Search this site

Splunk Enterprise Administrator | Splunk Training Pack delivered by INGENIQ Splunk Enterprise Administrator Splunk Training Pack#2 Splunk Enterprise Administrator Learn more, for less.. Ingeniq Splunk Training Packs are a collections of courses that when purchased together qualify for discounts of up to 25%. Splunk Training Packs apply to all Training Tracks and Certifications – in fact to any combination of courses purchased together from Ingeniq. Buy Splunk Training Pack#2 and you’ll sit all the courses you need to be certified as a Splunk Enterprise Administrator. A Splunk Enterprise Certified Admin manages various components of Splunk Enterprise on a daily basis, including license management, indexers and search heads, configuration, monitoring, and getting data into Splunk. Add-On any combination of courses to your training pack purchase and they’ll qualify for discounts too. Call our Training Consultants now on 1300 245 802 or email sales@ingeniq.com.au to have this training pack tailored to you or your team' s requirements. Splunk Training Pack Courses Splunk Enterprise System Administration This virtual 9 hour course is designed for system administrators who are responsible for managing the Splunk Enterprise environment. The course provides fundamental knowledge of Splunk license manager, indexers and search heads. It covers configuration, management and monitoring core Splunk Enterprise components. Splunk Enterprise Data Administration This virtual 13.5 hour course is designed for system administrators who are responsible for getting data into Splunk Indexers. Troubleshooting Splunk Enterprise This 2 day course is designed for Splunk administrators. It covers topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available on Splunk Enterprise. Cert Exam - Splunk Enterprise Admin [USD125] There are three ways to purchase a PearsonVUE registration voucher: Directly from PearsonVUE From Splunk (as an individual) From Splunk (as an account) Full instructions below. Addon & Save!! Splunk Fundamentals 2 This course focuses on searching and reporting commands as well as on the creation of knowledge objects. Major topics include using transforming commands and visualizations, filtering and formatting results, correlating events, creating knowledge objects, using field aliases and calculated fields, creating tags and event types, using macros, creating workflow actions and data models, and normalizing data with the Common Interface Model (CIM). Splunk Enterprise Cluster Administration This 3 day course is for an experienced Splunk Enterprise administrator who is new to Splunk Clusters. The course provides the fundamental knowledge of deploying and managing Splunk Enterprise in a clustered environment. It covers installation, configuration, management and monitoring of Splunk clusters. Splunk Certifications Exam When you’re ready to take a Splunk Certification exam, please view the Exam-Registration-Tutorial for registration assistance. As a reminder, each exam attempt costs US$125. Bulk registration vouchers can be purchased at a discounted price of five registrations for US$500. How to register for your exam There are three ways to purchase a PearsonVUE registration voucher: 1) Directly from PearsonVUE This is the most streamlined approach. Follow the steps for account creation and exam registration provided at www.pearsonvue.com/splunk Payment will be collected at the time of registration. You can also visit the Pearson VUE voucher store for direct purchase. 2) From Splunk (as an individual) Log into your existing account at Splunk.com/Education to purchase a registration code. Payment can be made via credit card or existing Splunk Education credits. Splunk will email you a unique registration code, which can be used for registration at www.pearsonvue.com/splunk . 3) From Splunk (as an account) Your Splunk Sales Rep can add certification exams to any deal. Once the number of vouchers has been requested, Splunk will email your unique registration codes, which can be used for registration at www.pearsonvue.com/splunk All scheduled exams are subject to a minimum 24-hour cancellation and/or rescheduling policy. Failure to cancel or reschedule an exam within this timeframe results in forfeiture of registration fee. One of the best trainers I've had - keeps content relevant & explains the tasks in easily understood language. Extremely knowledgeable in all fields relating to the content. Well paced & accommodated to everyone's questions & progress. Participant, Splunk Enterprise Data Administration

Administering SOAR Training delivered by INGENIQ Administering Splunk SOAR The Administering SOAR (previously called Phantom) course prepares IT and security practitioners to install, configure and use a SOAR (Phantom) server in their environment and will prepare developers to attend the playbook development course. This 3.5 hour course prepares IT professionals to configure and manage SOAR Splunk Credit Value : 50 Duration : 3.5 hours over 1 day Time : 11:00 am - 2:30 pm AEST *Course discounts apply for Splunk Partners. Please use the currency convertor above to check for course pricing in your local currency. Enquiry Form Let us know what you're after Courses for me Certifications for me Courses for my team Dedicated courses for my teams Training Tracks for my Company Dedicated courses for my Company Training Packs Using Splunk Training Credits Submit Thanks for submitting! The instructor very knowledgeable and was able to provide useful examples during the course.. Participant, Splunk Enterprise System Administration Administering SOAR - Course Topics SOAR concepts Initial configuration Apps and assets Configuring automation User management Ingesting data Customization and monitoring Class Format Instructor-led lecture with labs. Delivered via virtual classroom or at your site Course Prerequisites To be successful, students must have a working understanding of these courses: Investigating Incidents with Splunk SOAR Related Certifications None Administering SOAR - Audience Anyone whose role includes deploying, or maintaining and configuring Splunk SOAR (Phantom). SOC Engineer, Security Architects, Threat Hunters & Responders. After completing Administering SOAR course you will be able to Install and configure SOAR (Phantom) Configure apps, assets, access control and manage playbooks Identify and onboard data into SOAR (Phantom) Work with containers, labels, artifacts, and tags Manage investigations with actions and playbooks Use workbooks and case management Module 1 – Initial Configuration Describe SOAR operating concepts Identify documentation and community resources SOAR & Splunk Architecture