Table of Contents

Splunk Development - Advanced 3

What is the role of Splunk Developer in a Project? 3

What are the pre-requisites to learn Splunk Development? 3

Splunk basic housekeeping 3

Important information you should know from your project, as a Splunk Developer 3

Where to start learning? 3

Field Extractions - Deep dive 4

Field Filters - Deep dive 4

Field Aliasing - Deep dive 4

Calculated Fields - Deep dive 4

Lookups - Deep dive 4

Eventtypes - Deep dive 5

Tags - Deep dive 5

Reports - Deep dive 5

Alerts - Deep dive 5

Macros - Deep dive 6

Data Models - Deep dive 6

Splunk Add-on - Deep dive 6

Splunk Query writing - Introduction 7

Splunk Query writing - Intermediate 7

Splunk Query writing - Advanced 7

Dashboarding & Visualization 8

Splunk App Building 8

Search Optimization 9

References 10

Contact 10

Register here - [Link] 2

Splunk Development - Advanced
What is the role of Splunk Developer in a Project?
● Day to day responsibilities of a Splunk Developer

What are the pre-requisites to learn Splunk Development?

● Basic IT terminologies
● Basics of HTML
● Basics of Python
● Basics of Configuration file
● Basic Linux commands
● Basics of git
● What is the difference between structured & unstructured data?

Splunk basic housekeeping

● How to install Splunk?
● How to start, stop, restart, reload Splunk from CLI?
● How to run a basic search in Splunk?
● How to create a basic dashboard in Splunk?

Important information you should know from your project, as a

Splunk Developer
● Architecture overview
● Access Level given to you
● Deployment procedure / Flow
● Version control system (VCS)

Where to start learning?

● Get a Splunk Environment with Live data for you
● Learn the Process of converting Raw data into Knowledge

Register here - [Link] 3

Field Extractions - Deep dive
● How does Event line breaking works in Splunk?
● How does Splunk extracts fields?
● How to extract fields with manual configurations?
● How to use Regular expressions to extract fields from raw data?
● How does the permissions / access control works with Splunk fields?

Field Filters - Deep dive

● How does the field filter work?
● How to use field filters? - To hide a particular field for particular users
● How to use field filters? - To mask a particular field’s value for particular users

Field Aliasing - Deep dive

● How does the field alias work?
● How does Field Alias differ from RENAME command?
● How to use Field Alias? - To normalise the data from multiple sources with
similar data

Calculated Fields - Deep dive

● How does the calculated field work?
● What are the constraints of Calculated fields?
● How to use calculate fields? - To make the calculations re-usable

Lookups - Deep dive

● How does the lookup work?
● What are the different lookups in Splunk?
● CSV lookups- How does it work?
● KV Store lookups - How does it work?
● External lookups - How does it work?
● Geospatial lookups - How does it work?
● Time-based lookup - How does it work? When to use this?

Register here - [Link] 4

 ● Automatic lookup - How does it work? When to use this?
● Will there be any performance issue while using lookups?

Eventtypes - Deep dive

● How does the eventtypes work?
● When to create an eventtype? (Advantages of eventtype)
● When to not create an eventtype? (Disadvantages of eventtype)
● Will there be any performance issue while using eventtypes?

Tags - Deep dive

● How do tags work?
● Why to create tags?
● What is the difference between eventtypes and tags?
● Will there be any performance issue while using tags?
● When to use lookup for tags?

Reports - Deep dive

● How does the report work?
● How to create a Report?
● How to schedule a Report for a Particular Time
● How to schedule a Report that sends a PDF to multiple email IDs based on
data
● How to schedule a Report to improve dashboard performance?
● How to generate Scheduled Reports with conditional data splitting?
● How to export Scheduled Reports in multiple formats?
● How to use Lookup files in Scheduled Reports?
● How to handle skipped reports, to avoid gaps?
● Troubleshoot common Report issues

Alerts - Deep dive

● How does the Alert work?
● How to create an Alert?

Register here - [Link] 5

 ● How to trigger an Alert when a Report detects anomalies?
● How to throttle Alerts to avoid spam notifications?
● How to create Alerts based on Dynamic Thresholds (Trend-Based Alerting)
● How to trigger Multi-Action Alerts (Email, Script Execution, Ticketing, etc.)
● How to trigger Alerts based on Lookup data?
● How to trigger Alerts using REST API/Webhooks?
● How to use Per-Result vs. Aggregated Alerts?
● How to Suppress Alerts During Maintenance Windows?
● Troubleshoot common Alert issues

Macros - Deep dive

● How do the macros work?
● When to use macros?
● How to pass arguments to the macros?
● How to create nested macros in Splunk?

