-
Bitte beachten Sie: Das bisherige Training Splunk - Architekt Fast Track wurde vom Kurs Splunk Architect Fast Start abgelöst.
-
This course focuses on large enterprise deployments.
Students will learn:
- steps and best practices for planning, data collection and sizing for a distributed deployment.
- topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available on Splunk Enterprise.
- troubleshooting experience before attending more advanced courses. You will debug a distributed Splunk Enterprise environment using the live system.
- the fundamental knowledge of deploying and managing Splunk Enterprise in a clustered environment. It covers installation, configuration, management, and monitoring of Splunk clusters.
While Splunk Clusters are supported in Windows environments, the class lab environment is running Linux instances only. ONLY for customers with Splunk on-prem.
-
Kursinhalt
-
- Architecting Splunk Enterprise Deployments:
- Introduction
- Project Requirements
- Infrastructure Planning: Index Design
- Infrastructure Planning: Resource Planning
- Clustering Overview
- Forwarder and Deployment Best Practices
- Integration
- Performance Monitoring and Tuning
- Use Cases
- Splunk Troubleshooting Methods and Tools
- Indexing Problems
- Input Configuration Problems
- Input Deployment Problems
- Indexer Cluster Management Administration
- License, Upgrade, and User Management Problems
- Search Management Problems
- KV Store Collection and Lookup Management
- Large-scale Splunk Deployment Overview
- Single-site Indexer Cluster
- Multisite Indexer Cluster
- Indexer Cluster Management and Administration
- Forwarder Management
- Search Head Cluster
- Search Head Cluster Management and Administration
- KV Store Collection and Lookup Management
- SmartStore Implementation
-
Voraussetzungen
-
To be successful, students should have a solid understanding of the following courses:
- Splunk Power User Fast Start
- Splunk Enterprise Administration Fast Start
-
Kursziel
-
Splunk Enterprise Certified Architect (Prereq for this cert is the Splunk Core Certified Power User AND Splunk Enterprise Certified Admin)
Architecting Splunk Enterprise Deployments: |
Module 1 – Introduction |
Overview of the Splunk deployment planning process and associated tools |
Module 2 – Project Requirements |
Identify critical information about environment, volume, users, and requirements |
Review checklists and resources to aid in collecting requirements |
Module 3 – Infrastructure Planning: Index Design |
Design and size indexes |
Estimate storage requirements |
Identify relevant apps |
Module 4 – Infrastructure Planning: Resource Planning |
List sizing factors for servers |
Describe how reference hardware is used to scale deployments |
Identify the impact of clustering for index replication and for search heads |
Module 5 - Clustering Overview |
Describe the different clustering capabilities |
Introduce the concepts of indexer and search head clustering |
Module 6 - Forwarder and Deployment Best Practices |
Review types of forwarders |
Describe how to manage forwarder installation |
Review configuration management for all Splunk components, using Splunk deployment tools |
Provide best practices for a Splunk deployment |
Module 7 - Integration |
Describe integration methods |
Identify common integration points |
Module 8 – Performance Monitoring and Tuning |
Use the Monitoring Console to track test environment performance |
List options to fine tune performance for production environment |
Module 9 – Use Cases |
Provide example architecture topologies |
Discuss different architecture options based on use case |
Troubleshooting Splunk Enterprise : |
Module 1 – Splunk Troubleshooting Methods and Tools |
Describe the Splunk Troubleshooting Approach |
List Splunk Diagnostic Resources and Tools |
Create and Splunk a Diag |
Use RapidDiag |
Module 2 – Indexing Problems |
Discover Splunk deployment Topology and its Server Roles |
Identify Where to Check the Index-Time Pipeline Status |
Use the metrics.log to Clarify the Index-Time Problem |
