Troubleshooting Splunk EnterpriseTSESPSplunkSP-TSE9.4<p>To be successful, students must have completed these Splunk Education course(s) or have equivalent working experience:</p>
<ul>
<li>Intro to Splunk</li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-suf"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Using Fields <span class="fl-prod-pcode">(SUF)</span></a></span></li><li>Introduction to Knowledge Objects</li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-cko"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Creating Knowledge Objects <span class="fl-prod-pcode">(CKO)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-cfe"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Creating Field Extractions <span class="fl-prod-pcode">(CFE)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-sesa"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Splunk Enterprise System Administration <span class="fl-prod-pcode">(SESA)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-seda"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Splunk Enterprise Data Administration <span class="fl-prod-pcode">(SEDA)</span></a></span></li></ul><p>Additional courses and/or knowledge in these areas are also highly recommended:</p>
<ul>
<li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-edl"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Enriching Data with Lookups <span class="fl-prod-pcode">(EDL)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/en/course/splunk-sdm"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Data Models <span class="fl-prod-pcode">(SDM)</span></a></span></li></ul><p>Administrators</p><p><strong>Module 1 – Splunk Troubleshooting Methods and Tools</strong></p>
<ul>
<li>Describe the Splunk Troubleshooting Approach</li><li>List Splunk Diagnostic Resources and Tools</li><li>Create and Splunk a Diag</li><li>Use RapidDiag</li></ul><p><strong>Module 2 – Indexing Problems</strong></p>
<ul>
<li>Discover Splunk Deployment Topology and its Server Roles</li><li>Identify Where to Check the Index-Time Pipeline Status</li><li>Use the metrics.log to Clarify the Index-Time Problem</li></ul><p><strong>Module 3 – Input Configuration Problems</strong></p>
<ul>
<li>Data Input Issues</li><li>Troubleshooting Inputs with the Monitoring Console</li></ul><p><strong>Module 4 – Deployment and Forwarder Problems</strong>
</p>
<ul>
<li>Deployment Server Issues</li><li>Forwarding and Receiving Issues</li></ul><p><strong>Module 5 – Search Management Problems</strong>
</p>
<ul>
<li>Troubleshoot Distributed Search Issues</li><li>Identify Job Scheduling Problems</li><li>Learn to Diagnose Crashing Problems</li><li>Describe How to Prioritize Resources for Critical Splunk Processes</li></ul><p><strong>Module 6 – User Search Problems</strong>
</p>
<ul>
<li>Identify the Types of Search Problems</li><li>Isolate and Troubleshoot Search Problems</li></ul>To be successful, students must have completed these Splunk Education course(s) or have equivalent working experience:
- Intro to Splunk
- Using Fields (SUF)
- Introduction to Knowledge Objects
- Creating Knowledge Objects (CKO)
- Creating Field Extractions (CFE)
- Splunk Enterprise System Administration (SESA)
- Splunk Enterprise Data Administration (SEDA)
Additional courses and/or knowledge in these areas are also highly recommended:
- Enriching Data with Lookups (EDL)
- Data Models (SDM)AdministratorsModule 1 – Splunk Troubleshooting Methods and Tools
- Describe the Splunk Troubleshooting Approach
- List Splunk Diagnostic Resources and Tools
- Create and Splunk a Diag
- Use RapidDiag
Module 2 – Indexing Problems
- Discover Splunk Deployment Topology and its Server Roles
- Identify Where to Check the Index-Time Pipeline Status
- Use the metrics.log to Clarify the Index-Time Problem
Module 3 – Input Configuration Problems
- Data Input Issues
- Troubleshooting Inputs with the Monitoring Console
Module 4 – Deployment and Forwarder Problems
- Deployment Server Issues
- Forwarding and Receiving Issues
Module 5 – Search Management Problems
- Troubleshoot Distributed Search Issues
- Identify Job Scheduling Problems
- Learn to Diagnose Crashing Problems
- Describe How to Prioritize Resources for Critical Splunk Processes
Module 6 – User Search Problems
- Identify the Types of Search Problems
- Isolate and Troubleshoot Search Problems1 day1000.00835.001000.001000.001000.001000.001380.001100.001000.00100.00100.00100.00100.00100.00100.00100.00100.00100.00