Product settings Access control Authentication settings Response settings Understanding roles Creating users Managing user access Module 2 – Apps, Assets and Playbooks Add and configure apps and assets Manage playbooks Ingesting Data Labels and tags Event settings Module 3 – Customisation and Monitoring Create custom severity levels Create custom status levels Add custom fields and CEF settings Create custom workbooks Run reports Use SOAR audit tools Monitor system health Administering SOAR - Course Objectives Splunk Course Schedules and Timezones Ingeniq Course are delivered live and in English and provide access to customers spanning multiple timezones. Dates and times displayed for each course are relative to Australian Eastern Time (AET). AM Marked Splunk Courses AM marked courses start at AET 9:00am and finish at AET 1:30pm and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) PM Marked Splunk Courses PM marked courses usually starts at AEDT 12:00pm or AEST 11:00 am and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) Administering SOAR (Phantom) - Upcoming Courses Administering Splunk SOAR : Starts November 26, 2026, 9:00am AET Regular Price USD 500.00 Sale Price USD 450.00 Administering Splunk SOAR : Starts October 22, 2026, 9:00am AET Price USD 500.00 Administering Splunk SOAR : Starts October 1, 2026, 9:00am AET Course Closed

Creating Maps - Splunk Education Single Subject Course Training. Creating Maps The Splunk Education single-subject course module, Creating Maps is designed for power users who want to create maps in Splunk. It focuses on the data and components required to create cluster and choropleth maps. It also shows how to format, customise and make maps interactive. Splunk Credit Value : 50 Duration : 3 hours Time : 9:00 am - 12:00 pm AEST Please use the currency convertor above to check for course pricing in your local currency. Enquiry Form Let us know what you're after Courses for me Certifications for me Courses for my team Dedicated courses for my teams Training Tracks for my Company Dedicated courses for my Company Training Packs Using Splunk Training Credits Submit Thanks for submitting! The instructor was very responsive to questions and queries both private and Communal.. Final module collaborative lab walkthrough on screen was particularly helpful. Participant, Splunk Fundamentals 2 Creating Maps - Course Topics Cluster Maps Choropleth Maps Customizing Maps Class Format Instructor-led lecture with labs. Delivered via virtual classroom or at your site Course Prerequisites To be successful, students should have completed these courses: Introduction to Splunk Introduction to Dashboards Dynamic Dashboards Creating Maps - Audience Search Experts and Knowledge Managers Creating Maps - Course Objectives Topic 1 – Cluster Maps Define cluster map requirements Use the iplocation and geostats commands Create a cluster map Topic 2 – Choropleth Map Define choropleth map requirements Use the geom command Create a choropleth map Topic 3 – Customising Maps Customize marker colors Create drilldowns Use tokens Splunk Course Schedules and Timezones Splunk Course are delivered live and in English and provide access to customers spanning multiple timezones. Dates and times displayed for each course are relative to Australian Eastern Time (AET). AM Marked Splunk Courses AM marked courses start at AET 9:00am and finish at AET 1:30pm and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) PM Marked Splunk Courses PM marked courses usually starts at AEDT 12:00pm or AEST 11:00 am and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) Creating Maps - Upcoming Schedule We don’t have any products to show here right now.

uberAgent Fundamentals Training delivered by INGENIQ uberAgent Fundamentals Training The uberAgent Fundamentals training is a four-hour course designed for a technical audience involved in providing support for or managing remote end-user connectivity and productivity within a business supported Work From Home environment. Major topics include how to install and deploy uberAgent to your Windows endpoints, user experience data collection and interpretation, application and network data collection and interpretation and data storage within Splunk. uberAgent is a Splunk agent for end-user experience monitoring of Windows endpoints and across all virtual environments including SBC, VDI and RDS. uberAgent has its own metrics, covering key aspects of user experience and application performance that provide comprehensive information about physical PCs, virtual desktops, Citrix XenApp/XenDesktop or VMware Horizon View without affecting your systems’ user density. The instructor very knowledgeable and was able to provide useful examples during the course.. Participant, Splunk Enterprise System Administration uberAgent Fundamentals Training - Course Topics uberAgent Use Cases Architecture Installation Configuration Customisation Troubleshooting Class Format Instructor led virtual training delivered via GoToWebinar Portal. Course Prerequisites Splunk General Knowledge uberAgent Fundamentals Training - Audience This course is designed for a technical audience involved in the deployment or management of Splunk and/or uberAgent. Anyone involved in managing remote end-user connectivity and productivity. After completing uberAgent Fundamentals Training course you will be able to Understand uberAgent fundamentals within a business WFH environment Install and deploy uberAgent Manage custom metrics Apply common use cases Create custom use cases This course is designed to provide a comprehensive overview of uberAgent within the context of a supported business Work From Home environment and includes common uses cases, installation and configuration. Module 1 - Overview Why uberAgent? Why Splunk? Licensing Module 2 - Use case Dashboards Splunk Data Models Identifying Remote Connections Troubleshooting Network Issues Capacity Planning and Sizing Helpdesk Insights Additional uberAgent Use cases Module 3 - Architecture Overview Basic Data Collection Browser Performance Data Collecting Citrix Data Encryption Resources Module 3 - uberAgent Depolyment Installation Configuration Optimisation Logging Use cases Track application and Citrix performance Check Logon times and duration Monitor employee login times Application reliability and usage (license and application counts) Browser performance per website response times per business critical app Analysing VPN usage Troubleshooting VPN connectivity Identifying network latency and bandwidth issues uberAgent Fundamentals Training - Course Objectives uberAgent Fundamentals Training - Upcoming Courses We don’t have any products to show here right now.