Data Models - Deep dive

● How does the Data model works in Splunk?
● What problem does Data Model solve?
● When to use a Data model?
● How to use a Data model?
● CIM (Common Information Model) - Introduction
● CIM Mapping - How to make any Data CIM-Compatible?
● Accelerating a Data model - What is it?
● Why should we accelerate a Data model?
● When should we accelerate a Data model?
● How should we accelerate a Data model?
● Creating Alerts & Reports for CIM-Compatible Data

Splunk Add-on - Deep dive

● Splunk Add-on - What is it?
● Where to search for an existing Add-on?

Register here - [Link] 6

 ● How to decide where to deploy a particular Add-on?
● Should we split the add-on before deployment?
● How to split? - Use Splunk App packaging toolkit
● How to create a new Add-on?

Splunk Query writing - Introduction

● Write queries with basic Search commands - search, stats, timechart
● Write queries using simple filtering - index, source, sourcetype
● Write queries using stats command - count, sum, avg, max. min, median,
latest, earliest, etc

Splunk Query writing - Intermediate

● Write queries using advanced filtering - earliest, latest, timewrap
● Write queries using eval command - to create new fields based on conditions
● Write queries with regular expressions - Extract fields using rex command
● Write queries with regular expressions - Applying rex on unstructured logs
● Write queries with regular expressions - Combining eval with rex for field
transformations
● Write queries using advanced filtering - earliest, latest, timewrap
● Write queries using eval command - to create new fields based on conditions
● Write queries with regular expressions - Extract fields using rex command
● Write queries with regular expressions - Applying rex on unstructured logs
● Write queries with regular expressions - Combining eval with rex for field
transformations

Splunk Query writing - Advanced

● Subsearches - How does it work?
● Write queries using subsearches - with stats, top, join
● Write queries using complex aggregation - stats (values, list, count by)
● Write queries using complex aggregation - time-based (timechart, bin)
● Write queries with complex stats - with streamstats, eventstats

Register here - [Link] 7

Dashboarding & Visualization
● Overview of Inputs - Text, Drop-down, Multi-select, Radio button, Submit,
Checkbox, List, Time
● How to create dependent dropdowns?
● How to create a drill-down for panels?
● How to handle tokens inside the dashboard? - Set & unset token
● How to customize the Splunk native charts/tables?
● How to add custom charts/tables in the Splunk dashboard?
● How to use base search in the Splunk dashboard?
● How to use a saved search in Splunk dashboard?
● How to create a dashboard that refreshes automatically?
● How to create popup/modal drill-downs?
● How to handle the utility features menu?
● How to enable dark mode in the Splunk dashboard?
● How to create Tabs in the dashboard?
● How to add a background image?
● How to create a custom command/feedback box?
● How to group the metrics into a Single panel?
● How to add a Disclaimer popup in Splunk Dashboard?
● How to add a custom css or javascript logic to Splunk Dashboard?

Splunk App Building

● What is an App in Splunk?
● How to create an App in Splunk?
● How to add a logo to an App?
● How to create a dashboard inside an App?
● How to create Landing Page/Home Page for your App?
● How to customize the navigation bar?
● How to customize the theme of your App?
● How to handle local configurations during the packaging?
● How to Package Apps with a Slim Packaging Tool Kit?

Register here - [Link] 8

 ● How to do Appinspect? For Scanning?
● How to Deploy Apps to Search Head Clusters?
● How to Deploy Apps to Indexer Clusters?
● How to Deploy Apps to Forwarders?
● How to automate Splunk App deployment?
● How to Deploy Apps using CICD Pipeline (GitHub, Jenkins)

Search Optimization
● What happens if the search is not optimised?
● What are the search optimization Principles?
● Quick Tips for Optimization - Limit the data from disk
● Quick Tips for Optimization - Narrow the time window
● Quick Tips for Optimization - Specify the index, source or sourcetype
● Quick Tips for Optimization - Be specific
● Quick Tips for Optimization - Limit the number of events retrieved
● Quick Tips for Optimization - Use TERM directive to match terms that contain
minor breakers
● Quick Tips for Optimization - Avoid using NOT expressions
● Filter as soon as possible - Use field value-pairs before the first pipeline
● Filter as soon as possible - Use filtering commands before calculating
commands
● Filter as soon as possible - Filter unnecessary fields from search results
● Filter as soon as possible - Use non-streaming commands as late as possible
● Other techniques for search optimization - Post-process searches
● Other techniques for search optimization - Summary Indexing
● Other techniques for search optimization - Report Acceleration
● Other techniques for search optimization - Data model acceleration

Happy Splunking…!!

For any help/support required on Splunk, please contact the Soft Mania Team using
any one of the methods mentioned at the end of this document.

Register here - [Link] 9

References
[Link]

Contact
Email: info@[Link]

Website: Soft Mania

WhatsApp: [Link]

WhatsApp Community: [Link]

LinkedIn: [Link]

Instagram: [Link]

YouTube: [Link]

Telegram: [Link]

Register here - [Link] 10