Splunk Advanced Training in Bangkok, Thailand

This training provides hands-on exposure to advanced Splunk concepts including search optimization, advanced commands, data models, dashboards, alerts, and Splunk administration. Participants will learn how to manage large datasets efficiently, build custom visualizations, implement best practices for scaling, and integrate Splunk with enterprise systems.

Advanced Search and Data Management

Module 1: Advanced SPL (Search Processing Language)

• Review of core SPL commands
• Advanced search commands (stats, eval, transaction, eventstats)
• Subsearches and nested queries

Module 2: Search Optimization and Performance

• Understanding how Splunk processes searches
• Optimizing queries for large datasets
• Time range selection, filtering, and sampling techniques

Module 3: Data Models and Pivots

• Creating and managing data models
• Data model acceleration
• Using Pivot for advanced analytics

Module 4: Lookups and Macros

• Types of lookups: CSV, KV Store, external lookups
• Creating, editing, and applying lookups
• Using macros for query simplification

Dashboards, Alerts, and Administration

Module 5: Advanced Dashboards and Visualization

• Customizing dashboards with advanced XML
• Drilldowns, tokens, and dynamic inputs
• Creating interactive dashboards for end-users

Module 6: Alerts and Reporting

• Configuring scheduled searches and alerts
• Using throttling and suppression
• Building reports for business and technical teams

Module 7: Splunk Administration and Scaling

• Indexer and search head clustering concepts
• Forwarders and data ingestion best practices
• Managing users, roles, and permissions

Module 8: Integration and Troubleshooting

• Splunk integration with external tools (e.g., ServiceNow, SIEM, cloud services)
• Monitoring and troubleshooting Splunk performance
• Best practices for scaling Splunk deployments

Module 9: Wrap-Up and Feedback

• Review and Q&A
• Next steps: Splunk Enterprise Security, Splunk ITSI, or Splunk Cloud