SPLK-SCA - Splunk Cloud Administration

This 18-hour Instructor led course is for administrators new to Splunk Cloud and those wanting to become more experienced in managing Splunk Cloud instances. The course provides administrators with the opportunity to gain the skills, knowledge and best practices for data management and system configuration for data collection and ingestion required in a Splunk Cloud environment to create a productive Splunk SaaS deployment. The hands-on labs provide the opportunity to learn and ask questions on how to manage and maintain the platform, the users and how to effectively get data into Splunk Cloud. Modules include data inputs and forwarder configuration, data management, user accounts, and basic monitoring and problem isolation.

Duration: 4.0 days

Enquire Now

Schedule

Virtual ILT | 13 May 2024 - 16 May 2024 India
Virtual ILT | 27 May 2024 - 30 May 2024 Sri Lanka

Start learning today!

Click Hereto customize your Training

Objectives

  • Splunk Cloud overview
  • Managing user authentication and authorization in Splunk
  • Managing Splunk indexes
  • Using Splunk configuration files
  • Configuring and managing Splunk forwarders
  • Configuring inputs to the Cloud, including files and directories from forwarders, API, Scripted, HEC, and Application based inputs
  • Exploring the parsing phase and data preview
  • Manipulating raw data
  • Installing and managing applications
  • Problem isolation and working with Splunk Cloud support

Content

Module 1 – Splunk Cloud Overview

  • Describe Splunk Cloud features and topology
  • Identify Splunk Cloud administrator-managed tasks
  • List the primary Splunk Enterprise on-prem and Splunk Cloud administrator tasks
  • Explain Splunk Cloud data ingestion strategies

Module 2 – Managing Users

  • Identify Splunk Cloud authentication options
  • Add Splunk users using native authentication
  • Integrate Splunk with LDAP, Active Directory or SAML
  • Create a custom role
  • Manage users in Splunk
  • Use Workload Management to manage user resource usage

Module 3 – Managing Indexes

  • Understand cloud indexing strategy
  • Define and create indexes
  • Manage data retention and archiving
  • Delete and mask data from an index
  • Monitor indexing activities

Module 4 – Using Configuration Files

  • Describe Splunk configuration directory structure
  • Describe the configuration layering process with index and search time precedence
  • Use Splunk tools to examine configuration settings such as b tool

Module 5 – Configuring Forwarders

  • List Splunk forwarder types
  • Understand the role of forwarders
  • Configure a forwarder to send data to Splunk Cloud
  • Test the forwarder connection
  • Describe optional forwarder settings

Module 6 – Managing Forwarders

  • Describe Splunk Deployment Server (DS)
  • Manage forwarders using deployment apps
  • Configure deployment clients and client groups
  • Monitor forwarder management activities

Module 7 – Forwarder Inputs

  • Describe the Splunk process for inputting data
  • Creating network inputs
  • Create file and directory monitor inputs
  • Use optional settings for monitor inputs

Module 8 –API, Scripted and HEC Inputs

  • Create REST API inputs
  • Create a basic scripted input
  • Identify Linux-specific inputs
  • Identify Windows-specific inputs
  • Create Splunk HTTP Event Collector (HEC) agentless inputs

Module 9 – Application Based Inputs

  • Understand how inputs are managed using apps or add-ons
  • Explore Cloud inputs using Splunk Connect for Syslog, Data Manager, Inputs Data Manager (IDM), Splunk Edge Processor, and Splunk Edge Hub

Module 10 – Fine-tuning Inputs

  • Describe the default processing that occurs during the input phase
  • Configure input phase options, such as source type fine-tuning and character set encoding
  • Reset file check pointers on a forwarder using the bt probe command

Module 11 – Parsing Phase and Data Preview

  • Describe the default processing that occurs during parsing
  • Optimize and configure event line breaking
  • Modify how timestamps and time zones are extracted or assigned to events
  • Use Data Preview to validate event creation during the parsing phase

Module 12 – Manipulating Raw Data

  • Explore Splunk transformation methods
  • Mask data with SEDCMD and TRANSFORMS
  • Override sourcetype or host based upon event values
  • Create rulesets with Ingest Actions
  • Mask data with Ingest Action rules

Module 13 – Installing and Managing Apps

  • Review the process for installing apps
  • Define the purpose of private apps
  • Upload private apps
  • Describe how apps are managed

Module 14 – Managing Splunk Cloud

  • Describe Splunk connected experience apps such as Splunk Secure Gateway
  • Monitor and manage resource utilization by business units and users using Splunk App for Chargeback
  • Perform self-service administrative tasks in Splunk Cloud using the Admin Config Service

Module 15 – Supporting Splunk Cloud

  • Know how to isolate problems before contacting Splunk Cloud Support
  • Use Isolation Troubleshooting
  • Define the process for engaging Splunk Support
  • Improve Mean Time to Resolution (MTTR) by using clear communication, diagnostic tools, monitoring and the CMC

Audience

  • Splunk Administrator
  • Developer
  • User
  • Knowledge Manager
  • Architect

Prerequisites

To be successful, students should have a working knowledge of the topics covered in the following courses:

  • What is Splunk?
  • Intro to Splunk
  • Using Fields
  • Introduction to Knowledge Objects
  • Creating Knowledge Objects
  • Creating Field Extractions

Certification

product-certification

Course Benefits

product-benefits
  • Career growth
  • Broad Career opportunities
  • Worldwide recognition from leaders
  • Up-to Date technical skills
  • Popular Certification Badges

Splunk Popular Courses

splk-sefs

This "Fast Start" course covers over 60 commands and functions and prepares students to be search experts.

splk-iiss

This course prepares security practitioners to use SOAR to respond to security incidents.

splk-dyd

This course focuses on creating inputs, chain searches, event annotations, and improving dashboard performance.

splk-introdyd

This course focuses on dashboard creation, including prototyping, the dashboard definition, layouts types, adding visualizations, and dynamic coloring.
Enquire Now
 
 
 
 
6xywAC
By clicking "Submit", I agree to the Terms Of Use and Privacy Policy