Data onboarding in an accurate and efficient manner is the key to timely and reliable monitoring and analysis in Splunk Enterprise. In this course, Splunk Enterprise Administration: Parsing and Manipulating Data, you’ll learn different methods and techniques to parse and manipulate data at index-time in Splunk. First, you’ll explore different techniques and options for parsing data while indexing, applying appropriate configuration settings. Next, you’ll discover how to deal with situations that require extracting custom fields and timestamps as well as overriding the default fields. Finally, you’ll learn how to route data to specific indexes and filter or mask the event data based on specific criteria. When you’re finished with this course, you’ll have the skills and knowledge of Splunk Enterprise administration, parsing and manipulating data needed to deploy suitable techniques for handling, parsing and manipulating data while ingesting into Splunk.
Author Name: Muhammad Awan
Author Description:
Muhammad Awan is a Senior Splunk Admin in working in Public Sector. Has been associated with Splunk and data science related technologies for a decade. Splunk Certified Admin and Splunk Certified Power User. Microsoft Certified Solutions Exert and Microsoft Certified Solutions Associate (Office 365) MCSA (Messaging). Experience with Networks and Security technologies. He has been mentoring and teaching at various universities as a visiting faculty in the past. Loves to acquire new skills and dis… more

Table of Contents

• Course Overview
  1min
• Event Processing in Splunk Enterprise
  13mins
• Configuring Event Line-breaking
  20mins
• Identifying and Parsing Timestamps
  27mins
• Overriding Default Fields and Custom Fields Extraction
  26mins
• Routing and Filtering Events
  31mins
• Manipulating Raw Data
  20mins