Splunk
Splunk Search Expert; Splunk Knowledge Manager
Data analysis is a critical part of any cyber security strategy, and Splunk is fastly becoming an important tool in utilization of data analysis to fight cyber threats. While Splunk is used as a traditional Security Information and Event Management (SIEM) solution, Splunk’s approach to onboarding and analyzing any type of enterprise data is beyond normal logs.
Through a series of single-subject courses, students and alumni will have the opportunity to familiarize themselves with Splunk and gain an understanding of the concepts and methods to leverage data to support security investigations.
Whether looking to learn a single topic or pursue a Splunk learning path, Splunk offers students and alumni the opportunity to customize their learning experience with microcredentials and two stackable learning path badges. Complete single-subject courses, to earn microbadges. Follow the Splunk Search Expert and Splunk Knowledge Manager learning paths to earn a stackable learning path badge.
Students and alumni should register using their @nyu.edu email address through Splunk’s university portal. Registration is only necessary one-time.
For courses that require a fee, users can to follow the steps below to complete for free:
- On the course page, click on the arrow next to ‘Buy Now’ and select ‘Add to Cart’
- Go to your cart and select ‘Checkout’
- Under ‘Coupon Code’ enter ‘SplunkPledge’ and click ‘Apply’
- The coupon code should cover 100% of the cost
Splunk Search Expert
The Splunk Search Expert learning path badge teaches how to write searches and perform advanced searching forensics, and analytics. This badge will challenge NYU affiliates with creative solutions to complex problems. Creating alerts and simple dashboards will be a result of completion.
The following courses are related to the Search Expert Learning Path:
What is Splunk?
This course introduces students to what machine data is—and how Splunk can leverage operational intelligence to investigate and respond to incidents in their organizations.
Duration: 45 minutes
Intro to Splunk
This course teaches students how to use Splunk to create reports and dashboards and explore events using Splunk's Search Processing Language. Students will learn the basics of Splunk's architecture, user roles, and how to navigate the Splunk Web interface to create robust searches, reports, visualizations, and dashboards.
Duration: 45 minutes
Using Fields
This course is for power users who want to learn about fields and how to use fields in searches. Topics will focus on explaining the role of fields in searches, field discovery, using fields in searches, and the difference between persistent and temporary fields.
Duration: 3 hours
Scheduling Reports and Alerts
This eLearning course teaches students how to use scheduled reports and alerts to automate processes in their organization. Students will create, manage, and schedule reports and alerts, and use alert actions to further respond to incidents as they occur.
Duration: 3 hours
Visualizations
This eLearning course teaches students how to create visualizations in Splunk, using Splunk's Search Processing Language as well as the Splunk Web interface. Students will learn commands that allow data to be displayed on charts and graphs, transform geographic data into maps, create single value visualizations, and use Splunk's visual formatting options to change the look of statistical tables.
Duration: 1 hour
Working with Time
This course is for power users who want to become experts at using time in searches. Topics will focus on searching and formatting time, in addition to using time commands and working with time zones.
Duration: 3 hours
Statistical Processing
This course is for power users who want to identify and use transforming commands and eval functions to calculate statistics on their data. Topics will cover data series types, primary transforming commands, mathematical and statistical eval functions, using eval as a function, and the rename and sort commands.
Duration: 3 hours
Comparing Values
This course is for power users who want to learn how to compare field values using eval functions and eval expressions. Topics will focus on using the comparison and conditional functions of the eval command, and using eval expressions with the field format and where commands.
Duration: 3 hours
Result Modification
This course is for power users who want to use commands to manipulate output and normalize data. Topics will focus on specific commands for manipulating fields and field values, modifying result sets, and managing missing data. Additionally, students will learn how to use specific eval command functions to normalize fields and field values across multiple data sources.
Duration: 3 hours
Leveraging Lookups and Subsearches
This course is designed for power users who want to learn how to use lookups and subsearches to enrich their results. Topics will focus on lookup commands and explore how to use subsearches to correlate and filter data from multiple sources.
