This document describes a 4.5 hour Splunk training course that teaches power users how to search, navigate, tag, build alerts, and create simple reports and dashboards in Splunk. The course covers basic searches, sharing searches, using fields, adding tags and event types, creating alerts, and building reports and dashboards. It is designed for anyone who needs to use Splunk, including help desk staff, system administrators, and developers. The course is instructor-led with lectures and hands-on labs delivered virtually or on-site.

1. Splunk Education Services
Using Splunk 5.0This 4 ½ hour power-user course will teach you to search, navigate,
tag, build alerts and create simple reports and dashboards with
Splunk. It's recommended for anyone in your organization who
needs to use Splunk – from help desk staff to system administrators
and developers.
Course Topics
 Basic searches and navigation
 Share searches and search results
 Understand and use fields
 Add knowledge to your data with tags and event types
 Create alerts
 Create reports and dashboards
Class Format
Instructor-led lecture with labs. Delivered via virtual classroom or at
your site.
Course Objectives
Lesson 1 – Start Searching
 Introduce Splunk and the Search app
 Run basic searches
 Identify the contents of search results
 Control a search job
 Set the time range of a search
 Use the output of a search to refine your search
Lesson 2 – Saving Results and Searches
 Export search results
 Save and share search results
 Save searches
 Schedule searches
Lesson 3 – Using Fields
 Understand fields
 Use fields in searches
 Use the fields sidebar
Lesson 4 – Creating and Using Tags and Event Types
 Describe tags
 Create tags and use tags in a search
 Describe event types and their uses
 Create, tag, and use event types in a search
Lesson 5 – Creating Alerts
 Describe alerts
 Create an alert
 View fired alerts
Lesson 6 – Creating Reports
 Create reports and charts
 Create dashboards
 Edit dashboards to add panels
Splunk Education Tracks
User: For all day-to-day Splunk users including customer support
staff, developers, systems administrators and management.
Administrator: For administrators of Splunk itself. (Administrators
of other systems who will just be using Splunk should take the User
track.)
Architect: For architects who will be designing Splunk
deployments, including architects on staff at customer deployments
as well as partner professional services personnel.
Developer: For developers who will integrate, customize and
extend Splunk using its XML templates and advanced configuration
bundling.
Support Engineer: For Splunk OEM and channel partner support
staff who will be providing first line support for Splunk.
Tracks User Administrator Architect Developer
Support
Engineer
Using Splunk
✓ ✓ ✓ ✓ ✓
Searching and
Reporting with Splunk ✓ ✓ ✓ ✓
Administrating Splunk
✓ ✓ ✓
Advanced Splunk
Administration ✓ ✓ ✓
Architecting and
Deploying Splunk ✓ ✓
Developing Apps with
Splunk ✓ ✓ ✓
Splunk Architect
Certification Lab ✓
Supporting Splunk
✓
About Splunk
Splunk is software that indexes,
manages and enables you to search
data from any application, server or
network device in real time.
Visit our website at www.splunk.com
to download your own free copy.
Splunk Inc.
250 Brannan
San Francisco, CA 94107
866.GET.SPLUNK
(866.438.7758)
sales@splunk.com
support@splunk.com