Splunk Core Certified User Study Plan¶

Three weeks at 4 to 6 hours per week. Searching, fields and the search language carry most of the weight, so they get the first and longest block.

Week 1: Search and fields¶

• Read note 01: components, apps, the time picker, the results page, jobs
• Read note 02: field rules, the pipeline, table, rename, fields, dedup, sort
• Hands-on: get a Splunk instance and the tutorial data, and rebuild three searches from the Search Tutorial

Week 2: Statistics and saved objects¶

• Read note 03 and write each of top, rare and stats with and without by
• Read note 04 and save a report, then a dashboard with two panels
• Note the difference between a panel from a report and a panel with an inline search

Week 3: Lookups, alerts, review¶

• Read note 05 and create a small CSV lookup, a definition and an automatic lookup
• Read note 06 and create a scheduled alert with throttling
• Re-read scenarios and strategy
• Re-read the blueprint line by line and mark any line you cannot explain aloud