Duration:  24 hours

Objectives:

What you’ll learn:

• Understand factors that affect large-scale Splunk deployment
• Set up Splunk indexer clusters
• Deploy and configure a Splunk search head cluster
• Bring new nodes into an existing cluster
• DecomDeploy apps and knowledge bundles in Splunk clusters
• Manage KV store collections and lookups in Splunk clusters
• Troubleshoot potential cluster issues with Monitoring Console

Prerequisites:

• Splunk System Administration
• Splunk Data Administration
• Troubleshooting Splunk Enterprise
• Architecting Splunk Enterprise Deployments
• Working Linux knowledge

Course outlines:

1.      Module 1: Large-scale Splunk Deployment Overview

2.      Module 2: Single-site Indexer Cluster

3.      Module 3: Multisite Indexer Cluster

4.      Module 4: Indexer Cluster Management and Administration

5.      Module 5: Forwarder Configuration

6.      Module 6: Search Head Cluster

7.      Module 7: SHC Management and Administration

8.      Module 8: KV Store Collection and Lookup Management