Private corporate batches delivered onsite across Pune, or live online in IST (UTC+5:30) — taught by a practitioner who runs Splunk in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Splunk from the ingest decision outward, because sourcetype, event breaking, timestamp recognition and index routing set the ceiling on everything SPL can do afterwards. Sessions go deep on the search language — base search discipline, the streaming against transforming distinction, eventstats and streamstats, transaction against stats, and the Search Job Inspector as the way to find out why a search is expensive rather than guessing — then the knowledge layer and its permission model, accelerated data models with tstats, and the Common Information Model that correlation content depends on. The administration material is weighted toward what a regulated operations floor answers for: index and retention design, role and index-level access, licence volume forecasting, and filtering traffic at the forwarder before anybody pays to index it.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Splunk that means a trainer who has run it in production — Splunk data onboarding, SPL and licence economics for Pune's operations and security teams — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Onsite delivery covers Kharadi, Magarpatta, Yerwada, Hinjewadi, Talawade, Baner and Viman Nagar; you provide the room, a screen and network, we bring trainer, agenda, sample data sets, assessments and certificates. Hours are 09:30 to 17:30 IST, and for security operations teams we run a shorter separate sitting for the second shift roster rather than asking analysts to attend outside their hours. Labs use a free-tier instance each attendee provisions on a laptop or a small virtual machine with our sample data, so nobody consumes production licence volume during an exercise; if you want the onboarding labs to use your own log formats, send redacted samples ahead of day one and we build the sourcetype, props and transforms exercises around them under NDA. Tell us at the discovery call whether you run Enterprise Security or a plain deployment, because the correlation-search and notable-event material only applies to the former. Invoicing is in INR with GST against your purchase order from the Indian entity.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Splunk batchSplunk indexes machine data and lets you query it as data rather than as files. Events arrive from monitored files, network inputs, scripted inputs, an HTTP endpoint or a forwarder; each is stamped with a time, a host, a source and a sourcetype, and written into an index that ages through hot, warm, cold and frozen storage on a retention schedule somebody has to choose. Schema is applied at search time, and in an estate carrying retention obligations that is the single most valuable property of the platform: a field extraction written two years after an incident still applies to events already on disk, and answering a new question about an old day requires no reindexing.
The query surface is SPL, a pipeline language. A base search selects events by index, sourcetype, host and terms, and each command downstream reshapes the result set — eval computes, stats and timechart aggregate, lookup enriches from a table, rex extracts a field on the fly, and tstats reads accelerated summaries instead of raw events. Which commands stream and which gather every result to the search head decides whether a search returns in seconds or occupies indexers for ten minutes, and that stops being academic the moment fifty analysts share one deployment.
Above the search sits a knowledge layer — field extractions and aliases, calculated fields, event types, tags, macros, lookups and data models — governed by a permission model that scopes each object as private, app-level or global. Splunk's Common Information Model is a set of those data models with agreed field names, and it is why a correlation search written against one deployment can fire on a differently formatted log in another. Retention, index design, role-based access and daily licence volume are administration decisions that quietly set the ceiling on everything the search layer is able to do.
Splunk demand in Pune does not originate in product engineering. It originates where an unanswerable question has a consequence — a regulator's request, an access review, a payment that has to be traced end to end — and those obligations sit with the banking, insurance and payments captives around Kharadi, Yerwada and Magarpatta. Data onboarded carelessly cannot be un-onboarded cheaply, so the value here attaches to people who can define a sourcetype properly, correct a timestamp on a host whose clock was never set to IST, and normalise fields before anyone writes a correlation search on top of them.
The second population is the managed-services and security operations floor across Hinjewadi, Talawade and Magarpatta, where analysts work a customer's deployment on the India-hours shift and are measured on time to answer. In a shared-tenant deployment the search cost is shared as well: one all-time wildcard search, or one field extraction accidentally shared globally, lands on every other tenant of that search head. Accelerated data models, tstats, summary indexing and disciplined permission scoping are therefore hygiene rather than optimisation, and they are what separates an analyst who can run a search from one who can be trusted with the deployment.
The third pressure is commercial and it is felt directly by engineers. Licence volume is measured every day, and in Pune the person onboarding a source is usually the person who has to forecast what it will cost and defend it afterwards. Filtering at the forwarder, routing noise to the null queue and choosing between index-time and search-time extraction are ordinary parts of the job here, which is exactly why a search-language-only course leaves teams short of what their role demands.
