Troubleshooting Splunk Enterprise (TSE)


2 Days


Delivery Methods
Virtual Instructor Led
Private Group

Course Overview

It covers topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available with Splunk Enterprise.

This lab-oriented class is designed to help you gain troubleshooting experience before attending more advanced courses. You will debug a distributed Splunk Enterprise environment using the live system. This course does not cover the issues surrounding Splunk Cloud, Splunk Clusters, or Splunk premium apps.

Course Objectives

  • Splunk Troubleshooting Methods and Tools
  • Indexing Problems
  • Input Configuration Problems
  • Deployment Problems
  • License, Upgrade, and User Management Problems
  • Search Management Problems
  • User Search Problems
  • Understand the Splunk Support Model and its resources
  • Identify the best practices for troubleshooting Splunk Enterprise
  • List ways to gather useful Splunk diagnostic information
  • Use Splunk diagnostic tools
  • Identify common Splunk technical issues and solve them
  • Who Should Attend?

    This course is designed for Splunk administrators.

    United Training is committed to working as a partner with our clients. Choose United Training and take advantage of the following benefits.

    • Robust Public Enrollment Schedule. Enjoy access to hundreds of Guaranteed to Run dates across a diverse catalog of course titles.
    • Private Group Training. Let our world-class instructors come to you to deliver training at your place of business or we can present to your team online using our Virtual Instructor-Led Training platform.
    • Custom Training Solutions. Our subject matter experts can customize the class to specifically address the unique goals of your team.
    • Free Re-Takes. Most completed United Training courses carry our unbeatable Learning Guarantee. This guarantee allows students to repeat most United Training courses, if they are the same version, FREE OF CHARGE, within six months of completion of the courses. Exceptions: Cisco, Citrix, VMware, Red Hat, and courses provided by affiliated 3rd party training providers.


    1 - Splunk Troubleshooting Methods and Tools

    • Describe the Splunk Troubleshooting Approach
    • List Splunk Diagnostic Resources and Tools
    • Create and Splunk a Diag
    • Use RapidDiag

    2 - Indexing Problems

    • Discover Splunk Deployment Topology and its Server Roles
    • Identify Where to Check the Index-Time Pipeline Status
    • Use the metrics.log to Clarify the Index-Time Problem

    3 - Input Configuration Problems

    • Data Input Issues
    • Troubleshooting Inputs with the Monitoring Console

    4 - Input Configuration Problems

    • Deployment Server Issues
    • Forwarding and Receiving Issues

    5 - Indexer Cluster Management Administration

    • Peer Offline and Decommission
    • Master App Bundles
    • Indexer Cluster Storage Utilization Options
    • Site Mapping
    • Monitoring Console for Indexer Cluster Environment

    6 - License, Upgrade, and User Management Problems

    • Installation Issues
    • Upgrade Considerations
    • Splunk Licensing Issues
    • Splunk Roles and User Management Issues

    7 - Search Head Management Problems

    • Troubleshoot Distributed Search Issues
    • Identify Job Scheduling Problems
    • Learn to Diagnose Crashing Problems
    • Describe How to Prioritize Resources for Critical Splunk Processes

    8 - KV Store Collection and Lookup Management

    • Identify the Types of Search Problems
    • Isolate and Troubleshoot Search Problems

    Upcoming Class Dates and Times

    Dec 11, 12
    8:00 AM - 12:30 PM
    ENROLL $1,000.00
    Dec 18, 19
    8:00 AM - 12:30 PM
    ENROLL $1,000.00
    Dec 18, 19
    9:00 AM - 1:30 PM
    ENROLL $1,000.00
    Jan 4, 5
    8:00 AM - 12:30 PM
    ENROLL $1,000.00
    Jan 8, 9
    8:00 AM - 12:30 PM
    ENROLL $1,000.00
    Jan 8, 9
    9:00 AM - 1:30 PM
    ENROLL $1,000.00
    Jan 22, 23
    8:00 AM - 12:30 PM
    ENROLL $1,000.00
    Jan 22, 23
    9:00 AM - 1:30 PM
    ENROLL $1,000.00
    Feb 5, 6
    8:00 AM - 12:30 PM
    ENROLL $1,000.00
    Feb 12, 13
    9:00 AM - 1:30 PM
    ENROLL $1,000.00
    Feb 20, 21
    8:00 AM - 12:30 PM
    ENROLL $1,000.00
    Feb 26, 27
    8:00 AM - 12:30 PM
    ENROLL $1,000.00

    Do You Have Additional Questions? Please Contact Us Below.

    contact us contact us 
    Contact Us about Starting Your Business Training Strategy with United Training