Search Optimization (SSO) – Outline

Gedetailleerde cursusinhoud

Topic 1 - Optimizing Search

  • Understand how search modes affect performance
  • Examine the role of the Splunk Search Scheduler
  • Review general search practices

Topic 2 - Report Acceleration

  • Define acceleration and acceleration types
  • Understand report acceleration and create an accelerated report
  • Reveal when and how report acceleration summaries are created
  • Search against acceleration summaries

Topic 3 - Data Model Acceleration

  • Understand data model acceleration
  • Accelerate a data model
  • Use the datamodel command to search data models

Topic 4 - Using the tstats Command

  • Explore the tstats command
  • Search acceleration summaries with tstats
  • Search data models with tstats
  • Compare tstats and stats