Using Splunk IT Service Intelligence Training delivered by INGENIQ Using Splunk IT Service Intelligence The Using Splunk IT Service Intelligence course prepares analyst users who want to use Splunk IT Service Intelligence to manage, analyze, and optimize their IT services. The content of this course is included in the 4 day Implementing Splunk IT Service Intelligence Course. Splunk Credit Value : 50 Duration : 4.5 hours over 1 day Time : 9:00 am – 1:30 pm AEST (GMT +10) *Course discounts apply for Splunk Partners. Please use the currency convertor above to check for course pricing in your local currency. Enquiry Form Let us know what you're after Courses for me Certifications for me Courses for my team Dedicated courses for my teams Training Tracks for my Company Dedicated courses for my Company Training Packs Using Splunk Training Credits Submit Thanks for submitting! Great attitude to the students, encourage questions. always attempt his best to answer them. there is a lot of material but he strive through it. willingness to go beyond to do his job, well done. Participant, Cluster Administration Using Splunk IT Service Intelligence - Course Topics ITSI features and User Interface Creating Glass Tables Managing Notable Events Investigating with Deep Dives Course Prerequisites To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge: Intro to Splunk Optionally: Using Fields Visualizations Working with Time Introduction to Dashboards Related Certifications None Using Splunk IT Service Intelligence - Audience Anyone who wants to use Splunk IT Service Intelligence to manage, analyze, and optimize their IT services. Those who will implement Splunk IT Service Intelligence, please enroll in Implementing Splunk IT Service Intelligence instead. Class Format Instructor-led lecture with labs. Delivered via virtual classroom or at your site After completing Using Splunk IT Service Intelligence course you will be able to Using Splunk IT Service Intelligence - Course Objectives Module 1 - Introducing ITSI Identify what ITSI does Describe reasons for using ITSI Examine the ITSI user interface Module 2 - Glass Tables Describe glass tables Use glass tables Design glass tables Configure glass tables Module 3 - Managing Notable Events Define key notable events terms and their relationships Describe examples of multi – KPI Alerts Describe the notable events workflow Work with notable events Module 4 - Investigating Issues with Deep Dives Describe deep dive concepts and their relationships Use default deep dives Create and customize new custom deep dives Add and configure swim lanes Custom views Describe effective workflows for troubleshooting Splunk Course Schedules and Timezones Ingeniq Course are delivered live and in English and provide access to customers spanning multiple timezones. Dates and times displayed for each course are relative to Australian Eastern Time (AET). AM Marked Splunk Courses AM marked courses start at AET 9:00am and finish at AET 1:30pm and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) PM Marked Splunk Courses PM marked courses usually starts at AEDT 12:00pm or AEST 11:00 am and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) Using Splunk IT Service Intelligence - Upcoming Courses We don’t have any products to show here right now.

Splunk Enterprise Cluster Administration Training delivered by INGENIQ Splunk Enterprise Cluster Administration The Splunk Enterprise Cluster Administration course is for an experienced Splunk Enterprise administrator who is new to Splunk Clusters. The course provides the fundamental knowledge of deploying and managing Splunk Enterprise in a clustered environment. The Splunk Enterprise Cluster Administration course covers installation, configuration, management and monitoring of Splunk clusters. While Splunk Clusters are supported in Windows environments, the class lab environment is running on Linux instances only. Splunk Credit Value : 150 Duration : 13.5 hours over 3 days Time : 9:00 am - 1:30 pm AEST *Course discounts apply for Splunk Partners. Please use the currency convertor above to check for course pricing in your local currency. Enquiry Form Let us know what you're after Courses for me Certifications for me Courses for my team Dedicated courses for my teams Training Tracks for my Company Dedicated courses for my Company Training Packs Using Splunk Training Credits Submit Thanks for submitting! This course was very interactive . Logging into Splunk and showing how to do it, giving examples and showing the ins and outs of ES actually makes a huge difference. Well done to the instructor. Participant, Using Splunk Enterprise Security Splunk Enterprise Cluster Administration - Course Topics Large-scale Splunk Deployment Overview Single-site (high-availability) Indexer Cluster Multisite (disaster-recovery) Indexer Cluster Indexer Cluster Management and Administration Indexer Discovery Forwarder Configuration Search Head Cluster Search Head Cluster Management and Administration KV Store Collection and Lookup Management Course Prerequisites To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge: Intro to Splunk Using Fields Introduction to Knowledge Objects Creating Knowledge Objects Creating Field Extractions Splunk Enterprise System Administration Splunk Enterprise Data Administration Troubleshooting Splunk Enterprise Additional courses and/or knowledge in these areas are also highly recommended: Enriching Data with Lookups Data Models Splunk Enterprise Cluster Administration - Audience Anyone involved in the design, deployment and administration of Splunk within organisations. Previous attendees have included Consultants, IT Administrators, Pre-Sales Engineers and Solution Architects. Class Format Instructor-led lecture with labs. Delivered via virtual classroom or at your site Related Certifications Splunk Enterprise Certified Architect After completing Splunk Enterprise Cluster Administration course you will be able to Configure Splunk for High Availability and Disaster Recovery Set up search head clustering Configure and manage clusters Identify troubles within a clustered environment Add and remove cluster nodes Module 1 – Large-scale Splunk Deployment Overview Factors that affecting deployment design Splunk cluster overview License Master Module 2 – Single-site Indexer Cluster Splunk single-site indexer cluster configuration Optional single-site indexer cluster configurations Module 3 – Multisite Indexer Cluster Splunk multi-site indexer cluster overview Multi-site indexer cluster configuration Optional multi-site indexer cluster configurations Cluster migration and upgrade considerations Module 4 – Indexer Cluster Management and Administration Indexer cluster storage utilization options Peer offline and decommission Master app bundles Monitoring Console for indexer cluster environment Module 5 – Forwarder Management Indexer discovery Optional indexer discovery configurations Module 6 – Search Head Cluster Splunk search head cluster overview Search head cluster configuration Module 7 – Search Head Cluster Management and Administration Search head cluster deployer Captaincy transfer Search head member addition and decommissioning Monitoring Console for Search Head Cluster Module 8 – KV Store Collection and Lookup Management KV Store collection in Splunk clusters KV Store monitoring with Monitoring Console Splunk Enterprise Cluster Administration - Course Objectives Splunk Course Schedules and Timezones Ingeniq Course are delivered live and in English and provide access to customers spanning multiple timezones. Dates and times displayed for each course are relative to Australian Eastern Time (AET). AM Marked Splunk Courses AM marked courses start at AET 9:00am and finish at AET 1:30pm and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) PM Marked Splunk Courses PM marked courses usually starts at AEDT 12:00pm or AEST 11:00 am and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) Splunk Enterprise Cluster Administration - Upcoming Courses Splunk Enterprise Cluster Administration: Starts November 23 to 25, 2026 Price USD 1,500.00 Splunk Enterprise Cluster Administration: Starts October 26 to 28, 2026 Price USD 1,500.00 Splunk Enterprise Cluster Administration: Starts September 21 to 23, 2026 Course Closed