Module 3 – Input Configuration Problems |
Data Input issues |
Troubleshooting Inputs with the Monitoring Console |
Module 4 – Input Deployment Problems |
Deployment server issues |
Forwarding and Receiving Issues |
Module 5 – Indexer Cluster Management Administration |
Peer Offline and Decommission |
Master App Bundles |
Indexer Cluster Storage Utilization Options |
Site Mapping |
Monitoring Console for Indexer Cluster Environment |
Module 6 – License, Upgrade, and User Management Problems |
Installation Issues |
Upgrade Considerations |
Splunk Licensing Issues |
Splunk Roles and User Management issues |
Module 7 – Search Management Problems |
Troubleshoot Distributed Search Issues |
Identify Job Scheduling Problems |
Learn to Diagnose Crashing Problems |
Describe How to Prioritize Resources for Critical Splunk Processes |
Module 7 – KV Store Collection and Lookup Management |
Identify the Types of Search Problems |
Isolate and Troubleshoot Search Problems |
Splunk Enterprise Cluster Administration : |
Module 1 – Large-scale Splunk Deployment Overview |
Factors that affecting deployment design |
How Splunk Enterprise can scale |
Splunk License Master |
Module 2 – Single-site Indexer Cluster |
How Splunk Single-Site Indexer Clusters Work |
Indexer Cluster Components and Terms |
Splunk Single-Site Indexer Cluster Configuration |
Splunk indexer Cluster Log Channels |
Module 3 – Multisite Indexer Cluster |
How Splunk Multi-site Indexer Clusters Work |
Multi-Site Indexer Cluster Terms |
Multi-Site Indexer Cluster Configurations |
Optional Multi-Site Indexer Cluster Configurations |
Module 4 – Indexer Cluster Management and Administration |
Peer offline and decommission |
Master app bundles |
Indexer Cluster Storage Utilization Options |
Site Mapping |
Monitoring Console for Indexer Cluster Environment |
Module 5 – Forwarder Management |
Indexer discovery |
Optional Indexer Discovery Configurations |
Volume-Based Forwarder Load Balancing |
Module 6 – Search Head Cluster |
Splunk Search Head Cluster Overview |
Search Head Cluster Configuration |
Module 7 – Search Head Cluster Management and Administration |
Search Head Cluster Deployer |
Captaincy Transfer |
Search Head Member Addition and Decommissioning |
Monitoring Console for Search Head Cluster |
Module 8 – KV Store Collection and Lookup Management |
KV Store Collection in Splunk Clusters |
KV Store Monitoring with Monitoring Console |
Module 9 – SmartStore Implementation |
SmartStore Architecture Overview |
Deploy and manage SmartStore |
-
Classroom Training
- Bevorzugen Sie die klassische Trainingsmethode? Ein Kurs in einem unserer Training Center, mit einem kompetenten Trainer und dem direkten Austausch zwischen allen Teilnehmern? Dann buchen Sie einen der Classroom Training Termine!
-
Hybrid Training
- Hybrid Training bedeutet, dass zusätzliche Online-Teilnehmer an einem Präsenzkurs teilnehmen können. Die Dynamik eines realen Kurses bleibt erhalten, wovon besonders auch die Online-Teilnehmer profitieren. Als Online-Teilnehmer eines Hybrid-Kurses nutzen Sie eine Collaboration-Plattform wie WebEx Training Center oder Saba Meeting. Dazu wird nur ein PC mit Browser und Internet-Anschluss benötigt, ein Headset und idealerweise eine Webcam. Im Kursraum setzen wir speziell entwickelte und angepasste hochwertige Audio- und Videotechnik ein. Sie sorgt dafür, dass die Kommunikation zwischen allen Beteiligten angenehm und störungsfrei funktioniert.
-
Online Training
- Möchten Sie einen Kurs online besuchen? Zu diesem Kursthema bieten wir Ihnen Online-Kurstermine an. Als Teilnehmer benötigen Sie dazu einen PC mit Internet-Anschluss (mindestens 1 Mbit/s), ein Headset, falls Sie per VoIP arbeiten möchten und optional eine Kamera. Weitere Informationen und technische Empfehlungen finden Sie hier.
-
Inhouse-Schulung
-
Benötigen Sie einen maßgeschneiderten Kurs für Ihr Team? Neben unserem Standard-Angebot bieten wir Ihnen an, Kurse speziell nach Ihren Anforderungen zu gestalten. Gerne beraten wir Sie hierzu und erstellen Ihnen ein individuelles Angebot.
