(SDM)<\/span><\/a><\/span><\/li><\/ul>","audience":"Splunk Cloud Administrators.<\/p>","outline":"
Module 1 – Splunk Cloud Overview<\/strong><\/p>\n\n- Describe Splunk and Splunk Cloud features and topology<\/li>
- Identify Splunk Cloud administrator tasks<\/li>
- Describe Splunk Cloud purchasing options and differences between Classic and Victoria experience<\/li>
- Secure Splunk deployments best practices<\/li>
- Explain Splunk Cloud data ingestion strategies<\/li><\/ul>
Module 2 - Managing Users<\/strong>\n<\/p>\n\n- Identify Splunk Cloud authentication options<\/li>
- Add Splunk users using native authentication<\/li>
- Create a custom role<\/li>
- Integrate Splunk with LDAP, Active Directory or SAML<\/li>
- Use Workload Management to manage user resource usage<\/li>
- Manage users in Splunk<\/li><\/ul>
Module 3 – Managing Indexes<\/strong>\n<\/p>\n\n- Understand cloud indexing strategy<\/li>
- Define and create indexes<\/li>
- Manage data retention and archiving<\/li>
- Delete and mask data from an index<\/li>
- Monitor indexing activities<\/li><\/ul>
Module 4 – Using Configuration Files<\/strong>\n<\/p>\n\n- Describe Splunk configuration directory structure<\/li>
- Describe the configuration layering process with index and search time precedence<\/li>
- Use Splunk tools to examine configuration settings such as btool<\/li><\/ul>
Module 5 – Managing Apps<\/strong>\n<\/p>\n\n- Review the process for installing apps<\/li>
- Define the purpose of private apps<\/li>
- Upload private apps<\/li>
- Describe how apps are managed<\/li><\/ul>
Module 6 – Configuring Forwarders<\/strong>\n<\/p>\n\n- List Splunk forwarder types<\/li>
- Understand the role of forwarders<\/li>
- Configure a forwarder to send data to Splunk Cloud<\/li>
- Test the forwarder connection<\/li>
- Describe optional forwarder settings<\/li><\/ul>
Module 7 – Managing Forwarders<\/strong>\n<\/p>\n\n- Describe Splunk Deployment Server (DS)<\/li>
- Manage forwarders using deployment apps<\/li>
- Configure deployment clients and client groups<\/li>
- Monitor forwarder management activities<\/li><\/ul>
Module 8 – Forwarder Inputs<\/strong>\n<\/p>\n\n- Describe the Splunk process for inputting data<\/li>
- Create file and directory monitor inputs<\/li>
- Use optional settings for monitor inputs<\/li>
- Creating network inputs<\/li><\/ul>
Module 9 – Common Inputs<\/strong>\n<\/p>\n\n- Create REST API inputs<\/li>
- Create a basic scripted input<\/li>
- Identify Linux-specific inputs<\/li>
- Identify Windows-specific inputs<\/li>
- Create Splunk HTTP Event Collector (HEC) agentless inputs<\/li><\/ul>
Module 10 – Additional Inputs<\/strong>\n<\/p>\n\n- Understand how inputs are managed using apps or add-ons<\/li>
- Explore Cloud inputs using Splunk Connect for Syslog, Data Manager, Inputs Data Manager (IDM), Splunk Edge Processor, and Splunk Edge Hub<\/li><\/ul>
Module 11 – Fine-tuning Inputs<\/strong>\n<\/p>\n\n- Describe the default processing that occurs during the input phase<\/li>
- Configure input phase options, such as source type fine-tuning and character set encoding<\/li>
- Reset file check pointers on a forwarder using the btprobe command<\/li><\/ul>
Module 12 – Parsing Phase and Data Preview<\/strong>\n<\/p>\n\n- Describe the default processing that occurs during parsing<\/li>
- Optimize and configure event line breaking<\/li>
- Modify how timestamps and time zones are extracted or assigned to events<\/li>
- Use Data Preview to validate event creation during the parsing phase<\/li><\/ul>
Module 13 – Manipulating Input Data<\/strong>\n<\/p>\n\n- Explore Splunk transformation methods<\/li>
- Mask, filter and route data with SEDCMD and TRANSFORMS<\/li>
- Override sourcetype or host based upon event values<\/li>
- Create and manage rulesets with Ingest Actions<\/li>
- Mask, filter and route data with Ingest Action rules<\/li><\/ul>
Module 14 – Managing Splunk Cloud<\/strong>\n<\/p>\n\n- Secure ingest with Splunk Cloud Private Connectivity with AWS<\/li>
- Describe Federated Search functionality<\/li>
- Describe Splunk connected experience apps such as Splunk Secure Gateway<\/li>
