CVF 2072 - Visualization and Reporting for Big Data

Credits: 3
Hours/Week: Lecture 2 Lab 1
Course Description: This course builds on basic search and reporting skills to chart and visualize data. It focuses on more advanced search and reporting commands. It provides students with an opportunity to create reports as well as complex dashboards, forms, and visualizations.  Students are guided step-by-step through complex searches to produce multiple types of graphs and customized visualizations. This course employs both “open source technology” (Hadoop) and “commercial technology” (Splunk).
MnTC Goals
None

Prerequisite(s): CVF 1071  with a grade of C or higher, or instructor consent.
Corequisite(s): None
Recommendation: None

Major Content
1.Beyond Search Fundamentals

1. Proper case in searches
2. Splunk’s search process
3. Search inspector

2. Using Sub-Searches

1. Sub-searches - Matching values
2. Sub-search - Non matching values

3. Using Advanced Statistics

1. Statistical functions
2. Appendpipe command
3. Streamstats and eventstats commands

4. Using Data Manipulation, and Filtering

1. Data manipulation functions:
   1. bin
   2. xyseries
   3. foreach
2. Data filtering search commands:
   1. where functions: like, isnull
   2. eval functions: strftime, upper, case, replace

5. Using Advanced Charting

1. Advanced charting commands and functions:
2. untable
3. addtotals
4. append and appendcols

6. Using Advanced Transactions

1. Events logged - Before
2. Events logged - After
3. Complete transactions
4. Analyze transactions

7. Sorting, Searching, and Reformatting Time

1. Event searching - Custom time ranges
2. Event searching - Window of time
3. Event searching - Relative dates
4. Return command

8. Using Advanced Lookups

1. Lookup table
2. Baseline lookup table

9. Introduction to Views

1. Views - Definition
2. Views - Best practices
3. Common information model
4.  Splunk CIM

10. Adding Content

1. Data structure requirements
2. Primary transforming commands
3. Dashboard performance
4. Acceleration

11. Editing XML

1. Simple XML syntax
2. Categories of panels
3. Types of panel objects
4. Post-process searches
5. Charts

12. Using Tokens

1. Form inputs
2. Tokens and filters
3. Cascading menus
4. Dynamic drilldowns

13. Customizing Dashboards

1. Simple XML extensions
2. Search managers
3. Custom visualizations
4. Autodiscovery

1. use the proper case in searches.
2. describe Splunk’s search process.
3. use the search inspector to view search performance.
4. use sub-searches to correlate data by finding events that match given criteria.
5. display the array data model of an image with graphical representations.
6. use statistical functions in Splunk: min, max, mean, median, and standard deviation.
7. use the appendpipe, streamstats and eventstats commands.
8. use eval, where, bin, xyseries, foreach, filtering commands and functions.
9. use untable, addtotals, append, and appendcols charting commands and functions.
10. find a suspicious event using the transaction function in Splunk.
11. search for events using custom time ranges.
12. use the return command to pass values up from a sub search.
13. build a baseline lookup table and reference the baseline values in alerts.
14. identify best practices for creating views.
15. define the common information model.
16. normalize data to the Splunk common information model.
17. define data structure requirements.
18. identify the primary transforming commands.
19. describe methods to improve dashboard performance.
20. define the simple XML syntax.
21. name categories of panels.
22. identify types of panel objects.
23. identify types of form inputs.
24. use tokens and filters.
25. create cascading menus and dynamic drilldowns.
26. use simple XML extensions to customize Splunk dashboard.
27. identify types of search managers.

Courses and Registration