Inhouse-Schulung jetzt anfragen >>>
-
Bitte beachten Sie: Das bisherige Training Splunk - Architekt Fast Track wurde vom Kurs Splunk Architect Fast Start abgelöst.
-
This course focuses on large enterprise deployments.
Students will learn:
- steps and best practices for planning, data collection and sizing for a distributed deployment.
- topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available on Splunk Enterprise.
- troubleshooting experience before attending more advanced courses. You will debug a distributed Splunk Enterprise environment using the live system.
- the fundamental knowledge of deploying and managing Splunk Enterprise in a clustered environment. It covers installation, configuration, management, and monitoring of Splunk clusters.
While Splunk Clusters are supported in Windows environments, the class lab environment is running Linux instances only. ONLY for customers with Splunk on-prem.
-
Kursinhalt
-
- Architecting Splunk Enterprise Deployments:
- Introduction
- Project Requirements
- Infrastructure Planning: Index Design
- Infrastructure Planning: Resource Planning
- Clustering Overview
- Forwarder and Deployment Best Practices
- Integration
- Performance Monitoring and Tuning
- Use Cases
- Splunk Troubleshooting Methods and Tools
- Indexing Problems
- Input Configuration Problems
- Input Deployment Problems
- Indexer Cluster Management Administration
- License, Upgrade, and User Management Problems
- Search Management Problems
- KV Store Collection and Lookup Management
- Large-scale Splunk Deployment Overview
- Single-site Indexer Cluster
- Multisite Indexer Cluster
- Indexer Cluster Management and Administration
- Forwarder Management
- Search Head Cluster
- Search Head Cluster Management and Administration
- KV Store Collection and Lookup Management
- SmartStore Implementation
-
Voraussetzungen
-
To be successful, students should have a solid understanding of the following courses:
- Splunk Power User Fast Start
- Splunk Enterprise Administration Fast Start
-
Kursziel
-
Splunk Enterprise Certified Architect (Prereq for this cert is the Splunk Core Certified Power User AND Splunk Enterprise Certified Admin)
Architecting Splunk Enterprise Deployments: |
Module 1 – Introduction |
Overview of the Splunk deployment planning process and associated tools |
Module 2 – Project Requirements |
Identify critical information about environment, volume, users, and requirements |
Review checklists and resources to aid in collecting requirements |
Module 3 – Infrastructure Planning: Index Design |
Design and size indexes |
Estimate storage requirements |
Identify relevant apps |
Module 4 – Infrastructure Planning: Resource Planning |
List sizing factors for servers |
Describe how reference hardware is used to scale deployments |
Identify the impact of clustering for index replication and for search heads |
Module 5 - Clustering Overview |
Describe the different clustering capabilities |
Introduce the concepts of indexer and search head clustering |
Module 6 - Forwarder and Deployment Best Practices |
Review types of forwarders |
Describe how to manage forwarder installation |
Review configuration management for all Splunk components, using Splunk deployment tools |
Provide best practices for a Splunk deployment |
Module 7 - Integration |
Describe integration methods |
Identify common integration points |
Module 8 – Performance Monitoring and Tuning |
Use the Monitoring Console to track test environment performance |
List options to fine tune performance for production environment |
Module 9 – Use Cases |
Provide example architecture topologies |
Discuss different architecture options based on use case |
Troubleshooting Splunk Enterprise : |
Module 1 – Splunk Troubleshooting Methods and Tools |
Describe the Splunk Troubleshooting Approach |
List Splunk Diagnostic Resources and Tools |
Create and Splunk a Diag |
Use RapidDiag |
Module 2 – Indexing Problems |
Discover Splunk deployment Topology and its Server Roles |
Identify Where to Check the Index-Time Pipeline Status |
Use the metrics.log to Clarify the Index-Time Problem |
