Splunk Training Provider Authorised Learning Partner Australia

Splunk Fundamentals 3

The Splunk Fundamentals 3 course runs over 4 days and focuses on additional search commands as well as advanced use of knowledge objects.


Major topics include advanced statistics and eval commands, advanced lookup topics, advanced alert actions, using regex and erex to extract fields, using spath to work with self-referencing data, creating nested macros and macros with event types, and accelerating reports and data models.

Units: 4
Duration: 18 hours over 4 days
Time: 9:00 am – 1:30 pm  AEST (GMT +10)

*Course discounts apply for Splunk Partners. Please use the currency convertor above to check for course pricing in your local currency.

Splunk Fundamentals 3

Excellent Trainer, Have had the same instructor twice now & he is one of the best i have had. Thank you!

Participant, Splunk Fundamentals 3

Splunk Fundamentals 3
Splunk Fundamentals 3 - Course Topics
  • Advanced Statistical Commands

  • Advanced eval Commands

  • Advanced Lookups

  • Alert Actions

  • Advanced Field Creation and Management

  • Working with self-Describing Data and Files

  • Advanced Macros

  • Using Acceleration Options

Class Format

Instructor-led lecture with labs. Delivered via virtual classroom or at your site

Course Prerequisites
Related Certifications
Splunk Fundamentals 3 - Audience

Anyone whose role requires them to create complex search queries, advanced data models and reports with Splunk who have limited exposure to regular expressions. Previous attendees have included Consultants, IT Administrators and Business Intelligence/Business Analysts.

After completing Splunk Fundamentals 3 course you will be able to
  • Learn about and use KV store collections and scripted lookups in search and alerts.

  • Inline extractions best practices using regex

  • Working with structured data sources eg JSON and XML and table formatted events.

  • Learn how and when to use report acceleration and summary indexing

  • Learn how to seriously improve performance using tstats and data model acceleration.

Splunk Fundamentals 3
Splunk Fundamentals 3 - Course Objectives

Module 1: Exploring Statistical Commands

  • Performing statistical analysis with functions of the stat command

  • Using fieldsummary

  • Using appendpipe

  • Using eventstats

  • Using streamstats

Module 2: Exploring eval Command Functions

  • Using conversion functions

  • Using data and time functions

  • Using string functions

  • Using comparison and conditional functions

  • Using informational functions

  • Using statistical functions

  • Using mathematical functions

  • Using cryptographic functions

Module 3:  Exploring Lookups

  • Including and excluding events based on lookup values

  • Using KV Store lookups

  • Using external lookups

  • Using geospatial lookups

  • Using database lookups

  • Understanding best practices for lookups

Module 4: Exploring Alerts

  • Referencing lookups in alerts

  • Outputting alert results to a lookup

  • Logging and indexing searchable alert events

  • Using a webhook alert action

Module 5: Advanced Field Creation and Management

  • Using regex

  • Using the erex command

  • Using the rex command

  • Identifying regex best practices

Module 6: Working with Self-Describing Data and Files

  • Using the spath command

  • Using the eval command with the spath function

  • Extracting fields from table-formatted events with multikv

Module 7:  Advanced Search Macros

  • Using nested search Macros

  • Previewing search macros before executing

  • Using Tags and event types in search macros

Module 8: Using Acceleration Options: Reports and Summary Indexing

  • Using report acceleration

  • Using Summary indexing

Module 9:  Using Acceleration Options: Data Models and tsidx Files

  • Exploring data models using datamodel command

  • Using data model acceleration

  • Working with tsidx files using the tstats command

Splunk Course Schedules and Timezones

Ingeniq Course are delivered live and in English and provide access to customers spanning multiple timezones.

Dates and times displayed for each course are relative to Australian Eastern Time (AET).

AM Marked Splunk Courses

AM marked courses start at AET 9:00am and finish at AET 1:30pm (4.5 hour sessions over 1 or more days) and are optimal for customers in the following countries and areas;

  • UTC+10 including Australia (East Coast)

  • UCT+11/+12 including New Zealand and the Pacific Islands

  • UTC-8 including USA (West Coast), Canada (West Coast)

  • UTC-7 including USA (Mid West)

PM Marked Splunk Courses

PM marked courses start at AET  2:00pm and finish at AET 6:30pm (4.5 hour sessions over 1 or more days) and are optimal for customers in the following countries and areas;

  • UTC+9 including Japan, Korea

  • UTC+8 including Australia (West Coast), Singapore, Hong Kong, China, Philippines, Brunei, Thailand

  • UTC +5/+6 including India and Sri Lanka

Splunk Fundamentals 3 - Upcoming Courses