- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Security
- :
- splunk troubleshooting Training
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Greetings!!
Need your advice and opinions on the following points:
- What training can I take to master splunk admin troubleshooting issues and complete the admin training package,
- Is there a way to set or have a simulator that can help a team or someone to have a test environment to practice more on splunk troubleshooting and not the Live environment, is there any advice on this to still be able to play with the simulator or how to set up the test environment?
Kindly need your advice on these, Thank you in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pacifikn,
about training, there are some free courses https://www.splunk.com/en_us/training/free-courses/overview.html , in addition I hint the Search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchTutorial/WelcometotheSearchTutorial) that's very useful
In addition, you can find all the Splunk certification paths at https://www.splunk.com/en_us/training.html?sort=Newest
My hint is to follow the certification paths for Power User, then Admin and then eventually Architect, but you have to follow many courses!
No there isn't an environment to use for troubleshooting, you could create a test environment, as similar as possible to your production environment and use it for testing.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well, the troubleshooting is often the most annoying part of any solution administration and is difficult to "teach". Mostly because troubleshooting is what you need to do when something goes not as it should which means that either the external environment does something you'd not expect or you yourself did something wrong (my "favourite" mistake - mistype "pass4SymmKey" as "pass4SymKey").
That's why troubleshooting expertise comes mostly with experience. Broad experience with various IT solutions helps as well.
Of course every IT soultion has its own "typical first steps" to troubleshooting which vary between the different solutions. In case of splunk it would probably be some simple checklist like: check your btool output, check your connectivity, trim your search...
But still you need to understand what you're troubleshooting. Otherwise you're not really troubleshooting as such but just performing a playbook.
So get your User/Admin training, start working with splunk and it will come. After you learn the basics of Splunk on an all-in-one installation, try doing a distributed environment install. After that add a mutual-TLS layer. Each of those add additional points where something can go wrong.
Just do it 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pacifikn,
about training, there are some free courses https://www.splunk.com/en_us/training/free-courses/overview.html , in addition I hint the Search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchTutorial/WelcometotheSearchTutorial) that's very useful
In addition, you can find all the Splunk certification paths at https://www.splunk.com/en_us/training.html?sort=Newest
My hint is to follow the certification paths for Power User, then Admin and then eventually Architect, but you have to follow many courses!
No there isn't an environment to use for troubleshooting, you could create a test environment, as similar as possible to your production environment and use it for testing.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dear @gcusello ,
is there any guidance on how to create test environment step by step or you can advise me , here i think we'll use a single instance deployment?
- is it possible that you can do this test environment and work as production for free?
- what splunk enterprise and splunk enterprise security we can use for testing environment? free splunk enterprise is limited to 500MB only and i don't what to use so that you can do the test environment which can be similar to the production? what are I required to have?and how to do it?
Kindly guide me on this, as i want to create test environment similar to the production?
Thank you in advance!!
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pacifikn,
there isn't any guideline for test environments because they are usually similar to the production environment to recreate the same conditions of the production environment: e.g. if you have an indexer cluster, you should have an indexer cluster also in the test environment, obviously with less storage, less resources and less clients.
If instead you're speaking of a development environment you can have also a stand alone server, or eventually also use your workstation, because Splunk Enterprise guarantees portability of applications.
To simulate load condition probably a free license isn't sufficient, so you should ask to Splunk a development license, for more infos see at
https://dev.splunk.com/enterprise/dev_license/
https://splunkbase.splunk.com/develop/
https://www.splunk.com/en_us/resources/personalized-dev-test-licenses/faq.html
Ciao.
Giuseppe
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
