Splunk Data Administration Training in Bangkok, Thailand

This course provides practical knowledge of administering Splunk data inputs, indexing, parsing, and storage. Participants will learn to configure and manage data pipelines, forwarders, indexers, retention policies, and troubleshoot ingestion issues to ensure high performance and scalability of Splunk environments.

Splunk Data Ingestion and Indexing

Module 1: Splunk Data Administration Fundamentals

• Splunk architecture refresher (forwarders, indexers, search heads)
• Role of a data administrator
• Overview of data pipelines (input → parsing → indexing → search)

Module 2: Configuring Data Inputs

• Types of inputs: files, directories, scripts, TCP/UDP, syslog, HTTP Event Collector (HEC)
• Setting up data sources in Splunk

Module 3: Parsing and Data Transformation

• Parsing pipeline: input, parsing, indexing, search
• Line breaking, timestamp extraction, and character encoding
• Using props.conf and transforms.conf for data manipulation

Module 4: Indexing and Storage

• Indexer roles and workflows
• Index structure: buckets (hot, warm, cold, frozen)
• Configuring data retention policies

Forwarders, Retention, and Troubleshooting

Module 5: Forwarder Management

• Universal Forwarder vs Heavy Forwarder
• Installing and configuring forwarders
• Forwarder management with Deployment Server

Module 6: Data Retention and Archiving

• Index storage management
• Retention strategies for compliance
• Archiving frozen data

Module 7: Troubleshooting Data Ingestion

• Common ingestion issues and log analysis
• Using Splunk’s internal indexes (_internal, _audit)
• Monitoring indexing performance

Module 8: Wrap-up and Best Practices

• Review best practices for Splunk data administration
• Q&A and next steps (Splunk Enterprise Admin, Scaling Splunk)

Hands-on Exercises

Summary and Conclusion