Troubleshooting Splunk Enterprise (SP‑TSE)

This 9-hour course is designed for Splunk administrators. It covers topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available with Splunk Enterprise.

This lab-oriented class is designed to help you gain troubleshooting experience before attending more advanced courses. You will debug a distributed Splunk Enterprise environment using the live system.

This course does not cover the issues surrounding Splunk Cloud, Splunk Clusters, or Splunk premium apps.

Splunk Troubleshooting Delivery Methods

• In-Person

• Online

• Upskill your whole team by bringing Private Team Training to your facility.

Splunk Troubleshooting Course Information

Key Features

This course is part of the following Certifications:

• Splunk Enterprise Certified Architect

You Will Learn How To

• Understand the Splunk Support Model and its resources
• Identify the best practices for troubleshooting Splunk Enterprise
• List ways to gather useful Splunk diagnostic information
• Use Splunk diagnostic tools
• Identify common Splunk technical issues and solve them

Prerequisites

To be successful, students should have a solid understanding of the following modules:

• Splunk Fundamentals 1 (Retired)
• Splunk Fundamentals 2 (Retired)

Or the following single-subject modules:

• What is Splunk? (Retired)
• Intro to Splunk
• Search Under the Hood
• Scheduling Reports & Alerts
• Visualizations
• Leveraging Lookups and Subsearches (LLS)
• Intro to Knowledge Objects
• Creating Knowledge Objects (CKO)
• Creating Field Extractions (CFE)
• Enriching Data with Lookups (EDL)
• Data Models (SDM)

Students should also have completed the following modules:

• Splunk Enterprise System Administration (SP‑SESA)
• Splunk Enterprise Data Administration (SPSEDA)

Who Should Attend

Splunk administrators.