The most common method of data ingestion in Splunk is using the universal forwarders. While most of the factory settings work well on a universal forwarder, there are numerous options you can (and should) configure for optimal performance. Further, as the number of universal forwarders grow in your environment, managing all of them from one central system is inevitable. In this course, Splunk Enterprise Administration: Managing Data and Forwarders, you will learn the foundational knowledge to configure forwarders for efficiency, manage thousands for forwarders using Splunk deployment servers, and monitor forwarders. First, you will learn how the forwarders work and understand the difference between Splunk universal forwarder and heavy forwarder. Next, you will discover the various options to configure forwarders such as compression, encryption and load balancing. Finally, you will explore how to use Splunk deployment server to manage thousands of forwarders by configuring deployment apps and deployment clients. When you are finished with this course, you will have the skills and knowledge of Splunk administration needed to effectively configure and manage data ingestion.
Author Name: Karun Subramanian
Author Description:
Karun is passionate about IT operations. He has 20+ years of hands-on experience in diverse technologies ranging from Linux Administration to Cloud technologies, and everything in between. He specializes in modernizing IT operations with automation, end-to-end monitoring, CI/CD and containerization. He holds professional certifications from half a dozen companies, including IBM, Oracle and Splunk. Karun has extensive experience in popular Application Performance Management tools such as Dynatrac… more

Table of Contents

• Course Overview
  1min
• Getting Data into Splunk
  43mins
• Configure Splunk Forwarders
  59mins
• Manage Splunk Forwarders
  36mins