Splunk Education Single Subject Course Training. Ingeniq is the Authorised Splunk Training Provider for Australia and New Zealand and is certified to deliver the complete range of Splunk courses and offer both Instructor led public and dedicated virtual and face-to-face courses. Splunk Education - Single Subject Courses Splunk single-subject courses are available for registration. Splunk Education single-subject Instructor led courses are smaller portions of Splunk training courses and take approx. 3 hours. These will help you ramp your Splunk Learning quickly and efficiently and they are available as live Instructor-Led Training (ILT) or self-paced eLearning. Splunk Education single-subject training courses contribute to Splunk certifications. If you have started your Splunk training journey with the multi-subject courses and would like help defining the next steps our Education Consultants can help - call us or email at sales@ingeniq.com.au and we'll be in touch. Call us on 1300 245 802 To see the Single-subject to Multi-subject course mapping relationship, please refer to the Mapping column on the far right. Course Name Price Buy Now Learning Path Course Mapping What is Splunk? Free video eLearning Free eLearning Knowledge Manager , Search Expert Splunk Fundamentals 1 Intro to Splunk Free video eLearning Free eLearning Knowledge Manager , Search Expert Splunk Fundamentals 1 Scheduling Reports and Alerts Free video eLearning $500 or 1 credit Free eLearning , eLearning with Labs Search Expert Splunk Fundamentals 1 Using Fields $500 or 1 credit View Schedule Knowledge Manager , Search Expert Splunk Fundamentals 1 , Splunk Fundamentals 3 Visualisations Free video eLearning $500 or 1 credit Free eLearning , eLearning with Labs Search Expert Splunk Fundamentals 1 , Splunk Fundamentals 2 Working with Time $500 or 1 credit View Schedule Search Expert Splunk Fundamentals 2 , Splunk Fundamentals 3 , Advanced Searching and Reporting Statistical Processing $500 or 1 credit View Schedule Search Expert Splunk Fundamentals 2 Comparing Values $500 or 1 credit View Schedule Search Expert Splunk Fundamentals 3 Result Modification $500 or 1 credit View Schedule Search Expert Splunk Fundamentals 3 , Advanced Searching & Reporting Leveraging Lookups and Subsearches $500 or 1 credit View Schedule Search Expert Splunk Fundamentals 3 , Advanced Searching & Reporting Correlation Analysis $500 or 1 credit View Schedule Search Expert Splunk Fundamentals 2 , Advanced Searching & Reporting Search Under the Hood Free video eLearning $500 or 1 credit Free eLearning , eLearning with Labs Search Expert Splunk Fundamentals 2 , Splunk Fundamentals 3 , Advanced Searching & Reporting Multivalue Fields $500 or 1 credit View Schedule Search Expert Splunk Fundamentals 3 , Advanced Searching & Reporting Introduction to Knowledge Objects Free video eLearning Free eLearning Knowledge Manager Splunk Fundamentals 2 Creating Knowledge Objects $500 or 1 credit View Schedule Knowledge Manager Splunk Fundamentals 2 Creating Field Extractions $500 or 1 credit View Schedule Knowledge Manager Splunk Fundamentals 2 , Splunk Fundamentals 3 Enriching Data with Lookups $500 or 1 credit View Schedule Knowledge Manager Splunk Fundamentals 3 Data Models $500 or 1 credit View Schedule Knowledge Manager Splunk Fundamentals 2 , Splunk Fundamentals 3 Introduction to Dashboards $500 or 1 credit View Schedule Knowledge Manager Creating Dashboards Dynamic Dashboards $500 or 1 credit View Schedule Knowledge Manager Creating Dashboards Creating Maps $500 or 1 credit View Schedule Knowledge Manager Creating Dashboards Search Optimisation $500 or 1 credit View Schedule Knowledge Expert, Search Expert Splunk Fundamentals 3 Click on Read more to learn more about each Single Subject Course Training module and the course objectives. What is Splunk? This Splunk training course introduces students to what machine data is and how Splunk can leverage operational intelligence to investigate and respond to incidents in their organizations. Visit Splunk Website Intro to Splunk This Splunk training course teaches students how to use Splunk to create reports and dashboards and explore events using Splunk's Search Processing Language. Students will learn the basics of Splunk's architecture, user roles, and how to navigate the Splunk Web interface to create robust searches, reports, visualizations, and dashboards Visit Splunk Website Using Fields This Splunk training course is for power users who want to learn about fields and how to use fields in searches. Topics will focus on explaining the role of fields in searches, field discovery, using fields in searches, and the difference between persistent and temporary fields. The last topic will introduce how fields from other data sources can be used to enrich search results. Read More Intro to Knowledge Objects This Splunk training course teaches students about how different types of knowledge objects to extract additional insights from their data. Students will learn the basics of how to create knowledge objects, define their settings, edit, and manage existing knowledge objects. Visit Splunk Website Creating Knowledge Objects This Splunk training course is for knowledge managers who want to learn how to create knowledge objects for their search environment using the Splunk web interface. Topics will cover types of knowledge objects, the search-time operation sequence, and the processes for creating event types, workflow actions, tags, aliases, search macros, and calculated fields. Read More Creating Field Extractions This Splunk training course is for knowledge managers who want to learn about field extraction and the Field Extractor (FX) utility. Topics will cover when certain fields are extracted and how to use the FX to create regex and delimited field extractions. Read More Enriching Data with Lookups This Splunk training course is for knowledge managers who want to use lookups to enrich their search environment. Topics will introduce lookup types and cover how to upload and define lookups, create automatic lookups, and use advanced lookup options. Additionally, students will learn how to verify lookup contents in search and review lookup best practices. Read More Data Models This Splunk training course is for knowledge managers who want to learn how to create and accelerate data models. Topics will cover datasets, designing data models, using the Pivot editor, and accelerating data models. Read More Introduction to Dashboards This Splunk training course is designed for power users who want to learn best practices for building dashboards in the Dashboard Studio. It focuses on dashboard creation, including prototyping, the dashboard definition, layout types, adding visualizations, and dynamic coloring. Read More Dynamic Dashboards This Splunk training course module is designed for power users who want to learn best practices for building dashboards in the Dashboard Studio. It focuses on creating inputs, chain searches, event annotations, and improving dashboard performance. Read More Creating Maps This Splunk training Course helps you understand more about Choropleth maps. These maps have specific data and component requirements. A search uses the data and components to generate a choropleth map. Read More Scheduling Reports and Alerts This Splunk training course teaches students how to use scheduled reports and alerts to automate processes in their organization. Students will create, manage, and schedule reports and alerts, and use alert actions to further respond to incidents as they occur. Visit Splunk Website Visualisations