Detailed Course Outline
Module 1 - Optimize Search
- Understand how search modes affect performance
- Examine the role of the Splunk Search Scheduler
- Review general search practices
Module 2 - Report Acceleration
- Define acceleration and acceleration types
- Understand report acceleration and create an accelerated report
- Reveal when and how report acceleration summaries are created
- Search against acceleration summaries
Module 3 - Data Model Acceleration
- Understand data model acceleration
- Accelerate a data model
- Use the datamodel command to search data models
Module 4 - Using the tstats Command
- Explore the tstats command
- Search acceleration summaries with tstats
- Search data models with tstats
- Compare tstats and stats