A complete, hands-on course that takes you from "I have never opened Splunk" to "I design searches, dashboards and detections that other people rely on."
Everything here is written for people who learn by doing. Every chapter has real SPL you can paste, a lab you can run on your own machine, and diagrams that explain what is actually happening underneath.
🇬🇧 Start the English course → | 🇩🇪 Zum deutschen Kurs →
- Install Splunk, get your own data into it, and know why it looks the way it does
- Write SPL fluently — filtering,
stats,eval,timechart,rex,tstats, subsearches - Build dashboards people actually open in the morning
- Write alerts that fire when they should and stay quiet when they shouldn't
- Understand indexes, forwarders, buckets, roles and retention well enough to run a small deployment
- Build security detections on top of CIM and accelerated data models
- Walk into a Splunk Core Certified Power User exam without panic
| # | Chapter | You will learn |
|---|---|---|
| 01 | What Splunk actually is | The problem it solves, architecture, core vocabulary |
| 02 | Installation and first start | Linux, Windows, Docker, Splunk Cloud, first login |
| 03 | The interface, explained | Search app, timeline, fields sidebar, search modes |
| 04 | Getting data in | Inputs, sourcetypes, forwarders, HEC, indexes |
| 05 | SPL foundations | The pipeline, filtering, booleans, wildcards, time |
| 06 | Fields, eval and stats | The three commands that carry 80% of all searches |
| 07 | Time and trends | timechart, spans, comparisons, bin, time functions |
| 08 | Advanced SPL | rex, eventstats, streamstats, multivalue, subsearches |
| 09 | Knowledge objects | Lookups, macros, event types, tags, field extractions |
| 10 | Dashboards and visualisations | Panels, tokens, drilldowns, Dashboard Studio |
| 11 | Alerts and reports | Scheduling, throttling, actions, alert hygiene |
| 12 | Data models, CIM and tstats | Acceleration, Pivot, normalising many sources |
| 13 | Administration essentials | Indexes, conf files, apps, users, roles, licensing |
| 14 | Performance and troubleshooting | Job Inspector, slow searches, the internal indexes |
| 15 | Security use cases | Brute force, rare process, lateral movement, risk |
| 16 | Certification and what comes next | Exam paths, study plan, staying sharp |
| 17 | SPL cheat sheet | Everything on one page, for printing |
| 18 | The labs | 12 guided exercises with solutions |
Every exercise in this course uses the same three sample log files. Generate them once:
git clone https://github.com/kalin0x0/Splunk.git
cd Splunk/labs
python3 generate_sample_data.py --hours 24You get data/access.log, data/auth.log and data/app.log — roughly 40,000 events containing a deliberate outage, a brute force attempt and a batch of slow requests, so there is something real to find.
Upload them in Splunk under Settings → Add Data → Upload, into an index called tutorial.
There are also two CSV lookups in labs/lookups/ used from chapter 9 onwards.
If you have a week. Chapters 1–7, plus labs 1–6. That is enough to be genuinely useful on a team.
If you have a month. Everything up to chapter 12. You will be the person others ask for help.
If you are preparing for certification. Chapters 1–14 map closely to the Core Certified Power User syllabus. Chapter 16 has the details.
Read a chapter, then immediately do its lab. Splunk is not a subject you can learn by reading — the muscle memory of the pipeline is the whole point.
|
This course is written and maintained by Naiemi Consulting, an independent consultancy working on data engineering, observability and security analytics. We spend most of our time doing three things: getting messy data into Splunk cleanly, making slow searches fast, and building detections that security teams actually trust. The material here is a condensed version of what we teach on client engagements. If your team is stuck on any of that — an ingest pipeline that keeps breaking, dashboards nobody trusts, an alert backlog nobody reads — that is usually a short conversation, and we are happy to have it. Training · Implementation · Health checks · SOC enablement |
Typical engagements
|
Found an error, a search that no longer works, or a chapter that could be clearer? Open an issue or a pull request. Corrections from people who are still learning are the most useful kind.
Released under the MIT Licence — see LICENSE. Use it for internal training, adapt it, translate it. A link back is appreciated but not required.
Splunk, SPL and related marks are trademarks of Splunk LLC. This is an independent, unofficial course and is not affiliated with or endorsed by Splunk.