Splunk Core Certified User study plan
Splunk Core Certified User · Give each week a clear focus.
8 weeks · About 7 hours per week
Splunk Components and Architecture & Navigating the Splunk Interface
Diagram the data pipeline from universal forwarder to indexer to search head, labeling where parsing, indexing, and search-time processing each occur.
Distinguish Splunk Enterprise, Splunk Cloud, and forwarder roles, and state which tasks run at index time versus search time.
Identify each major area of the Splunk Web interface (apps bar, Search & Reporting, Settings, Activity menus) and state the purpose of each.
Differentiate index, source, sourcetype, and host, giving one concrete example of each from a web-server log scenario.
Locate the license usage, index list, and user/role settings pages and describe when an admin would visit each.
Your checkpoint
A one-page labeled architecture diagram drawn from memory plus a 10-row table mapping source, sourcetype, host, and index to concrete examples, self-checked against documentation.
Basic Searching
Construct searches following the base search, filter, then transform progression.
Apply relative time modifiers such as -24h@h and now, and set earliest/latest boundaries on searches.
Use free-text terms, boolean operators, and wildcards correctly, and explain default AND behavior and quoting rules.
Read search job properties to confirm scan count, result count, and run time for a completed search.
Your checkpoint
A 20-search notebook where each search is labeled with the question it answers and a one-line note identifying which clause does the filtering.
Basic Searching & Navigating the Splunk Interface
Write searches using fields, table, rename, sort, dedup, head, and tail to shape results.
Choose between search and where for filtering, and justify the choice in two written examples.
Use the field sidebar and Interesting Fields list to discover, add, and remove fields from results.
Interpret the timeline and event histogram to validate that a search is returning the expected volume and time distribution.
Your checkpoint
A 15-row command reference table (syntax example plus one pitfall per row), validated by running five searches against a sample dataset and recording the row count each returns.
Fields, Lookups, and Knowledge Objects
Differentiate automatic/default fields, indexed fields, and search-time extracted fields.
Extract a new field using rex and using the field extractor in both regex and delimiter modes.
Apply eval functions including case, if, coalesce, and strftime to build calculated values inside a search.
Compare field aliases, calculated fields, lookups, and event types, and select the right one for four given scenarios.
Create one field alias and one calculated field through Settings and confirm both appear in search results.
Your checkpoint
Three new fields extracted from sample web logs, one promoted to a calculated field, all recorded in a knowledge-object inventory table listing name, type, scope, and search that verifies it.
Fields, Lookups, and Knowledge Objects
Build a CSV lookup table, upload it through Settings, and confirm its contents with inputlookup.
Apply the lookup command to enrich events and verify coverage across matching events.
Configure an automatic lookup and explain the conditions under which it fires without being called explicitly.
Create an event type and a tag, then reference both in a search filter.
Explain knowledge object permissions and scoping across app versus global and user versus role.
Your checkpoint
A working CSV lookup applied to sample data that returns at least two enriched fields on every matching event, accompanied by a written step-by-step record of the configuration.
Alerts, Statistical Reports, and Dashboards
Write statistical searches using count, dc, avg, sum, and values with by clauses.
Build trend and ranking views with timechart, chart, top, and rare.
Add eventstats to attach aggregate context back to individual events and explain how it differs from stats.
Filter aggregated results with where, and order them with sort on calculated columns.
Your checkpoint
Three saved reports built on sample data: top 10 sourcetypes by volume, error rate over time, and distinct users per host.
Alerts, Statistical Reports, and Dashboards
Configure a scheduled alert specifying the trigger condition, throttle settings, and an action.
Explain the difference between a cron schedule and a time range, and set both for one alert.
Build a dashboard containing a single value panel, a timechart panel, and a table panel sharing one time range input.
Convert an ad-hoc search into a scheduled report and add that report to the dashboard.
Your checkpoint
One three-panel dashboard plus one scheduled alert confirmed to fire on a controlled test condition, documented with trigger condition, schedule, and throttle settings.
Basic Searching & Fields, Lookups, and Knowledge Objects & Alerts, Statistical Reports, and Dashboards
Re-attempt every missed item from weeks 1 through 7 and close each gap with a written correction note.
Redraw the architecture diagram and reconstruct the knowledge-object inventory without notes.
Complete a timed 60-question cumulative practice set spanning all five domains.
Rank remaining weak areas by domain weight and schedule targeted review for the two lowest scores.
Your checkpoint
A timed cumulative practice set score of at least 85 percent plus a one-page weak-spot list where every listed item has a documented remediation.
Milestones
Week 2: Explain the indexing pipeline end to end in under three minutes without notes, and pass 20 of 25 self-written questions on domains 1 and 2.
Week 3: Compose a filtering search from a plain-English question in under two minutes, five times in a row, with correct time range and command order.
Week 4: Pass a 25-question self-test covering domains 1 through 3 at 80 percent or higher, and demonstrate extraction of a field the test set did not cover.
Week 5: Enrich a raw event stream with a CSV lookup from scratch in under 15 minutes, then explain permissions scoping to a peer or in writing.
Week 6: Produce a statistical report with a by clause, a timechart trend, and an eventstats comparison without consulting notes.
Week 7: Deliver a dashboard and a firing alert in a single sitting, and explain the throttle behavior observed.
Week 8: Score 85 percent or higher on the timed cumulative practice set and finish the weak-spot remediation list.