The table below is taken from the Splunk Conf 2014 website and gives a nice overview over different areas of Splunk, with which to gauge your skills.
To make it a bit more useful I’m planning to add links for each item, to the official documentation, articles/blog posts I’ve found or blog posts that I’ve written myself. There are also some quick tips after the table.
At the moment it is far from exhaustive…but over time I hope that this becomes a valuable learning reference.
If you think that there is something missing then leave me a comment and I’ll update the table.
|AREA OF EXPERTISE
||Building stuff in Splunk Web:
||Editing simple XML and using simple XML extensions:
||Working with SplunkJS, Django bindings, SDKs:
- Keyword searches (basic Google knowledge)
- Time ranges, booleans, key, value pair searching
- Concepts of source, source type, and host and other fields
- Tags, saving reports, creating alerts
- Basic reporting, top, timechart, simple stats commands and eval.
- Event types, workflow actions, basic form search, basic report acceleration.
- Complex statistical questions–measure, report, and alert based on standard deviations, etc.
- Work closely with Splunk Admins on data acquisition.
- Non-traditional API-based searching
- Data models and pivot reports
- All-in-one Splunk with just forwarders
- Use of deployment server to deploy to UF/HWFs only
- Single serverclass.conf file
- Distributed, but no clustering or search head pooling
- Use of deployment server to maintain apps on SH/indexers (outside of clustering), surgical DS reloading
- Load balancing forwarders
- Search head pooling
- Multi-site clusters
- Use of deployment server to store configs for apps in git or other source-control system
- Multiple DSs behind load balancers
- Self-updating deploymentclient.confs
- SSL keys et al
Development – Intermediate
Using Drilldown to set Tokens and crossfilter the dashboard – When using a drilldown with a timechart, you use $click.name2$ to access the value of the “group” the user has clicked on. With other charts, e.g. line charts use $row..
Splunk posts I’ve written
External Splunk content