- Monitor and manage resource utilization by business units and users using Splunk App for Chargeback<\/li>
- Perform self-service administrative tasks in Splunk Cloud using the Admin Config Service<\/li><\/ul>
Module 15 – Supporting Splunk Cloud<\/strong>\n<\/p>\n\n- Know how to isolate problems before contacting Splunk Cloud Support<\/li>
- Use Isolation Troubleshooting<\/li>
- Define the process for engaging Splunk Support<\/li><\/ul>
Appendix<\/strong>\n<\/p>\n\n- Explore Splunk security fundamentals<\/li><\/ul>","summary":"
This course is for administrators new to Splunk Cloud and those wanting to become more experienced in managing Splunk Cloud instances.<\/p>\n
The course provides administrators with the opportunity to gain the skills, knowledge and best practices for data management and system configuration for data collection and ingestion required in a Splunk Cloud environment to create a productive Splunk SaaS deployment. The hands-on labs provide the opportunity to learn and ask questions on how to manage and maintain the platform, the users and how to effectively get data into Splunk Cloud. Modules include data inputs and forwarder configuration, data management, user accounts, and basic monitoring and problem isolation.<\/p>\n
Note: Splunk Cloud Administration and Transitioning to Splunk Cloud SHOULD NOT be taken together as both are designed to develop Splunk Cloud-specific skills and as such there is some overlap.<\/p>\n
Please note that this course may run over three days of 6 hour sessions or four days of 4.5 hour sessions.<\/strong><\/p>","essentials_plain":"To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge:\n\n\n- Intro to Splunk\n- Using Fields (SUF)\n- Intro to Knowledge Objects\n- Creating Knowledge Objects (CKO)\n- Creating Field Extractions (CFE)\nAdditional courses and\/or knowledge in these areas are also highly recommended:\n\n\n\n- Enriching Data with Lookups (EDL)\n- Data Models (SDM)","audience_plain":"Splunk Cloud Administrators.","outline_plain":"Module 1 \u2013 Splunk Cloud Overview\n\n\n- Describe Splunk and Splunk Cloud features and topology\n- Identify Splunk Cloud administrator tasks\n- Describe Splunk Cloud purchasing options and differences between Classic and Victoria experience\n- Secure Splunk deployments best practices\n- Explain Splunk Cloud data ingestion strategies\nModule 2 - Managing Users\n\n\n\n- Identify Splunk Cloud authentication options\n- Add Splunk users using native authentication\n- Create a custom role\n- Integrate Splunk with LDAP, Active Directory or SAML\n- Use Workload Management to manage user resource usage\n- Manage users in Splunk\nModule 3 \u2013 Managing Indexes\n\n\n\n- Understand cloud indexing strategy\n- Define and create indexes\n- Manage data retention and archiving\n- Delete and mask data from an index\n- Monitor indexing activities\nModule 4 \u2013 Using Configuration Files\n\n\n\n- Describe Splunk configuration directory structure\n- Describe the configuration layering process with index and search time precedence\n- Use Splunk tools to examine configuration settings such as btool\nModule 5 \u2013 Managing Apps\n\n\n\n- Review the process for installing apps\n- Define the purpose of private apps\n- Upload private apps\n- Describe how apps are managed\nModule 6 \u2013 Configuring Forwarders\n\n\n\n- List Splunk forwarder types\n- Understand the role of forwarders\n- Configure a forwarder to send data to Splunk Cloud\n- Test the forwarder connection\n- Describe optional forwarder settings\nModule 7 \u2013 Managing Forwarders\n\n\n\n- Describe Splunk Deployment Server (DS)\n- Manage forwarders using deployment apps\n- Configure deployment clients and client groups\n- Monitor forwarder management activities\nModule 8 \u2013 Forwarder Inputs\n\n\n\n- Describe the Splunk process for inputting data\n- Create file and directory monitor inputs\n- Use optional settings for monitor inputs\n- Creating network inputs\nModule 9 \u2013 Common Inputs\n\n\n\n- Create REST API inputs\n- Create a basic scripted