The deployment you are actually running, before any search is typed. Which component does what, how an event travels from a forwarder to a bucket on an indexer, and the index and retention design that decides what is still searchable when somebody asks about last March.
Topics: Forwarder, indexer, search head, deployment server, licence manager and cluster manager · How an event becomes an indexed event: parsing, indexing and the pipeline · Indexes and buckets: hot, warm, cold, frozen and thawed · Retention policy, sizing and what frozen actually means for an obligation · Distributed search, indexer clustering and search head clustering · Index-level access control and why it is designed at this stage · Monitoring Console and watching Splunk itself
Collection at scale, and the failure everyone meets — a forwarder that connects successfully and indexes nothing. Universal against heavy forwarders and the real difference between them, input types, and managing hundreds of forwarders through the deployment server rather than one at a time.
Topics: Universal forwarder against heavy forwarder, and when the heavy one is justified · Monitor, network, scripted and modular inputs · HTTP Event Collector, tokens and application-side instrumentation · inputs.conf and outputs.conf, layer by layer · The deployment server, serverclasses and deployment apps · Load balancing and indexer discovery · Diagnosing a forwarder that connects but sends nothing
The module that decides everything downstream. Event breaking, timestamp and timezone recognition for hosts that are certainly not all set to IST, sourcetype definition and overrides, and the routing and filtering decisions that determine what a source costs to index every day for the rest of its life.
Topics: Sourcetype assignment, overrides and naming that other people can live with · Line breaking and event boundaries for multi-line and non-standard formats · Timestamp recognition, TIME_FORMAT, TZ and hosts on the wrong clock · props.conf and transforms.conf at index time · Index-time against search-time extraction, and the storage and licence consequence · Routing to a different index, and dropping traffic to the null queue · Forecasting daily volume before a source is onboarded · Verifying a new source before anyone builds a report on it
The core skill, taught as a pipeline rather than a set of recipes. Base search discipline and why filtering early is the largest single performance lever, time range as a cost decision, search modes, and the command families that cover most day-to-day questions on an operations or security floor.
Topics: The search pipeline and the pipe operator · Base searches: index, sourcetype, source, host and free-text terms · Time ranges, relative time modifiers and the cost of a wide window · Fast, smart and verbose modes · Filtering: search, where, dedup, head and tail · Shaping: fields, table, rename and sort · Reporting: stats, chart, timechart, top and rare · eval and the function library, including null handling
Where an analyst becomes an engineer. Commands that gather all results to the search head against those that stream, subsearch limits nobody reads until they bite, session grouping done with stats rather than transaction, and the Search Job Inspector as the instrument that ends arguments about why a search is slow.
Topics: Streaming, transforming and centralised commands, and why the difference is a cost model · Subsearches: syntax, the result and time limits, and when to avoid them · transaction against stats for session grouping · eventstats and streamstats for windowed calculations · rex, erex and regular extraction in the search · lookup, inputlookup and outputlookup for enrichment · append and join, and their performance profile · Multivalue fields and the mv command family · Reading the Search Job Inspector and acting on it
Making data usable by people who did not onboard it, without making it everybody's problem. Extractions, aliases, calculated fields, event types, tags, macros and workflow actions — then the sharing model, because in a shared deployment one object promoted to global scope changes results for tenants you have never met.
Topics: Knowledge object categories and what each is for · Interactive and manual field extraction, and where the definition lives · Field aliases and calculated fields · Event types and tags for classification · Search macros with arguments, for logic a team repeats · Lookups as knowledge objects: file-based, KV Store and external · Workflow actions into a ticketing or investigation tool · Private, app and global sharing, role-based permissions and orphaned objects · Naming conventions that survive a change of owner
How reporting stays cheap when the deployment is busy. What a data model is and how it differs from a saved search, acceleration and the storage it consumes, tstats against accelerated summaries, and summary indexing where acceleration is the wrong instrument.
Topics: Data models: datasets, objects, constraints and field categories · Building a model to satisfy a stated reporting requirement · Acceleration: how it works, what it costs and when it is refused · tstats against accelerated data and the syntax differences that catch people · Report acceleration against data model acceleration · Summary indexing and si- commands · Pivot for people who do not write SPL · Deciding which of the three techniques a given report needs
Turning searches into things other people depend on, without flooding an inbox or an indexer. Scheduled reports and the scheduler's constraints, alert trigger conditions and throttling, alert actions into the tools an operations floor already uses, and dashboards built on shared base searches rather than a dozen independent ones.
