Splunk Basics Course

Machines are trying to tell us something through logs, so they are a very valuable resource for IT departments to ensure that everything is working as expected and to give us an idea of what is going on in our IT environments which will help to respond faster to incidents.
In this
hands-on
course, we will learn how to set up a small virtual LAB to simulate
real-world logging and monitoring scenarios
, where we will collect logs from
Apache web server
and
Fortigate firewall
and send them to
Splunk
for storage, analysis, visualization and alerting.
I selected these two log sources specifically because they represent
the majority of log sources
you will find in your environment, so you can follow the same steps in the course to integrate different log sources in the future.
There are more complex log sources to integrate like logs that are pulled from database but they are not suitable to be discussed in an introductory course.
After we onboard logs to
Splunk
, we will search and explore data we received then we will add knowledge to it by extracting interesting fields in these logs. 
At this point, our logs will be ready to be treated by
Splunk Searching Processing Language (SPL)
to create reports, dashboards, and alerts.
This course will make you ready to dig deep into more advanced topics of Splunk administration like,
High availability
Indexers clusters
Search head clusters
Deployments servers
Splunk Apps
Advanced SPL
But you have to walk before you run, so my vision for this course is to master the basics first to break the ice.
Note:
When the course was recorded Splunk version was
8.0.4.1
, On 10-09-2022 I validated
Splunk Enterprise 9.0.1
on my own test lab and the steps and instructions in this course still apply.
Who this course is for:
Security engineers
IT Administrators
Security operations center engineers
Security incident handlers
Systems administrators
Anyone wants to explore huge log files/feeds
Anyone interested to learn Splunk