Duration: 3 hours
Correlation Analysis
This course is for power users who want to learn how to calculate co-occurrence between fields and analyze data from multiple datasets. Topics will focus on the transaction, append, appendcols, union, and join commands.
Duration: 3 hours
Search Under the Hood
This eLearning course gives students additional insight into how Splunk processes searches. Students will learn about Splunk architecture, how components of a search are broken down and distributed across the pipeline, and how to troubleshoot searches when results are not returning as expected.
Duration: 3 hours
Multivalue Fields
This course is for power users who want to become experts on searching and manipulating multivalue data. Topics will focus on using multivalue eval functions and multivalue commands to create, evaluate, and analyze multivalue data.
Duration: 3 hours
Search Optimization
This course is for power users who want to improve search performance. Topics will cover how search modes affect performance, how to create an efficient basic search, how to accelerate reports and data models, and how to use the tstats command to quickly query data.
Duration: 3 hours
Approximate duration of Search Expert learning path: 36 hours
Splunk Knowledge Manager
Splunk Knowledge Manager learning path badge builds the ability to perform data interpretation, classification, enrichment and data models. Managing knowledge objects while configuring summary-based reports and data model acceleration is a result of this learning path.
The following courses are related to the Knowledge Manager Learning Path:
What is Splunk?
This eLearning course introduces students to what machine data is—and how Splunk can leverage operational intelligence to investigate and respond to incidents in their organizations.
Duration: 45 minutes
Intro to Splunk
This eLearning course teaches students how to use Splunk to create reports and dashboards and explore events using Splunk's Search Processing Language. Students will learn the basics of Splunk's architecture, user roles, and how to navigate the Splunk Web interface to create robust searches, reports, visualizations, and dashboards.
Duration: 45 minutes
Using Fields
This course is for power users who want to learn about fields and how to use fields in searches. Topics will focus on explaining the role of fields in searches, field discovery, using fields in searches, and the difference between persistent and temporary fields.
Duration: 3 hours
Intro to Knowledge Objects
This eLearning course teaches students about different types of knowledge objects to extract additional insights from their data. Students will learn the basics of how to create knowledge objects, define their settings, edit, and manage existing knowledge objects.
Duration: 1 hour
Creating Knowledge Objects
This course is for knowledge managers who want to learn how to create knowledge objects for their search environment using the Splunk web interface. Topics will cover types of knowledge objects, the search-time operation sequence, and the processes for creating event types, workflow actions, tags, aliases, search macros, and calculated fields.
Duration: 3 hours
Creating Field Extractions
This course is for knowledge managers who want to learn about field extraction and the Field Extractor (FX) utility. Topics will cover when certain fields are extracted and how to use the FX to create regex and delimited field extractions.
Duration: 3 hours
Enriching Data with Lookups
This course is for knowledge managers who want to use lookups to enrich their search environment. Topics will introduce lookup types and cover how to upload and define lookups, create automatic lookups, and use advanced lookup options. Additionally, students will learn how to verify lookup contents in search and review lookup best practices.
Duration: 3 hours
Data Models
This course is for knowledge managers who want to learn how to create and accelerate data models. Topics will cover datasets, designing data models, using the Pivot editor, and accelerating data models.
Duration: 3 hours
Introduction to Dashboards
This course is designed for power users who want to learn best practices for building dashboards in the Dashboard Studio. It focuses on dashboard creation, including prototyping, the dashboard definition, layout types, adding visualizations, and dynamic coloring.
Duration: 3 hours
Dynamic Dashboards
This course is designed for power users who want to learn best practices for building dashboards in the Dashboard Studio. It focuses on creating inputs, chain.
Duration: 3 hours
Using Choropleth
This course is designed for power users who want to create maps in Splunk. It focuses on the data and components required to create cluster and choropleth maps. It also shows how to format, customize and make maps interactive.
Duration: 3 hours
Search Optimization
This course is for power users who want to improve search performance. Topics will cover how search modes affect performance, how to create an efficient basic search, how to accelerate reports and data models, and how to use the tstats command to quickly query data.
Duration: 3 hours
Approximate duration of Knowledge Manager: 30 hours