Analysts
Answer complex questions with data.
SPL Training.
Search Processing Language training, from basic to advanced, with exercises based on real cases.
The problem we solve.
Much of Splunk's value depends on writing good searches. Poor SPL gives incorrect results or consumes resources across the whole platform.
What’s included.
- Fundamental commands
- Statistics, transformations and correlation
- Subsearches, lookups and macros
- tstats and data models
- Performance and best practices
How we work.
Five phases, always in the same order. Select each one to see what happens in it. In full projects they map onto the stages of our method.
We assess the group's starting level and what they need to be able to do by the end.
We design the programme: syllabus, exercises, practice environment and schedule.
We deliver the sessions with progressive search exercises.
Each participant answers a set of questions using efficient SPL.
We gather feedback and results and refine the programme for future editions.
Technical capabilities.
- SPL
- stats, eval and where
- Lookups and macros
- tstats
- Data models
- Job Inspector
Use cases.
Detection engineers
Write efficient detections.
Administrators
Optimise searches across the platform.
Benefits for your organisation.
- Correct, fast searches
- Less load on the platform
- Greater independence
- A better foundation for detection and dashboards
Deliverables.
- Course materials
- Worked exercises
- SPL quick-reference sheet
- Final assessment
Frequently asked questions.
What level does it cover?
There are introductory, intermediate and advanced modules; we build the course around the group.
Do you teach how to optimise searches?
Yes, using Job Inspector and comparing alternatives for the same question.
Shall we talk about SPL Training?
Tell us about your situation. If this service is not what you need, we will tell you; if it is, we will propose a concrete first step.
Request this service