Splunk

Curriculum

1. 01

   Splunk & the Search Pipeline

   What Splunk is for, how it stores machine data as events with fields, and how a search reads left-to-right as a pipeline that narrows and transforms data.

   Available
   • Events, Fields and SourcetypesTheory
   • The Search Pipeline and TimeTheory
   • Module 1 Knowledge Check — Splunk & the Search PipelineKnowledge Check
2. 02

   Searching and Filtering

   Cut millions of events down to the few that answer your question: keyword and field search, boolean logic, table and fields, sort and dedup.

   Available
   • Keyword, Field and Boolean SearchTheory
   • Shaping Results: fields, table, sort, dedupTheory
   • Module 2 Knowledge Check — Searching and FilteringKnowledge Check
   • Filter to the TruthBrowser Lab
3. 03

   Aggregating and Transforming

   Turn events into answers: stats with count/values/dc, top and rare, eval for derived fields, and timechart to see a pattern over time.

   Available
   • stats: count, values, dc, byTheory
   • top / rare, eval and timechartTheory
   • Module 3 Knowledge Check — Aggregating and TransformingKnowledge Check
   • Spray or Brute Force?Browser Lab
   • The Steady HeartbeatBrowser Lab
4. 04

   Investigating with Splunk

   Put it together: turn a question into a search, correlate across authentication, endpoint and network sources into one timeline, validate the hypothesis and avoid a misleading conclusion — then work a real investigation.

   Available
   • From Question to SearchTheory
   • Correlating Across Sources and Building a TimelineTheory
   • Ten Minutes to a VerdictBrowser Lab