This Splunk training course teaches students how to use scheduled reports and alerts to automate processes in their organization. Students will create, manage, and schedule reports and alerts, and use alert actions to further respond to incidents as they occur. Visit Splunk Website Working with Time This Splunk training course is for power users who want to become experts at using time in searches. Topics will focus on searching and formatting time in addition to using time commands and working with time zones. Read More Statistical Processing This Splunk training course is for power users who want to identify and use transforming commands and eval functions to calculate statistics on their data. Topics will cover data series types, primary transforming commands, mathematical and statistical eval functions, using eval as a function, and the rename and sort commands. Read More Comparing Values This Splunk training course is for power users who want to learn how to compare field values using eval functions and eval expressions. Topics will focus on using the comparison and conditional functions of the eval command, and using eval expressions with the field format and where commands. Read More Result Modification This Splunk training course is for power users who want to use commands to manipulate output and normalize data. Topics will focus on specific commands for manipulating fields and field values, modifying result sets, and managing missing data. Additionally, students will learn how to use specific eval command functions to normalize fields and field values across multiple data sources. Read More Leveraging Lookups and Subsearches This Splunk training course is designed for power users who want to learn how to use lookups and sub searches to enrich their results. Topics will focus on lookup commands and explore how to use sub searches to correlate and filter data from multiple sources. Read More Correlation Analysis This Splunk training course is for power users who want to learn how to calculate co-occurrence between fields and analyze data from multiple datasets. Topics will focus on the transaction, append, appendcols, union, and join commands. Read More Search Under the Hood This Splunk training course gives students additional insight into how Splunk processes searches. Students will learn about Splunk architecture, how components of a search are broken down and distributed across the pipeline, and how to troubleshoot searches when results are not returning as expected. Visit Splunk Website Multivalue Fields This Splunk training course is for power users who want to become experts on searching and manipulating multivalue data. Topics will focus on using multivalue eval functions and multivalue commands to create, evaluate, and analyze multivalue data. Read More Search Optimisation This Splunk training course is for power users who want to improve search performance. Topics will cover how search modes affect performance, how to create an efficient basic search, how to accelerate reports and data models, and how to use the tstats command to quickly query data. Read More One of the best trainers I've had - keeps content relevant & explains the tasks in easily understood language. Extremely knowledgeable in all fields relating to the content. Well paced & accommodated to everyone's questions & progress. Participant, Splunk Enterprise Data Administration

Splunk Pick n Mix | Splunk Training Pack delivered by INGENIQ Splunk Pick'n Mix Splunk Training Pack#7 Splunk Pick'n Mix Learn more, for less.. Ingeniq Splunk Training Packs are a collections of courses that when purchased together qualify for discounts of up to 25%. Splunk Training Packs apply to all Training Tracks and Certifications – in fact to any combination of courses purchased together from Ingeniq. Pick any combination of courses and add to your training pack purchase and they’ll qualify for up to 25% discounts. Call our Training Consultants now on 1300 245 802 or email sales@ingeniq.com.au to have this training pack tailored to you or your team' s requirements. Splunk Training Pack Courses Splunk Fundamentals 1 This self-paced e-learning teaches you how to search and navigate in Splunk, use fields, get statistics from your data, create reports, dashboards, lookups, and alerts. It will also introduce you to Splunk’s datasets features and Pivot interface. This class is provided as free e-learning, to register click on this link to be directed to the Splunk training website: https://www.splunk.com/view/education/SP-CAAAAH9 Splunk Fundamentals 2 This course focuses on searching and reporting commands as well as on the creation of knowledge objects. Major topics include using transforming commands and visualizations, filtering and formatting results, correlating events, creating knowledge objects, using field aliases and calculated fields, creating tags and event types, using macros, creating workflow actions and data models, and normalising data with the Common Interface Model (CIM). Splunk Fundamentals 3 This course runs over 4 days and focuses on additional search commands as well as advanced use of knowledge objects. Major topics include advanced statistics and eval commands, advanced lookup topics, advanced alert actions, using regex and erex to extract fields, using spath to work with self-referencing data, creating nested macros and macros with event types, accelerating reports and data models. Administering Enterprise Security This 13.5 hour course prepares architects and systems administrators to install, configure and manage Splunk Enterprise Security. It covers ES event processing and normalization, deployment requirements, technology add-ons, settings, risk analysis settings, threat intelligence and protocol intelligence configuration, and customisations. Advanced Searching & Reporting This 13.5 hour Splunk course focuses on more advanced search and reporting commands. Scenario-based examples and hands-on challenges enable users to create robust searches, reports, and charts. Students are coached step by step through complex searches to produce final results. Splunk Enterprise System Administration This virtual 9 hour course is designed for system administrators who are responsible for managing the Splunk Enterprise environment. The course provides fundamental knowledge of Splunk license manager, indexers and search heads. It covers configuration, management and monitoring core Splunk Enterprise components. Splunk Enterprise Data Administration This virtual 9 hour course is designed for system administrators who are responsible for managing the Splunk Enterprise environment. The course provides fundamental knowledge of Splunk license manager, indexers and search heads. It covers configuration, management and monitoring core Splunk Enterprise components. Architecting Enterprise Deployments This 9 hour Splunk course focuses on large enterprise deployments. Students will learn steps and best practices for planning, data collection and sizing for a distributed deployment. Workshop-style labs challenge students to make design decisions about an example enterprise deployment. Troubleshooting Splunk This 2 day course is designed for Splunk administrators. It covers topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available on Splunk Enterprise. Cluster Administration This 3 day course is for an experienced Splunk Enterprise administrator who is new to Splunk Clusters. The course provides the fundamental knowledge of deploying and managing Splunk Enterprise in a clustered environment. It covers installation, configuration, management and monitoring of Splunk clusters. Using Enterprise Security This 3 virtual day course (13.5 hours) prepares security practitioners to track security incidents, analyse security risks, use predictive analytics, and threat discovery. It covers the use of Enterprise Security’s dashboards, forms and workflow to identify, find root cause and resolve security issues. This 4 day virtual course prepares consultants to install and configure Splunk’s app for IT Service Intelligence (ITSI). Students will learn to use ITSI to monitor mission-critical services. Topics include ITSI architecture, deployment planning, installation, service design and implementation, configuring entities, notable events, and developing glass tables and deep dives. Implementing IT Service Intelligence Splunk Certifications Exam When you’re ready to take a Splunk Certification exam, please view the Exam-Registration-Tutorial for registration assistance. As a reminder, each exam attempt costs US$125. Bulk registration vouchers can be purchased at a discounted price of five registrations for US$500. How to register for your exam There are three ways to purchase a PearsonVUE registration voucher: 1) Directly from PearsonVUE This is the most streamlined approach. Follow the steps for account creation and exam registration provided at www.pearsonvue.com/splunk Payment will be collected at the time of registration. You can also visit the Pearson VUE voucher store for direct purchase. 