When it comes to preparing for Splunk Certification exams, there are two questions I see in the Splunk community this post will address:
- “I’m going to take the ____ certification test. How should I study?”
- “What is the ‘secret’ to passing the cert exams?”
In the post, we’ll advise studying techniques and provide the “secret” for passing Splunk Certifications… and, along the way, you’ll get better at using Splunk.
Note: This information is current as of March 2021. Please check the Splunk Training website for potential changes.
Step 1: Determine Splunk Certification Course Prerequisites
First, review the requirements for the certification. Namely, do you have to take any Splunk Education courses? I recommend the education courses for all certifications, but I understand if experienced Splunkers want to focus their education budgets on new topics or advanced classes.
Head to Splunk’s Training and Certification Page and select Certification Tracks on the left menu. The details for each certification list if the classes are required or strongly recommended (coursework will increase understanding of the concepts and make a pass more likely).
For example, select Splunk Enterprise Certified Admin to open the details and then select the top link. In the description, it states: “The prerequisite courses listed below are highly recommended, but not required for candidates to register for the certification exam.” Ergo, you do not have to take the classes (though you probably should).
The Splunk Enterprise Certified Architect lists that the prerequisite courses through the Data and System Admin courses are not required. This means the only courses required for Certified Architect are: Troubleshooting Splunk Enterprise, Splunk Enterprise Cluster Administration, Architecting Splunk Enterprise Deployments, and the Splunk Enterprise Practical Lab.
Step 2: Determine Required Splunk Certifications
The same website, Splunk’s Training and Certification Page will also list any certification requirements for taking the certification you wish. For example, to obtain Splunk Enterprise Certified Architect, you must be a current Splunk Enterprise Certified Admin and a current Splunk Core Certified Power User.
To find which certifications are prerequisites for the cert you wish to take, on Splunk’s Training and Certification Page, click on Certification Track and then navigate to the particular certification you want to review.
Step 3: Review What Topics the Exams Cover
One of the most common questions I see and hear is, “What is on the Test?” Fortunately, Splunk publishes an exam blueprint for each of its certification tests. Splunk’s Training site lists these blueprints in the Splunk Certification Exams Study Guide, along with sample questions for most of the tests.
Let’s investigate the Splunk Core Certified Power User:
Splunk’s Test Blueprint states that this is a 57-minute, 65-question assessment evaluating field aliases, calculated fields, creating tags, event types, macros, creating workflow actions, data models, and CIM. Whew, so it spells out the main topics and explains them in more detail before giving out the critical information: exactly what topics are on the exam and the percentage of those topics on the typical exam.
We learn from the document that 5% of the exam deals with the topic “Using Transforming Commands for Visualizations” and further shows two elements:
- Using the chart command.
- Using the the timechart command.
The topic “Filtering and Formatting Results” makes up 10% and has elements:
- Using the eval command.
- Using search and where commands to filter results.
- Using the fillnull command.
The exam continues by listing out the ten topics of the exam and their elements. If a candidate is going to pass this exam, they should be knowledgeable on the topics listed. Bonus: if the candidate is good with these topics, they likely can perform the job as a Splunk Power User/Knowledge Manager.
Step 4: Review Material, Focusing on Unfamiliar Topics
In Step 3, we found what topics are on the different exams. Now comes the big question: how do I prepare for the exams?
1. Gather your study material:
If you took the Splunk Education Classes, get the class docs. Those are great at taking cumbersome topics and presenting them in an accessible method.
Splunk Docs has exhaustive details on the variety of exam topics.
2. Practice on Splunk Instance(s):
We can read until we’re bleary-eyed, and that may be enough for you, but I find people learn better using a combination of reading and practice. If you have a laptop/desktop (windows, Linux, or Mac), then you can download Splunk—for free—install it on your system, and use that for practice. The free install works great for User, Power User, Admin, and Advanced Power User. For ITSI or ES, the best approach is to use a dev instance (if you are lucky enough to have access to one) or the Free Trials from Splunk Cloud. Other exams work best in a private cloud or container system (after all, it’s hard to learn how to use a cluster if you don’t have a cluster).
Back to our example for Splunk Core Power User:
Grab the Fundamentals 1 and Fundamentals 2 course material, have a Splunk instance installed, and open a web browser. Then, go through the exam blueprint one topic at a time. In this example, we’ll look at “Describe, create, and use field aliases.” The Fundamentals 2 course material explains what a field alias is and provides examples of its use. You can also supplement that material with the Splunk Knowledge Manager Manual section on Field Aliases. Run through creating field aliases in your Splunk instance until you have the topic down.
Then you can move on to the next section, find the relevant course material/documentation, and practice.
The Non-Step: Or, The Elephant in the Phone Booth
I need to address a question that gets asked far too often…
Q: “Dumps. Where do we find them?”
A: “Don’t do that.” (though sometimes the language is much more colorful)
Q: “Why not?”
Answer 1: Splunk Certification strictly prohibits using dumps, and their use is grounds for being banned from taking Splunk Certs. That’d suck for someone making Splunk their focus to limit their career by never earning any certifications.
Answer 2: The goal of certification is to prove the ability to use the product, not the ability to memorize test questions. If you tell an employer that you have the Power User Cert, it comes with a promise that you have the skills. Don’t be the person faking it.
The Cert Secret
Finally, the “secret” method for passing Splunk certs: Find the topics and study those. Sometimes the best secrets are the obvious ones.
Best of luck in your testing!