Module 3 – Input Configuration Problems |
Data Input issues |
Troubleshooting Inputs with the Monitoring Console |
Module 4 – Input Deployment Problems |
Deployment server issues |
Forwarding and Receiving Issues |
Module 5 – Indexer Cluster Management Administration |
Peer Offline and Decommission |
Master App Bundles |
Indexer Cluster Storage Utilization Options |
Site Mapping |
Monitoring Console for Indexer Cluster Environment |
Module 6 – License, Upgrade, and User Management Problems |
Installation Issues |
Upgrade Considerations |
Splunk Licensing Issues |
Splunk Roles and User Management issues |
Module 7 – Search Management Problems |
Troubleshoot Distributed Search Issues |
Identify Job Scheduling Problems |
Learn to Diagnose Crashing Problems |
Describe How to Prioritize Resources for Critical Splunk Processes |
Module 7 – KV Store Collection and Lookup Management |
Identify the Types of Search Problems |
Isolate and Troubleshoot Search Problems |
Splunk Enterprise Cluster Administration : |
Module 1 – Large-scale Splunk Deployment Overview |
Factors that affecting deployment design |
How Splunk Enterprise can scale |
Splunk License Master |
Module 2 – Single-site Indexer Cluster |
How Splunk Single-Site Indexer Clusters Work |
Indexer Cluster Components and Terms |
Splunk Single-Site Indexer Cluster Configuration |
Splunk indexer Cluster Log Channels |
Module 3 – Multisite Indexer Cluster |
How Splunk Multi-site Indexer Clusters Work |
Multi-Site Indexer Cluster Terms |
Multi-Site Indexer Cluster Configurations |
Optional Multi-Site Indexer Cluster Configurations |
Module 4 – Indexer Cluster Management and Administration |
Peer offline and decommission |
Master app bundles |
Indexer Cluster Storage Utilization Options |
Site Mapping |
Monitoring Console for Indexer Cluster Environment |
Module 5 – Forwarder Management |
Indexer discovery |
Optional Indexer Discovery Configurations |
Volume-Based Forwarder Load Balancing |
Module 6 – Search Head Cluster |
Splunk Search Head Cluster Overview |
Search Head Cluster Configuration |
Module 7 – Search Head Cluster Management and Administration |
Search Head Cluster Deployer |
Captaincy Transfer |
Search Head Member Addition and Decommissioning |
Monitoring Console for Search Head Cluster |
Module 8 – KV Store Collection and Lookup Management |
KV Store Collection in Splunk Clusters |
KV Store Monitoring with Monitoring Console |
Module 9 – SmartStore Implementation |
SmartStore Architecture Overview |
Deploy and manage SmartStore |
-
Classroom Training
- Bevorzugen Sie die klassische Trainingsmethode? Ein Kurs in einem unserer Training Center, mit einem kompetenten Trainer und dem direkten Austausch zwischen allen Teilnehmern? Dann buchen Sie einen der Classroom Training Termine!
-
Hybrid Training
- Hybrid Training bedeutet, dass zusätzliche Online-Teilnehmer an einem Präsenzkurs teilnehmen können. Die Dynamik eines realen Kurses bleibt erhalten, wovon besonders auch die Online-Teilnehmer profitieren. Als Online-Teilnehmer eines Hybrid-Kurses nutzen Sie eine Collaboration-Plattform wie WebEx Training Center oder Saba Meeting. Dazu wird nur ein PC mit Browser und Internet-Anschluss benötigt, ein Headset und idealerweise eine Webcam. Im Kursraum setzen wir speziell entwickelte und angepasste hochwertige Audio- und Videotechnik ein. Sie sorgt dafür, dass die Kommunikation zwischen allen Beteiligten angenehm und störungsfrei funktioniert.
-
Online Training
- Möchten Sie einen Kurs online besuchen? Zu diesem Kursthema bieten wir Ihnen Online-Kurstermine an. Als Teilnehmer benötigen Sie dazu einen PC mit Internet-Anschluss (mindestens 1 Mbit/s), ein Headset, falls Sie per VoIP arbeiten möchten und optional eine Kamera. Weitere Informationen und technische Empfehlungen finden Sie hier.
-
Inhouse-Schulung
-
Benötigen Sie einen maßgeschneiderten Kurs für Ihr Team? Neben unserem Standard-Angebot bieten wir Ihnen an, Kurse speziell nach Ihren Anforderungen zu gestalten. Gerne beraten wir Sie hierzu und erstellen Ihnen ein individuelles Angebot.
Inhouse-Schulung jetzt anfragen >>>