2) From Splunk (as an individual) Log into your existing account at Splunk.com/Education to purchase a registration code. Payment can be made via credit card or existing Splunk Education credits. Splunk will email you a unique registration code, which can be used for registration at www.pearsonvue.com/splunk . 3) From Splunk (as an account) Your Splunk Sales Rep can add certification exams to any deal. Once the number of vouchers has been requested, Splunk will email your unique registration codes, which can be used for registration at www.pearsonvue.com/splunk All scheduled exams are subject to a minimum 24-hour cancellation and/or rescheduling policy. Failure to cancel or reschedule an exam within this timeframe results in forfeiture of registration fee. One of the best trainers I've had - keeps content relevant & explains the tasks in easily understood language. Extremely knowledgeable in all fields relating to the content. Well paced & accommodated to everyone's questions & progress. Participant, Splunk Enterprise Data Administration

Architecting Splunk Enterprise Deployments Training delivered by INGENIQ Architecting Splunk Enterprise Deployments The Architecting Splunk Enterprise Deployments course focuses on large enterprise deployments. Students will learn steps and best practices for planning, data collection and sizing for a distributed deployment. Workshop-style labs challenge students to make design decisions about an example enterprise deployments. Splunk Credit Value : 150 Duration : 9 hours over 2 days Time : 9:00 am - 1:30 pm AEST *Course discounts apply for Splunk Partners. Please use the currency convertor above to check for course pricing in your local currency. Enquiry Form Let us know what you're after Courses for me Certifications for me Courses for my team Dedicated courses for my teams Training Tracks for my Company Dedicated courses for my Company Training Packs Using Splunk Training Credits Submit Thanks for submitting! Instructor is good in his domain, knows what he is talking about, are very experienced as well. he is also willing to share his personal work that he gathers over the years with us. Great attitude. Participant, Troubleshooting Splunk Architecting Splunk Enterprise Deployments - Course Topics Requirements definition Index and infrastructure planning Data collection Forwarders and managing deployments Data comprehension Search considerations Development tools and external integration concepts Operations and management Course Prerequisites To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge: Intro to Splunk Using Fields Introduction to Knowledge Objects Creating Knowledge Objects Creating Field Extractions Splunk Enterprise System Administration Splunk Enterprise Data Administration Troubleshooting Splunk Enterprise Additional courses and/or knowledge in these areas are also highly recommended: Enriching Data with Lookups Data Models Splunk Enterprise Cluster Administration Architecting Splunk Enterprise Deployments - Audience Anyone involved in the design and deployment of Splunk within their organisation or are looking to become Splunk certified. Previous attendees have included Consultants, IT Administrators, Pre-Sales Engineers and Solution Architects. Class Format Instructor-led lecture with labs. Delivered via virtual classroom or at your site Related Certifications Splunk Enterprise Certified Architect After completing Architecting Splunk Enterprise Deployments course you will be able to Understand high availability concepts Know how to estimate storage requirements Compare remote collection methods Understand search performance Identify onboarding processes Utilise monitoring tools Architecting Splunk Enterprise Deployments - Course Objectives Module 1 – Introduction Overview of the Splunk deployment planning process and associated tools Module 2 – Planning Identify critical information about environment, volume, users, and requirements Review checklists and resources to aid in collecting requirements Module 3 – Apps and Index Design Design and size indexes Plan app deployment Module 4 – Infrastructure Learn sizing factors for servers Understand how reference hardware is used to scale deployments Identify the impact of clustering for index replication and for search heads Identify best practices for authentication, authorization and access control Module 5- Data Collection Compare agent-based and agentless data collection methods Discuss data inputs Compare remote collection methods Module 6 – Forwarders and Deployment Management Review types of forwarders Understand how to manage forwarder installation Understand configuration management for all Splunk components, using Splunk deployment tools Module 7 – Data Comprehension and Enrichment Identify the six things you must get correct at index time Discuss Common Information Model Discuss Data Models and data model design Discuss data enrichment, including lookups and KV Store Module 8 – Querying Discuss search performance Discuss differences between summarization methods Module 9 – Integration Describe integration methods Identify common integration points Module 10 – Operations and Management Identify ongoing tasks in a Splunk deployment Identify backup and archiving methods Discuss onboarding processes Review monitoring tools and apps Splunk Course Schedules and Timezones Ingeniq Course are delivered live and in English and provide access to customers spanning multiple timezones. Dates and times displayed for each course are relative to Australian Eastern Time (AET). AM Marked Splunk Courses AM marked courses start at AET 9:00am and finish at AET 1:30pm and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) PM Marked Splunk Courses PM marked courses usually starts at AEDT 12:00pm or AEST 11:00 am and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) Architecting Splunk Enterprise Deployments - Upcoming Courses Architecting Splunk Enterprise Deployments : November 30 to December 30, 2026 Price USD 1,500.00 Architecting Splunk Enterprise Deployments : Starts October 29 and 30, 2026 Price USD 1,500.00 Architecting Splunk Enterprise Deployments : Starts September 24 and 25, 2026 Course Closed

