>> Hi. Before we begin our next and last video,
which will be a review of
the topics covered in this course,
I wanted to discuss some other areas of study.
We've learned a lot in a short amount of time,
but there are still so much more Splunk has to
offer and so much more you're able to learn.
In this video, I'll introduce
some topics that I won't fully explain.
This is intended to help you
look for things to study on your own.
As a reminder, Splunk does offer its own courses.
Their first course is free and I highly
recommend that as a next step after finishing this one.
It gets more in-depth with search language, timing,
and it introduces some concepts we haven't covered,
such as macros and lookups.
Running better and more complex searches
is also a great next step.
We just touched the surface of what you can do.
Splunk.com has a great reference guide
for learning other search commands.
A fill null command, for example,
can replace an empty field value with the value you want.
The make MV command can split field values.
Lookup tables can store lists of
information to compare it
to search results and do many other things.
Search macros are portions of
searches that can be re-used,
and apply it in other searches.
Summary indexing involves writing
searches or report results to
a unique index that can
help improve reporting efficiency,
and it has other uses.
The common information model
helps you normalize data by having
field name and event tags standards
that apply to different source types.
Again, this doesn't cover anywhere near everything,
but gives you some good ideas.
A few ideas to study next around architecture,
could be understanding how to set
up a distributed Splunk environment,
and how to be able to set up a clustered environment.
Learning more about
Spunk data storage including buckets,
and getting familiar with the files and file structure
used by Splunk could be another good direction.
You may also want to study how to load balance,
such as having a forward or be able to
send multiple indexes in case one is unreachable.
There's a lot to learn about hardware planning,
and best practices for Splunk.
You'll likely also want to spend
some time browsing the many different apps,
and add-ons available on Splunk base.
You may want to learn how to create your own apps.
As you use Splunk more,
you'll find the need to
troubleshoot various problems that come up.
You might learn to use the command line tool called BTool
to help troubleshoot configuration file issues.
You could look at the job inspector
to try and evaluate search performance.
You could dig into Splunk D,
or crash logs to try and identify issues.
You may also want to learn more about Splunk licensing,
how to make intelligent purchases for
your company and lead Splunk related projects.
You might also want to learn
more about other Splunk products,
and identify ways to automate
and streamline business activities.
These are just a few ideas.
You've already learned a lot and you should
have a good foundation for
moving forward with your Splunk goals.
In our next video,
we'll have a final review.