Search Optimization (SSO)

Voraussetzungen

To be successful, students must have completed these Splunk Education course(s) or have equivalent working knowledge:

• How Splunk works
• Creating search queries
• Creating reports and data models

Zielgruppe

• Knowledge Managers
• Users/Analysts

Detaillierter Kursinhalt

Module 1 - Optimize Search

• Understand how search modes affect performance
• Examine the role of the Splunk Search Scheduler
• Review general search practices

Module 2 - Report Acceleration

• Define acceleration and acceleration types
• Understand report acceleration and create an accelerated report
• Reveal when and how report acceleration summaries are created
• Search against acceleration summaries

Module 3 - Data Model Acceleration

• Understand data model acceleration
• Accelerate a data model
• Use the datamodel command to search data models

Module 4 - Using the tstats Command

• Explore the tstats command
• Search acceleration summaries with tstats
• Search data models with tstats
• Compare tstats and stats