Why take this course with Trainocate?

Here’s what sets us apart:
- Global Reach, Localized Accessibility: Benefit from our geographically diverse training hubs in 16 countries (and counting!).
- Top-Rated Instructors: Our team of subject matter experts (with high average CSAT and MTM scores) are passionate to help you accelerate your digital transformation.
- Customized Training Solutions: Choose from on-site, virtual classrooms, or self-paced learning to fit your organization and individual needs.
- Experiential Learning: Dive into interactive training with our curated lesson plans. Participate in hands-on labs, solve real-world challenges, and take on comprehensive assessments.
- Learn From The Best: With 30+ authorized training partnerships and countless awards from Microsoft, AWS, Google – you're guaranteed learning from the industry's elite.
- Your Bridge To Success: We provide up-to-date course materials, helpful exam guides, and dedicated support to validate your expertise and elevate your career.

Keep Exploring

Course Curriculum

Training Schedule

Exam & Certification

FAQs

Frequently Asked Questions

Improve yourself and your career by taking this course.

Enroll Now

More Courses By Splunk

Browse All Courses

Ready to Take Your Business from Great to Awesome?

Level-up by partnering with Trainocate. Get in touch today.

Name

Phone

I'm inquiring for

Myself
Company

Inquiry Details

By providing your contact details, you agree to our Privacy Policy.