Leveraging Lookups and SubsearchesLLSSPSplunkSP-LLS1.0<p>To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge:
</p>
<ul>
<li>Intro to Splunk</li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/fr/course/splunk-suf"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Using Fields <span class="fl-prod-pcode">(SUF)</span></a></span></li><li>Visualizations</li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/fr/course/splunk-wwt"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Working with Time <span class="fl-prod-pcode">(WWT)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/fr/course/splunk-ssp"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Statistical Processing <span class="fl-prod-pcode">(SSP)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/fr/course/splunk-scv"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Comparing Values <span class="fl-prod-pcode">(SCV)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/fr/course/splunk-srm"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Result Modification <span class="fl-prod-pcode">(SRM)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/fr/product/splunk-sra"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Scheduling Reports & Alerts <span class="fl-prod-pcode">(SRA)</span></a></span></li><li><span class="cms-link-marked"><a class="fl-href-prod" href="/swisscom/fr/course/splunk-itd"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Introduction to Dashboards <span class="fl-prod-pcode">(ITD)</span></a></span></li></ul><ul>
<li>Users/Analysts</li><li>Administrators</li><li>Engineers</li></ul><p><strong>Module 1 – Using Lookup Commands</strong></p>
<ul>
<li>Understand lookups</li><li>Use the inputlookup command to search lookup files</li><li>Use the lookup command to invoke field value lookups</li><li>Use the outputlookup command to create lookups</li><li>Invoke geospatial lookups in search</li></ul><p><strong>Module 2 – Adding a Subsearch</strong></p>
<ul>
<li>Define subsearch</li><li>Use subsearch to filter results</li><li>Identify when to use subsearch</li><li>Understand subsearch limitations and alternatives</li></ul><p><strong>Module 3 – Using the return Command</strong></p>
<ul>
<li>Use the return command to pass values from a subsearch</li><li>Compare the return and fields commands</li></ul>To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge:
- Intro to Splunk
- Using Fields (SUF)
- Visualizations
- Working with Time (WWT)
- Statistical Processing (SSP)
- Comparing Values (SCV)
- Result Modification (SRM)
- Scheduling Reports & Alerts (SRA)
- Introduction to Dashboards (ITD)- Users/Analysts
- Administrators
- EngineersModule 1 – Using Lookup Commands
- Understand lookups
- Use the inputlookup command to search lookup files
- Use the lookup command to invoke field value lookups
- Use the outputlookup command to create lookups
- Invoke geospatial lookups in search
Module 2 – Adding a Subsearch
- Define subsearch
- Use subsearch to filter results
- Identify when to use subsearch
- Understand subsearch limitations and alternatives
Module 3 – Using the return Command
- Use the return command to pass values from a subsearch
- Compare the return and fields commands3 heures500.00500.00420.00500.00500.00690.00550.00500.0050.0050.0050.0050.0050.0050.0050.0050.0050.0050.00