Splunk Enterprise Cluster AdministrationSCLASPSplunkSP-SCLA9.3<p>To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge:</p>
<ul>
<li>Intro to Splunk</li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-suf"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Using Fields <span class="fl-prod-pcode">(SUF)</span></a></span></li><li>Introduction to Knowledge Objects</li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-cko"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Creating Knowledge Objects <span class="fl-prod-pcode">(CKO)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-cfe"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Creating Field Extractions <span class="fl-prod-pcode">(CFE)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-sesa"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Splunk Enterprise System Administration <span class="fl-prod-pcode">(SESA)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-seda"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Splunk Enterprise Data Administration <span class="fl-prod-pcode">(SEDA)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-tse"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Troubleshooting Splunk Enterprise <span class="fl-prod-pcode">(TSE)</span></a></span></li></ul><p>Additional courses and/or knowledge in these areas are also highly recommended:
</p>
<ul>
<li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-edl"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Enriching Data with Lookups <span class="fl-prod-pcode">(EDL)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-sdm"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Data Models <span class="fl-prod-pcode">(SDM)</span></a></span></li></ul><p>Splunk administrators.</p><p><strong>Module 1 – Overview of Large-scale Splunk Deployment</strong>
</p>
<ul>
<li>Identify factors that affect large-scale deployment design</li><li>Describe approaches to scaling Splunk Enterprise</li><li>Configure Splunk License Manager</li></ul><p><strong>Module 2 – Deploying Single-site Indexer Clusters</strong>
</p>
<ul>
<li>Identify indexer cluster states</li><li>Define replication factor and search factor</li><li>Implement a single-site indexer cluster</li></ul><p><strong>Module 3 – Deploying Multisite Indexer Clusters</strong>
</p>
<ul>
<li>Define site replication factor and site search factor</li><li>Define search affinity</li><li>Implement a multisite indexer cluster</li></ul><p><strong>Module 4 – Updating Indexer Cluster Peer Configurations</strong>
</p>
<ul>
<li>Distribute configurations and apps across peers</li></ul><p><strong>Module 5 - Managing and Monitoring Indexer Clusters</strong>
</p>
<ul>
<li>Enable replication for clustered indexes</li><li>Configure Monitoring Console for indexer cluster environment</li></ul><p><strong>Module 6 – Configuring Indexer Discovery on Forwarders</strong>
</p>
<ul>
<li>Configure indexer discovery</li><li>Configure indexer acknowledgment</li><li>Configure forwarder site failover</li></ul><p><strong>Module 7 – Deploying Search Head Cluster</strong>
</p>
<ul>
<li>Configure a search head cluster</li><li>Connect clustered and non-clustered indexers</li></ul><p><strong>Module 8 – Managing and Monitoring Search Head Clusters</strong>
</p>
<ul>
<li>Deploy configuration bundles to search head cluster members</li><li>Manage captaincy and member addition, removal and upgrades</li></ul><p><strong>Module 9 – Using KV Store in a Search Head Cluster</strong>
</p>
<ul>
<li>Enable KV Store collection replication in a search head cluster</li><li>Monitor KV Store status with Monitoring Console</li></ul>To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge:
- Intro to Splunk
- Using Fields (SUF)
- Introduction to Knowledge Objects
- Creating Knowledge Objects (CKO)
- Creating Field Extractions (CFE)
- Splunk Enterprise System Administration (SESA)
- Splunk Enterprise Data Administration (SEDA)
- Troubleshooting Splunk Enterprise (TSE)
Additional courses and/or knowledge in these areas are also highly recommended:
- Enriching Data with Lookups (EDL)
- Data Models (SDM)Splunk administrators.Module 1 – Overview of Large-scale Splunk Deployment
- Identify factors that affect large-scale deployment design
- Describe approaches to scaling Splunk Enterprise
- Configure Splunk License Manager
Module 2 – Deploying Single-site Indexer Clusters
- Identify indexer cluster states
- Define replication factor and search factor
- Implement a single-site indexer cluster
Module 3 – Deploying Multisite Indexer Clusters
- Define site replication factor and site search factor
- Define search affinity
- Implement a multisite indexer cluster
Module 4 – Updating Indexer Cluster Peer Configurations
- Distribute configurations and apps across peers
Module 5 - Managing and Monitoring Indexer Clusters
- Enable replication for clustered indexes
- Configure Monitoring Console for indexer cluster environment
Module 6 – Configuring Indexer Discovery on Forwarders
- Configure indexer discovery
- Configure indexer acknowledgment
- Configure forwarder site failover
Module 7 – Deploying Search Head Cluster
- Configure a search head cluster
- Connect clustered and non-clustered indexers
Module 8 – Managing and Monitoring Search Head Clusters
- Deploy configuration bundles to search head cluster members
- Manage captaincy and member addition, removal and upgrades
Module 9 – Using KV Store in a Search Head Cluster
- Enable KV Store collection replication in a search head cluster
- Monitor KV Store status with Monitoring Console2 days1500.001250.001500.001500.001500.001500.002070.001650.001500.00150.00150.00150.00150.00150.00150.00150.00150.00150.00