Topics: Saved searches as the common substrate for reports, alerts and panels · Scheduling, the scheduler window and skipped search diagnosis · Alert trigger conditions, real-time against scheduled, and throttling · Alert actions: email, webhook, script and ticketing integration · Choosing a visualisation that does not mislead · Dashboard inputs, tokens and drilldown to raw events · Base searches and post-process for dashboard performance · Simple XML and Dashboard Studio, and when to reach for either
Why a detection that works in one deployment silently matches nothing in another. Normalising to the Common Information Model, validating that normalisation, then the Enterprise Security objects built on top — correlation searches, notable events, adaptive response and the investigation workflow an audit will later ask about.
Topics: The Common Information Model: data models, field names and tags · Mapping a non-standard source to a CIM data model · Validating normalisation before a detection is written on it · Correlation searches and how they consume accelerated models · Notable events, urgency and the analyst queue · Adaptive response actions · The investigation workflow and preserving the evidence trail · Producing compliance and access-review reporting from indexed data
We rebuild the agenda around the tools you actually run.
Request a custom agendaTake a multi-line log whose events break in the wrong place and whose hosts report in three different timezones, and make it index correctly and search consistently.
Profile a noisy source, filter and route at the forwarder, send the rest to the null queue, and produce a before-and-after daily volume figure you could take to a licence review.
Answer ten operational questions in SPL, then use the Search Job Inspector to find why the three slowest are expensive and restructure them until they are not.
Build extractions, aliases, event types and macros for one source, scope each correctly, then audit an app for objects shared globally by accident and fix them without breaking a saved search.
Take a scheduled report that scans raw events over thirty days, back it with an accelerated data model, rewrite it in tstats and record both the runtime and the storage it now costs.
Onboard an unfamiliar source, parse and normalise it to the Common Information Model, write a correlation search on top, and hand over an investigation trail an auditor could follow.
Splunk's Pune footprint is concentrated in regulated operations rather than in product engineering. The banking, insurance and payments captives around Kharadi, Yerwada and Magarpatta index for audit and investigation before they index for dashboards — retention obligations, access reviews, transaction traceability — so the training that lands here is mostly about getting data in correctly the first time: sourcetype definition, props and transforms, timestamp and timezone handling for hosts that are certainly not all set to IST, index-time against search-time extraction, and normalisation to a common information model so a correlation search actually fires instead of silently matching nothing.
The second Pune population is the managed-services and security operations floor across Hinjewadi, Talawade and Magarpatta, where analysts run a customer's deployment on the India-hours shift and are judged on how fast they can answer a question in the search language. That pushes the syllabus toward search performance — accelerated data models and tstats, summary indexing, and breaking the habit of an all-time wildcard search run simultaneously by fifty analysts — and toward knowledge-object hygiene across app and role boundaries, because in a shared-tenant deployment one badly scoped field extraction affects everyone. Licence volume is a live commercial topic here for the same reason: filtering noisy sources at the forwarder, routing to the null queue, and forecasting daily ingest before onboarding a new source are part of the job in Pune rather than an afterthought handled by procurement.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
I recently did a SRE Session with Rajesh Kumar from DevOps School and the session was great. Right from 1st day till day 15, we had a very interactive session. Rajesh clarified our doubts and the tool demos were excellent without any hiccups. He simplified the concepts while sticking to the content with a fine balance between theory and practice. Am convinced he is one of the best trainers for SRE & DevOps concepts.
The trainer (Rajesh) provided very good sessions on SRE profession. Not only hands-on learning on the tools but also SRE mindset.
Very good training session. Well explained from the basics to the complex concepts. Also tried to cover practicals and demos within the 3 hour sessions. The learning content and videos are of a great deal of help.
Basics explanation was exemplary from Rajesh where he dealt with complicated topics to be simple. Great learning stuff personally for me.
Good discussion, helped us to understand different tools in SRE.
I took Terraform training with the tutor named Mithilesh. I requested to tailor the course curriculum for my needs. He did an excellent job of showing me how to write the Terraform script per the instructions provided.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.