2 hours 29 minutes
hi Before we begin our next and last video, which will be a review of the topics covered in this course, I wanted to discuss some other areas of study.
We've learned a lot in a short amount of time, but there's still so much more *** has to offer and so much more you're able to learn in this video. I'll introduce some topics that I won't fully explain.
This is intended to help you look for things to study on your own.
As a reminder Splunk does offer. Its own course is their first course of free, and I highly recommend that as a next step after finishing this one, it gets more in depth with search language timing. And it introduces some concepts we haven't covered, such as macros and lookups,
running better and more complex searches as also a great next step.
We just touched the surface of what you can. D'oh *** dot com has a great reference guide for learning other search commands. Ah, Phil Knoll Command, for example,
can replace an empty field value with the value you want.
The Make M V command can split field values lookup tables in store lists of information to compare it to search results and do many other things with
search Macros are portions of searches that could be reused and applied in other searches.
Summary indexing involves writing searches or report
results to a unique index. They can help
improve reporting efficiency, and it has other uses.
The common information model helps you normalize. Date up by having feel name an event tag standards that apply to different source types.
Again, this doesn't cover anywhere near everything, but gives you some good ideas.
A few ideas to study next door on architecture
could be understanding how to set up a distributed *** environment
how to be able to set up ah clustered environment.
Learning more about *** Data storage, including buckets
and getting familiar with the files and file structure used
Bye splint could be another good direction.
You may also want to study how to load balance, such as I have in a Ford, or be able to send the multiple indexers in case one is unreachable.
there's a lot to learn about hardware planning and best practices for sport.
You'll likely also want to spend some time browsing the many different APS and add ons available on *** base,
and you may want to learn how to create your own APS.
As you use one more,
you'll find the need to troubleshoot various problems that come up.
You might learn to use the command line tool called be tool to help troubleshoot
configuration file issues.
You could look at the job inspector to try and evaluate search performance.
You could dig into spunky or crash logs to try and identify issues.
You may also want to learn more about ***, licensing howto make intelligent purchases for your company and lead Splunk related projects.
You might also want to learn more about other split products and identify ways to automate and streamline business activities.
These are just a few ideas.
You've already learned a lot,
and you should have a good foundation for moving forward with your *** goals.
And her next video will have a final review
Splunk online test helps to assess knowledge of Splunk which is an advanced, scalable and ...
Event Log Collection
In this lab you will use Splunk Enterprise to ingest logs from a local host ...