In this course, you will learn how fields are extracted and how to create regex and delimited field extractions. You will upload and define lookups, create automatic lookups, and use advanced lookup options. You will learn about datasets, designing data models, and using the Pivot editor. You’ll improve search performance by creating efficient base searches, accelerating reports and data models, and how to use the tstats command.
Class Deals by MOOC List - Click here and see Coursera's Active Discounts, Deals, and Promo Codes.
Course 2 of 3 in the Splunk Knowledge Manager Specialization.
What You Will Learn
- Learn how to perform different types of regex and delimited field extractions and when the field extraction process occurs.
- Define, create, and use file-based lookups and identify where lookups fall in the search-time operation sequence.
- Add event, search, and transaction datasets to data models and learn how to work with Pivots by creating, configuring, and visualizing a Pivot.
- Understand how search modes affect performance by defining and using acceleration and acceleration types.
Syllabus
WEEK 1
Creating Field Extractions
This module is for knowledge managers who want to learn about field extraction and the Field Extractor (FX) utility. Topics will cover when certain fields are extracted and how to use the FX to create regex and delimited field extractions.
WEEK 2
Enriching Data with Lookups
This module is for knowledge managers who want to use lookups to enrich their search environment. Topics will introduce lookup types and cover how to upload and define lookups, create automatic lookups, and use advanced lookup options. Additionally, students will learn how to verify lookup contents in search and review.
WEEK 3
Data Models
This module is for knowledge managers who want to learn how to create and accelerate data models. Topics will cover datasets, designing data models, using the Pivot editor, and accelerating data models.
WEEK 4
Search Optimization
This module is for users who want to improve search performance. Topics will cover how search modes affect performance, how to create an efficient basic search, how to accelerate reports and data models, and how to use the tstats command to quickly query data.
