Splunk Core Certified User study materials
Splunk Core Certified User study resources

Splunk Core Certified User case studies

Splunk Core Certified User · Put your knowledge to work in context.

The Splunk Core Certified User credential is an entry-level certification from Splunk, now a Cisco company, that verifies foundational ability to work with Splunk Enterprise and Splunk Cloud. Splunk describes it as an optional entry point to its certification program, intended for candidates with little or no prior Splunk experience: career changers, new customers, and data analysts who need to search data and turn it into action. The exam covers platform basics and practical skills - searching, using fields and lookups, and creating alerts, basic statistical reports, and dashboards. There are no prerequisites, but candidates should still expect to learn interface navigation, search fundamentals, knowledge objects, and the reporting workflow. The Splunk Core Certified User case studies are 5 cases and about 3,679 words.

1

License Violation After a New Firewall Feed

Northwind Retail runs one Splunk indexer and one search head. Forty universal forwarders send application and system logs, about 55 GB per day in total, against a 50 GB per day license.

703 words, about 4 min
2

The Dashboard Dana Cannot See

Dana joins the payments operations team. Her colleague Miguel shows her a 'Payments Ops' dashboard in Splunk Web.

771 words, about 4 min
3

Four Minutes Versus Fifteen Seconds

Priya runs index=web sourcetype=access combined status=500 stats count by uri over the last 7 days and it takes four minutes. A teammate runs index=web sourcetype=access combined stats count by status over the same period in 15 seconds.

751 words, about 4 min
4

The Lookup That Went Stale on One Search Head

Ravi owns product catalog.csv in the Sales app. It maps product id to product name and list price , and his search is index=sales sourcetype=orders lookup product catalog product id OUTPUT product name list price .

750 words, about 4 min
5

380 Emails and a 90-Second Dashboard

Meridian's SOC has an alert called 'Failed Login Spike' scheduled every 5 minutes that emails 40 recipients. During a brute-force attempt it fired 380 times in two hours and the mail queue backed up.

704 words, about 4 min