Splunk Consultant | Splunk Training Pack delivered by INGENIQ Splunk Consultant Splunk Training Pack#4 Splunk Consultant Learn more, for less.. Ingeniq Splunk Training Packs are a collections of courses that when purchased together qualify for discounts of up to 25%. Splunk Training Packs apply to all Training Tracks and Certifications – in fact to any combination of courses purchased together from Ingeniq. Buy Splunk Training Pack#4 and you’ll sit all the courses you need to be certified as a Splunk Consultant. A Splunk Core Certified Consultant has a thorough understanding of Splunk Deployment Methodology and implementation in large Splunk installations and has expert-level knowledge of multi-tier Splunk architectures, clustering, and scalability topics. Call our Training Consultants now on 1300 245 802 or email sales@ingeniq.com.au to have this training pack tailored to you or your team' s requirements. Splunk Training Pack Courses Architecting Splunk Enterprise Deployments This 9 hour Splunk course focuses on large enterprise deployments. Students will learn steps and best practices for planning, data collection and sizing for a distributed deployment. Workshop-style labs challenge students to make design decisions about an example enterprise deployment. Troubleshooting Splunk Enterprise This 2 day course is designed for Splunk administrators. It covers topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available on Splunk Enterprise. Splunk Enterprise Cluster Administration This 3 day course is for an experienced Splunk Enterprise administrator who is new to Splunk Clusters. The course provides the fundamental knowledge of deploying and managing Splunk Enterprise in a clustered environment. It covers installation, configuration, management and monitoring of Splunk clusters. Splunk Fundamentals 3 This course runs over 4 days and focuses on additional search commands as well as advanced use of knowledge objects. Major topics include advanced statistics and eval commands, advanced lookup topics, advanced alert actions, using regex and erex to extract fields, using spath to work with self-referencing data, creating nested macros and macros with event types, accelerating reports and data models. Advanced Searching and Reporting This 13.5 hour Splunk course focuses on more advanced search and reporting commands. Scenario-based examples and hands-on challenges enable users to create robust searches, reports, and charts. Students are coached step by step through complex searches to produce final results. Addon & Save!! Cert exam - Splunk Consultant [USD 125] There are three ways to purchase a PearsonVUE registration voucher: Directly from PearsonVUE From Splunk (as an individual) From Splunk (as an account) Full instructions below. Splunk Fundamentals 2 This course focuses on searching and reporting commands as well as on the creation of knowledge objects. Major topics include using transforming commands and visualizations, filtering and formatting results, correlating events, creating knowledge objects, using field aliases and calculated fields, creating tags and event types, using macros, creating workflow actions and data models, and normalising data with the Common Interface Model (CIM). Splunk Enterprise System Administration This virtual 9 hour course is designed for system administrators who are responsible for managing the Splunk Enterprise environment. The course provides fundamental knowledge of Splunk license manager, indexers and search heads. It covers configuration, management and monitoring core Splunk Enterprise components. Splunk Enterprise Data Administration This virtual 13.5 hour course is designed for system administrators who are responsible for getting data into Splunk Indexers. Splunk Certifications Exam When you’re ready to take a Splunk Certification exam, please view the Exam-Registration-Tutorial for registration assistance. As a reminder, each exam attempt costs US$125. Bulk registration vouchers can be purchased at a discounted price of five registrations for US$500. How to register for your exam There are three ways to purchase a PearsonVUE registration voucher: 1) Directly from PearsonVUE This is the most streamlined approach. Follow the steps for account creation and exam registration provided at www.pearsonvue.com/splunk Payment will be collected at the time of registration. You can also visit the Pearson VUE voucher store for direct purchase. 2) From Splunk (as an individual) Log into your existing account at Splunk.com/Education to purchase a registration code. Payment can be made via credit card or existing Splunk Education credits. Splunk will email you a unique registration code, which can be used for registration at www.pearsonvue.com/splunk . 3) From Splunk (as an account) Your Splunk Sales Rep can add certification exams to any deal. Once the number of vouchers has been requested, Splunk will email your unique registration codes, which can be used for registration at www.pearsonvue.com/splunk All scheduled exams are subject to a minimum 24-hour cancellation and/or rescheduling policy. Failure to cancel or reschedule an exam within this timeframe results in forfeiture of registration fee. One of the best trainers I've had - keeps content relevant & explains the tasks in easily understood language. Extremely knowledgeable in all fields relating to the content. Well paced & accommodated to everyone's questions & progress. Participant, Splunk Enterprise Data Administration

Splunk Fundamentals 2 Training Legacy Course Information delivered by INGENIQ Splunk Fundamentals 2 - Legacy Course Information The Splunk Fundamentals 2 course focuses on searching and reporting commands as well as on the creation of knowledge objects. Major topics include using transforming commands and visualizations, filtering and formatting results, correlating events, creating knowledge objects, using field aliases and calculated fields, creating tags and event types, using macros, creating workflow actions and data models, and normalizing data with the Common Interface Model (CIM). This Fundamentals 2 Splunk Courses have been replaced by shorter Splunk single-subject course modules , this page have been retained to assist customers. To see which courses have replaced Splunk Fundamentals 2 and book the equivalent course click here Single-subject to Multi-subject course mapping. Alternatively contact one of our Training Consultants on 1300 245 802 or email sales@ingeniq.com.au The instructor was very responsive to questions and queries both private and Communal.. Final module collaborative lab walkthrough on screen was particularly helpful. Participant, Splunk Fundamentals 2 Splunk Fundamentals 2 - Course Topics Transforming commands and visualisation Filtering and formatting results Correlating events Knowledge objects Fields(Field aliases, field extractions, calculated fields) Tags and event types Macros Workflow actions Data models Splunk Common Information Model (CIM) Class Format Instructor-led lecture with labs. Delivered via virtual classroom or at your site Course Prerequisites Splunk Fundamentals 1 or the following single subject courses What is Splunk Intro to Splunk Using Fields Scheduling Reports & Alerts Visualisations Intro to Knowledge Objects Related Certifications Splunk Core Certified Power User Splunk Core Certified Advanced Power User Splunk Enterprise Certified Admin Splunk Enterprise Certified Architect Splunk Core Certified Consultant Splunk Fundamentals 2 - Audience Anyone whose role requires them to view or run reports within Splunk. Previous attendees have had various roles within their organisations such as Consultants, IT Operations/Security, Business Intelligence/Business Analysts and Marketing Professionals, Solution Architects and Application Developers. After completing Splunk Fundamentals 2 course you will be able to Create searches using the Splunk Search Processing Language Use many common search commands to create statistics, evaluate data, sort, rename and add totals Create tables and charts using your newfound search commands Customise charts by adding filters to show only certain data, create stacked charts and charts based on time Perform calculations on your event data, use conditional expressions Correlate data using transactions Learn to create valuable knowledge objects which you can reuse time and time again Extract fields at search time with Splunk’s interactive field extractor tool Create macro’s and pass arguments into your search Utilise workflow actions which enable you to launch and interact