input\n- Identify Linux-specific inputs\n- Identify Windows-specific inputs\n- Create Splunk HTTP Event Collector (HEC) agentless inputs\nModule 10 \u2013 Additional Inputs\n\n\n\n- Understand how inputs are managed using apps or add-ons\n- Explore Cloud inputs using Splunk Connect for Syslog, Data Manager, Inputs Data Manager (IDM), Splunk Edge Processor, and Splunk Edge Hub\nModule 11 \u2013 Fine-tuning Inputs\n\n\n\n- Describe the default processing that occurs during the input phase\n- Configure input phase options, such as source type fine-tuning and character set encoding\n- Reset file check pointers on a forwarder using the btprobe command\nModule 12 \u2013 Parsing Phase and Data Preview\n\n\n\n- Describe the default processing that occurs during parsing\n- Optimize and configure event line breaking\n- Modify how timestamps and time zones are extracted or assigned to events\n- Use Data Preview to validate event creation during the parsing phase\nModule 13 \u2013 Manipulating Input Data\n\n\n\n- Explore Splunk transformation methods\n- Mask, filter and route data with SEDCMD and TRANSFORMS\n- Override sourcetype or host based upon event values\n- Create and manage rulesets with Ingest Actions\n- Mask, filter and route data with Ingest Action rules\nModule 14 \u2013 Managing Splunk Cloud\n\n\n\n- Secure ingest with Splunk Cloud Private Connectivity with AWS\n- Describe Federated Search functionality\n- Describe Splunk connected experience apps such as Splunk Secure Gateway\n- Monitor and manage resource utilization by business units and users using Splunk App for Chargeback\n- Perform self-service administrative tasks in Splunk Cloud using the Admin Config Service\nModule 15 \u2013 Supporting Splunk Cloud\n\n\n\n- Know how to isolate problems before contacting Splunk Cloud Support\n- Use Isolation Troubleshooting\n- Define the process for engaging Splunk Support\nAppendix\n\n\n\n- Explore Splunk security fundamentals","summary_plain":"This course is for administrators new to Splunk Cloud and those wanting to become more experienced in managing Splunk Cloud instances.\n\nThe course provides administrators with the opportunity to gain the skills, knowledge and best practices for data management and system configuration for data collection and ingestion required in a Splunk Cloud environment to create a productive Splunk SaaS deployment. The hands-on labs provide the opportunity to learn and ask questions on how to manage and maintain the platform, the users and how to effectively get data into Splunk Cloud. Modules include data inputs and forwarder configuration, data management, user accounts, and basic monitoring and problem isolation.\n\nNote: Splunk Cloud Administration and Transitioning to Splunk Cloud SHOULD NOT be taken together as both are designed to develop Splunk Cloud-specific skills and as such there is some overlap.\n\nPlease note that this course may run over three days of 6 hour sessions or four days of 4.5 hour sessions.","skill_level":"Intermediate","version":"9.4","duration":{"unit":"d","value":2.5,"formatted":"2.5 days"},"pricelist":{"List Price":{"US":{"country":"US","currency":"USD","taxrate":null,"price":2000},"GB":{"country":"GB","currency":"GBP","taxrate":20,"price":1670},"PL":{"country":"PL","currency":"USD","taxrate":23,"price":2000},"DE":{"country":"DE","currency":"EUR","taxrate":19,"price":2250},"AT":{"country":"AT","currency":"EUR","taxrate":20,"price":2250},"SE":{"country":"SE","currency":"EUR","taxrate":25,"price":2250},"CA":{"country":"CA","currency":"CAD","taxrate":null,"price":2760},"FR":{"country":"FR","currency":"EUR","taxrate":19.6,"price":2000},"CH":{"country":"CH","currency":"CHF","taxrate":8.1,"price":2500},"NL":{"country":"NL","currency":"EUR","taxrate":21,"price":2250}}},"lastchanged":"2026-01-12T11:20:09+01:00","parenturl":"https:\/\/portal.flane.ch\/swisscom\/en\/json-courses","nexturl_course_schedule":"https:\/\/portal.flane.ch\/swisscom\/en\/json-course-schedule\/25907","source_lang":"en","source":"https:\/\/portal.flane.ch\/swisscom\/en\/json-course\/splunk-sca"}}