Splunk Enterprise Architect Fast Start

Course Duration

5 Days

Audience

Employees of federal, state and local governments; and businesses working with the government.

Prerequisites

Completion of Splunk Enterprise Cluster Administration (SP-SCLA) or equivalent. Strong working knowledge of distributed Splunk deployments, clustering, and data administration.

Course Description

This 5-day Fast Start series delivers the three-module content needed for the Splunk Enterprise Certified Architect certification. Students learn to architect and size large-scale Splunk deployments, design for high availability, plan capacity for indexing and search workloads, implement advanced deployment patterns, and govern enterprise Splunk environments at scale.

Learning Objectives

• Assess organizational requirements to design an appropriate Splunk architecture
• Size Splunk infrastructure for indexing throughput and search concurrency
• Design high-availability architectures using clustering and load balancing
• Plan and implement distributed deployments with multiple indexer clusters
• Configure advanced Splunk features including data tiering and SmartStore
• Govern Splunk configuration management across large enterprise deployments
• Troubleshoot and optimize performance across complex Splunk environments

Course Outline

Architecting Splunk Deployments

• Design considerations and requirements
• Deployment architecture patterns
• Sizing and capacity planning
• Hardware and storage planning

Advanced Cluster Configuration

• Multi-site indexer clustering
• Search head cluster with deployer
• Deployment server at scale
• SmartStore configuration

Enterprise Governance

• Configuration file management
• Splunk app management
• Performance tuning
• Advanced troubleshooting techniques

Frequently Asked Questions