Foundational sessions will help those who are starting their Splunk journey. Deep-dive technical sessions — presented by Splunk engineers, product managers and sales engineers — provide real-world best practices along with do’s and don’ts for using, deploying and administering Splunk.
750 archived sessions available on .conf Online
For those with three years’ experience or less with Splunk, these sessions are focused on foundational principles and concepts, the beginner track is your first stop to Splunk stardom.
Beginner sessions focus on topics like:
- Basic search
- Using fields in searches
- Search fundamentals
- Transforming commands
- Creating reports and dashboards
- Creating and using lookups
- Scheduled reports
- Alerts
- Using Pivot
For those with three to 5 years’ experience with Splunk, intermediate topics build on definitional terms and concepts with instructive demos, management tools, deep process discussions and similar content.
Intermediate sessions focus on topics like:
- Transforming commands and visualization
- Filtering and formatting results
- Correlating events
- Knowledge objects
- Fields (field aliases, field extractions, calculated fields)
- Tags and event types
- Macros
- Workflow actions
- Data models
- Splunk Common Information Model (CIM)
For Splunk experts, get straight to the internals of Splunk with demonstrations, line code, architecture discussions, tools that can be shared and more. Parental guidance is advised.
Advanced sessions focus on topics like:
- Using subsearches
- Using advanced statistics
- Manipulating and filtering data
- Additional charting techniques
- Using advanced transactions
- Working with time
- Using advanced lookups
- Searching tsidx files
- Prototyping
- Using tokens
- Improving performance
- Customizing views
- Using event handlers
- Adding simple XML extensions