Splunk Advanced Power User Fast Start

Course Duration

3 Days

Audience

Employees of federal, state and local governments; and businesses working with the government.

Prerequisites

Completion of Splunk Power User Fast Start (SP-POWER-U) or equivalent experience. Students should hold or be prepared to sit for the Splunk Core Certified Power User certification.

Course Description

This 18-hour Fast Start series bundles six modules to deliver the full content for the Splunk Core Certified Advanced Power User certification. Students learn advanced search techniques, sophisticated data manipulation with eval and stats commands, complex lookups, advanced knowledge objects, and Splunk best practices for building scalable, efficient searches across large data sets.

Learning Objectives

• Use advanced eval functions to transform and normalize field values
• Apply advanced statistical commands including eventstats, streamstats, and xyseries
• Create and manage complex lookup tables and lookup transformations
• Build advanced knowledge objects including calculated fields, field aliases, and event types
• Optimize searches for performance across large Splunk deployments
• Use advanced subsearch techniques and join commands
• Create advanced reports and visualizations

Course Outline

Advanced Searches and Reports

• Advanced eval functions
• Advanced statistical commands
• Comparing values and conditional logic
• Result modification and normalization
• Multivalue field operations

Advanced Lookup Operations

• Creating and managing lookup tables
• Dynamic lookups
• Lookup transformation best practices

Advanced Knowledge Objects

• Calculated fields
• Field aliases
• Event types and tagging
• Search macros with arguments

Search Optimization

• Search performance fundamentals
• Using tstats for fast searches
• Summary indexing
• Report acceleration

Frequently Asked Questions