I failed the first Splunk exam (SPLK-1001: Splunk Core Certified User) this afternoon.
However, I wanted to provide a review as it is fairly new. I decided to take the exam, as the end of the free fundamentals course recommended it. This was a “I don’t know what I’m getting into, but I have to do something about it” moment for me.
The exam is 60 multiple-choice questions with a 60 minute time limit. The cost for a Splunk exam voucher is $125. Register on Splunk’s website first, then use the ID they provide to you in an email to register an account on PearsonVUE.
I completed the free Splunk Fundamentals 1 course offered from Splunk two days prior to the exam. My experience with Splunk is limited to the labs in the free course, and lightly exploring the product at the office. Ok, basic information is out of the way. Here’s what I wish I knew and did:
Read the exam blueprint!
Like most certification exams, the free course was not enough to prepare for it. Do the free course, then do it again. Then do it one more time. Pay attention to small details. You will need to know which words turn which color, correct syntax, and which words are case-sensitive.
Information for each command is very important; you will need to know how to rename fields, sort fields, limit fields, etc. In addition, the exam is tricky – they may put two answers that are VERY SIMILAR – these might be clear to those who are experienced using Splunk, but can be tricky for beginners.
Booleans – learn them, review them, practice, practice, practice. Pay attention to how they are written in the search bar. Practice generating long (not necessarily complex) search strings. For example, try searching more than one index and more than one Boolean statement. Remember how algebra has an order of operations and can specify what happens first with parenthesis? Apply that to your practice searches.
You will also need to know default settings for commands, reports, searches, etc. The exam can get tricky by providing two answers which look like they are both correct – the only difference being one includes a description of default values.
I feel a lot better having sat for the exam and experiencing what it was like. Having discovered the blueprint and seeing the exam results, I can narrow down where I need to focus.
And now back to the training.
