Duration:  24 hours

Objectives:

What you’ll learn:

• Understand factors that affect large-scale Splunk deployment
• Set up Splunk indexer clusters
• Deploy and configure a Splunk search head cluster
• Bring new nodes into an existing cluster
• DecomDeploy apps and knowledge bundles in Splunk clusters
• Manage KV store collections and lookups in Splunk clusters
• Troubleshoot potential cluster issues with Monitoring Console

Prerequisites:

• Splunk System Administration
• Splunk Data Administration
• Troubleshooting Splunk Enterprise
• Architecting Splunk Enterprise Deployments
• Working Linux knowledge

Course outlines:

1. Module 1: Large-scale Splunk Deployment Overview

2. Module 2: Single-site Indexer Cluster

3. Module 3: Multisite Indexer Cluster

4. Module 4: Indexer Cluster Management and Administration

5. Module 5: Forwarder Configuration

6. Module 6: Search Head Cluster

7. Module 7: SHC Management and Administration

8. Module 8: KV Store Collection and Lookup Management