topic Re: Prerequisites of Splunk in Splunk Search

Prerequisites of Splunk

Tron-spectron47 — Tue, 12 Mar 2024 18:22:22 GMT

if i had to write a document for myself on basic learning of splunk: to create a dashboard i can either use inputs like index,source,source fields or I can give a data set is that right? for that can i write it like this or am i wrong with side headings:

Understanding of input data: Explore different methods of data input into Splunk, such as ingesting data from files, network ports, or APIs.
Understanding of Data domains : Discover how to efficiently structure your data in Splunk using data models to drive analysis.

Re: Prerequisites of Splunk

gcusello — Wed, 13 Mar 2024 07:13:10 GMT

Hi @Tron-spectron47,

here you can find all the Splunk courses: https://www.splunk.com/en_us/training/course-catalog.html

in details you should see these courses:

Splunk Enterprise System Administration chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.splunk.com/en_us/pdfs/training/splunk-enterprise-system-administration-course-description.pdf

Splunk Enterprise Data Administration chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.splunk.com/en_us/pdfs/training/splunk-enterprise-data-administration-course-description.pdf

Data Models chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.splunk.com/en_us/pdfs/training/data-models-course-description.pdf

You can find the page to register in the first url.

Ciao.

Giuseppe

Re: Prerequisites of Splunk

Tron-spectron47 — Wed, 13 Mar 2024 12:39:52 GMT

I wanted to see what i captured is in right direction its for own sake,can i say like that like there are two ways for creating dashboard understand through inputs and other through data models?

Re: Prerequisites of Splunk

gcusello — Wed, 13 Mar 2024 12:58:53 GMT

Hi @Tron-spectron47,

everything in Splunk is a search, so you have to learn how to create a search, both using indexes or Data Models.

When you'll be able to create a search, you can save it in a dashboard or an alert or a report, but the starting point is always a search.

To start, you could follow the Splunk Search Tutorial https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial

Ciao.

Giuseppe