Splunk - Architect Fast Start

This course focuses on large enterprise deployments.

Students will learn:

• steps and best practices for planning, data collection and sizing for a distributed deployment.
• topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available on Splunk Enterprise.
• troubleshooting experience before attending more advanced courses. You will debug a distributed Splunk Enterprise environment using the live system.　
• the fundamental knowledge of deploying and managing Splunk Enterprise in a clustered environment. It covers installation, configuration, management, and monitoring of Splunk clusters.

While Splunk Clusters are supported in Windows environments, the class lab environment is running Linux instances only. ONLY for customers with Splunk on-prem.

• Architecting Splunk Enterprise Deployments:
• Introduction
• Project Requirements
• Infrastructure Planning: Index Design
• Infrastructure Planning: Resource Planning
• Clustering Overview
• Forwarder and Deployment Best Practices
• Integration　
• Performance Monitoring and Tuning
• Use Cases
• Splunk Troubleshooting Methods and Tools
• Indexing Problems
• Input Configuration Problems
• Input Deployment Problems
• Indexer Cluster Management Administration
• License, Upgrade, and User Management Problems
• Search Management Problems
• KV Store Collection and Lookup Management
• Large-scale Splunk Deployment Overview
• Single-site Indexer Cluster
• Multisite Indexer Cluster
• Indexer Cluster Management and Administration
• Forwarder Management
• Search Head Cluster
• Search Head Cluster Management and Administration
• KV Store Collection and Lookup Management
• SmartStore Implementation

To be successful, students should have a solid understanding of the following courses:

• Splunk Power User Fast Start
• Splunk Enterprise Administration Fast Start

Splunk Enterprise Certified Architect (Prereq for this cert is the Splunk Core Certified Power User AND Splunk Enterprise Certified Admin)