with external resources Create powerful data models which can be used to run the Pivot tool Add value to your event data using lookups Splunk Fundamentals 2 - Course Objectives Module 1 – Introduction Overview of Buttercup Games Inc. Lab environment Module 2 – Beyond Search Fundamentals Search fundamentals review Case sensitivity Using the job inspector to view search performance Audience Module 3 - Using Transforming Commands for Visualisations Explore data structure requirements Explore visualization types Create and format charts and timecharts Module 4 - Using Mapping and Single Value Commands The iplocation command The geostats command The geom command The addtotals command Module 5 - Filtering and Formatting Results The eval command Using the search and where commands to filter results The filnull command Module 6 – Correlating Events Identify transactions Group events using fields Group events using fields and time Search with transactions Report on transactions Determine when to use transactions vs. stats Module 7 – Introduction to Knowledge Objects Identify naming conventions Review permissions Manage knowledge objects Module 8 – Creating and Managing Fields Perform regex field extractions using the Field Extractor (FX) Perform delimiter field extractions using the FX Module 9 – Creating Field Aliases and Calculated Fields Describe, create, and use field aliases Describe, create and use calculated fields Module 10 – Creating Tags and Event Types Create and use tags Describe event types and their uses Create an event type Module 11 – Creating and Using Macros Describe macros Create and use a basic macro Define arguments and variables for a macro Add and use arguments with a macro Module 12 – Creating and Using Workflow Actions Describe the function of GET, POST, and Search workflow actions Create a GET workflow action Create a POST workflow action Create a Search workflow action Module 13 – Creating Data Models Describe the relationship between data models and pivot Identify data model attributes Create a data model Use a data model in pivot Module 14 – Using the Common Information Model (CIM) Add-On Describe the Splunk CIM List the knowledge objects included with the Splunk CIM Add-On Use the CIM Add-On to normalize data Splunk Course Schedules and Timezones Ingeniq Course are delivered live and in English and provide access to customers spanning multiple timezones. Dates and times displayed for each course are relative to Australian Eastern Time (AET). AM Marked Splunk Courses AM marked courses start at AET 9:00am and finish at AET 1:30pm and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) PM Marked Splunk Courses PM marked courses usually starts at AEDT 12:00pm or AEST 11:00 am and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West)

Advanced Searching and Reporting Training Legacy Course Information delivered by INGENIQ Advanced Searching and Reporting - Legacy Course Information The Advanced Searching and Reporting course focuses on more advanced search and reporting commands. Scenario-based examples and hands-on challenges enable users to create robust searches, reports, and charts. Students are coached step by step through complex searches to produce final results. Major topics include optimizing searches, additional charting commands and functions, formatting and calculating results, correlating events, and using combined searches and sub-searches. This Advanced Searching and Reporting Splunk Courses have been replaced by shorter Splunk single-subject course modules , this page have been retained to assist customers. To see which courses have replaced Advanced Searching and Reporting and book the equivalent course click here Single-subject to Multi-subject course mapping. Alternatively contact one of our Training Consultants on 1300 245 802 or email sales@ingeniq.com.au Extremely proficient at controlling the pace of training. Great explanation of answers & not just reading the content. Very knowledgeable about all content. Looking forward to completing the rest of the of the class. Highly recommended. Participant, Splunk Enterprise Data Administration Advanced Searching and Reporting - Course Topics Using Search Efficiently More Search Tuning Manipulating and Filtering Data Working with Multivalue Fields Using Advanced Transactions Working with Time Combining Searches Using Subsearches Class Format Instructor-led lecture with labs. Delivered via virtual classroom or at your site Course Prerequisites Splunk Fundamentals 1 Splunk Fundamentals 2 Splunk Fundamentals 3 Highly recommend 6 months experience with the Splunk search language Related Certifications Splunk Core Certified Advanced Power User Splunk Core Certified Consultant Advanced Searching and Reporting - Audience Anyone within a technical role who needs to utilise more complex searches or reports or are looking to become Splunk certified. Previous attendees have included Consultants, IT Administrators, Data Scientists, Security and Risk Professionals and Solution Architects. After completing Advanced Searching and Reporting course you will be able to Extend your basic search language knowledge Understand and use sub-searches Create advanced visualisations using extended search language Identify events before or after events Use advanced lookups Understand and be able to use the DB Connect App Advanced Searching and Reporting - Course Objectives Module 1 – Using Search Efficiently Review search architecture Understand how the components of a bucket (.tsidx an djournal.gz files) are used How bloom filters are used to improve search speed Describe the parts of a search string Understand the use of centralized vs. distributable commands Create better searches Module 2 – More Search Tuning Understand how segmenters are used in Splunk Use lispy to reduce the number of events read from disk Module 3 - Manipulating and Filtering Data Divide search results into different groups, based on values in a specified field, using the bin command Regroup fields of search results using untable and xyseries Create a template for performing additional processing on a set of related fields using foreach Module 4 - Working with Multivalue Fields Use multivalue eval functions to analyze and format data Use the makemv command to convert a single value into a multivalue field Use the mvexpand command to create separate events for each value in a multivalue field Module 5 - Using Advanced Transactions Find events logged before or after a particular event occurs Compare complete vs. incomplete transactions Analyze Transactions Module 6 – Working with Time Use time modifiers Search for events using custom time ranges and time windows Display and use using relative dates Use custom time ranges in multiple subsearches Module 7 – Combining Searches Use the append and appendcols commands (and know the differences) Use join and union (and when not to use them) Module 8 – Using Subsearches Use subsearches to provide filtering and other information to the main search Know when NOT to use subsearches Troubleshoot subsearches Module 9– Some Extra Tips Describe the use of regular expressions Provide some guidance on using lookups Provide miscellaneous optimization tips Splunk Course Schedules and Timezones Ingeniq Course are delivered live and in English and provide access to customers spanning multiple timezones. Dates and times displayed for each course are relative to Australian Eastern Time (AET). AM Marked Splunk Courses AM marked courses start at AET 9:00am and finish at AET 1:30pm and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West) PM Marked Splunk Courses PM marked courses usually starts at AEDT 12:00pm or AEST 11:00 am and are optimal for customers in the following countries and areas; UTC+10 including Australia (East Coast) UCT+11/+12 including New Zealand and the Pacific Islands UTC-8 including USA (West Coast), Canada (West Coast) UTC-7 including USA (Mid West)