Splunk Core Certified User study guide
Splunk Core Certified User · Work through your exam, one topic at a time.
The Splunk Core Certified User credential is an entry-level certification from Splunk, now a Cisco company, that verifies foundational ability to work with Splunk Enterprise and Splunk Cloud. Splunk describes it as an optional entry point to its certification program, intended for candidates with little or no prior Splunk experience: career changers, new customers, and data analysts who need to search data and turn it into action. The exam covers platform basics and practical skills - searching, using fields and lookups, and creating alerts, basic statistical reports, and dashboards. There are no prerequisites, but candidates should still expect to learn interface navigation, search fundamentals, knowledge objects, and the reporting workflow. The Splunk Core Certified User study guide has 5 sections and about 1,651 words.
01Splunk Components and Architecture
Splunk deployments are described by role: forwarders collect, indexers store and search, and search heads provide the web UI and coordinate distributed searches. A single-instance install performs all three roles on one machine.
329 words, about 2 min02Navigating the Splunk Interface
Nearly all user work happens in the Search & Reporting app, the default app. The top app bar holds the app menu, Settings , and the Activity menu (Jobs, Searches & Reports, Triggers), plus account, Help, and Messages.
327 words, about 2 min03Basic Searching
A bare term is a keyword search across all fields: error finds any event containing it. Combine with AND (implicit), OR , and NOT , and group with parentheses.
324 words, about 2 min04Fields, Lookups, and Knowledge Objects
Fields are searchable name/value pairs. Default fields exist on every event: host , source , sourcetype , index , time , linecount , splunk server , plus the raw text in raw .
335 words, about 2 min05Alerts, Statistical Reports, and Dashboards
Transforming commands turn events into a results table. stats is the workhorse: stats count by host , stats avg(response) as avg resp by app , dc(user) for distinct count, values() / list() to collect.
336 words, about 2 min