What’s on the Exam

This next-level certification exam is a 57-minute, 65-question assessment which evaluates a candidate’s knowledge and skills of field aliases and calculated fields, creating tags and event types, using macros, creating workflow actions and data models, and normalizing data with the CIM. Candidates can expect an additional 3 minutes to review the exam agreement, for a total seat time of 60 minutes.

In order to be prepared for the certification exam, Splunk recommends following course:

Courses to prepare for this certification:

Courses to prepare for this certification:

What’s on the Exam

This upper-level certification exam is a 57-minute, 56-question assessment which evaluates a candidate’s knowledge and skills to manage various components of Splunk on a daily basis, including the health of the Splunk installation. Candidates can expect an additional 3 minutes to review the exam agreement, for a total seat time of 60 minutes.

It is recommended that candidates for this certification complete the lecture, hands-on labs, and quizzes that are part of the Splunk Enterprise System Administration and Splunk Enterprise Data Administration courses in order to be prepared for the certification exam.

Courses to prepare for this certification:

The following content areas are general guidelines for the content to be included on the exam:

• Splunk deployment overview
• License management
• Splunk apps
• Splunk configuration files
• Users, roles, and authentication
• Getting data in
• Distributed search
• Introduction to Splunk clusters
• Deploy forwarders with Forwarder Management
• Configure common Splunk data inputs
• Customize the input parsing process

What’s on the Exam

This highly technical certification exam is an 87-minute, 85-question assessment which evaluates a candidate’s knowledge and skills in Splunk Deployment Methodology and best-practices for planning, data collection, and sizing, managing, and troubleshooting a standard with indexer and search head clustering. Candidates can expect an additional 3 minutes to review the exam agreement, for a total seat time of 90 minutes.

Candidates for this certification must complete the lecture, hands-on labs, and quizzes that are part of the Architecting Splunk Enterprise Deployments, Troubleshooting Splunk Enterprise, and Splunk Enterprise Cluster Administration courses, as well as the Splunk Enterprise Deployment Practical Lab in order to be eligible for the certification exam.

Courses to prepare for this certification:

The following content areas are general guidelines for the content to be included on the exam:

• Requirements definition
• Index and infrastructure planning
• Clustering Overview
• Forwarder and Deployment
• Integration
• Splunk Support model
• Splunk troubleshooting methods and tools
• Clarifying the problem, installation, licensing, and crash problems
• UI and search problems
• Configuration problems
• Deployment problems
• User management problems
• Large-scale Splunk deployment overview
• Single-site (high-availability) indexer cluster, multi-site (disaster-recovery) indexer cluster
• Indexer cluster management and administration
• Indexer discovery forwarder configuration
• Search head cluster
• Search head cluster management and administration
• KV Store collection and lookup management

Courses to prepare for this certification:

Courses to prepare for this certification:

Courses to prepare for this certification:

Courses to prepare for this certification:

Courses to prepare for this certification:

Courses to prepare for this certification: