Core Consultant Labs
The newest comprehensive resource from Splunk Training + Certification is here.
- Free Courses
-
Learning Paths
- Courses for Users
-
Courses for Splunk Administrators
- Courses for Splunk Administrators
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Implementing Splunk SmartStore
- Splunk Workload Management
- Working with Metrics in Splunk
- Implementing Splunk Data Stream Processor (DSP)
- Courses for Splunk Cloud Customers
-
Courses for Splunk Architects
- Courses for Splunk Architects
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Creating Dashboards with Splunk
- Splunk Fundamentals 3
- Advanced Searching and Reporting
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Architecting Splunk Enterprise Deployments
- Courses for App Developers
-
Courses for Enterprise Security Administrators
- Courses for Enterprise Security Administrators
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Creating Dashboards with Splunk
- Splunk Fundamentals 3
- Advanced Searching and Reporting
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Architecting Splunk Enterprise Deployments
- Administering Splunk Enterprise Security
- Courses for Enterprise Security End-Users
-
Courses for IT Service Intelligence Administrators
- Courses for IT Service Intelligence Administrators
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Creating Dashboards with Splunk
- Splunk Fundamentals 3
- Advanced Searching and Reporting
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Implementing Splunk IT Service Intelligence
- Courses for IT Service Intelligence End-Users
- Courses for Phantom Customers
-
Courses for Observability Customers
- Courses for Observability Customers
- Introduction to Splunk Observability
- Using Splunk Infrastructure Monitoring
- Kubernetes Monitoring with Splunk
- Automation Using the REST and SignalFlow APIs
- Using the Splunk Terraform Provider
- Sending Custom Metrics to Splunk IM
- Using Splunk APM to Monitor Microservices-based Applications
- Advanced Monitoring of Microservices Applications Using Splunk APM
- Using the Splunk Log Observer
-
Certification Tracks
- Splunk Core Certified User
- Splunk Core Certified Power User
- Splunk Core Certified Advanced Power User
- Splunk Cloud Certified Admin
- Splunk Enterprise Certified Admin
-
Splunk Enterprise Certified Architect
- Splunk Enterprise Certified Architect
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Architecting Splunk Enterprise Deployments
- Splunk Enterprise Practical Lab
- Splunk Certified Developer
- Splunk Enterprise Security Certified Admin
- Splunk IT Service Intelligence Certified Admin
-
Splunk Core Certified Consultant
- Splunk Core Certified Consultant
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Architecting Splunk Enterprise Deployments
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Splunk Deployment Practical Lab
- Splunk Fundamentals 3
- Creating Dashboards with Splunk
- Advanced Searching and Reporting
- Core Consultant Labs
- Services Core Implementation
- Splunk Phantom Certified Admin
-
Courses
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Splunk Fundamentals 3
- Advanced Searching and Reporting
- Creating Dashboards with Splunk
- Advanced Dashboards and Visualizations
- Building Splunk Apps
- Splunk for Analytics and Data Science
- Splunk Infrastructure Overview
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Splunk Cloud Administration
- Transitioning to Splunk Cloud
- Architecting Splunk Enterprise Deployments
- Working with Metrics in Splunk
- Implementing Splunk SmartStore
- Splunk Workload Management
- Splunk Deployment Practical Lab
- Implementing Splunk Data Stream Processor (DSP)
- Developing with Splunk's REST API
- Administering Splunk Enterprise Security
- Using Splunk Enterprise Security
- Implementing Splunk IT Service Intelligence
- Using Splunk IT Service Intelligence
- Splunk User Behavior Analytics
- Administering Phantom
- Developing Phantom Playbooks
- Advanced Phantom Implementation
- Introduction to Splunk IM
- Using Splunk Infrastructure Monitoring
- Kubernetes Monitoring with Splunk
- Using Splunk APM to Monitor Microservices-based Applications
- Automation Using the REST and SignalFlow APIs
- Using the Splunk Terraform Provider
- Sending Custom Metrics to Splunk IM
- Advanced Monitoring of Microservices Applications Using Splunk APM
- Services Core Implementation
- Core Consultant Labs
- IT Essentials Learn - Walkthrough
- Implementing the Splunk App for Infrastructure (SAI)
- Responding to Incidents with Splunk On-Call
- Splunk On-Call Administration
- Introduction to Splunk Observability
- Using Splunk Real User Monitoring
- Using the Splunk Log Observer
-
Videos
- All Videos
- Splunk Cloud Tutorial
- Installing Splunk Enterprise on Linux
- Installing Splunk Enterprise on Windows
- Getting Data In to Splunk Enterprise (Linux)
- Getting Data In (Windows)
- Getting Data In with Forwarders
- Basic Search in Splunk Enterprise
- Create a Dashboard in Splunk Enterprise
- Splunk Certification Candidate Journey
- Creating Alerts in Splunk Enterprise
-
- Program Guide + FAQ
- Download Fact Sheet
Core Consultant Lab Registration
Lab Prerequisites
- Splunk Enterprise Certified Architect
Estimated Lab Duration
- Services Consultant Architect Practice Lab 1 (maximum 3 hours)
- Services Consultant Architect Practice Lab 2 (maximum 4 hours)
- Services Consultant Architect Practice Lab 3 (maximum 4 hours)
- Implementation Fundamentals Practical Lab (maximum 8 hours)
- Distributed Search Migration Lab (maximum 4 hours)
- Indexer Cluster Lab (maximum 4 hours)
Course Description
This package consists of a self-paced eLearning course focused on base configs and best practices for props.conf, along with the following six self-paced labs:
Services Consultant Architect Practice Lab 1
This self-graded lab focuses on the download and installation of Splunk on four hosts. Registrants must configure a single search head, two indexers, and a monitoring console. The indexers should be configured as distributed search peers of the search head and the monitoring console.
Services Consultant Architect Practice Lab 2
This self-graded lab focuses on the configuration of a Splunk universal forwarder and on app installation using a deployment server.
Services Consultant Architect Practice Lab 3
This self-graded lab focuses on the configuration of data forwarding through an intermediate tier of universal forwarders and routing data to specific indexes based on the contents of the raw events.
Implementation Fundamentals Practical Lab
This lab, manually graded by Splunk Education, consists of six modules, as follows:
Module 1 – Establish Deployment Client Connectivity
Module 2 – Identify Data Onboarding Parameters
Module 3 – Define and Deploy Input Specification
Module 4 – Create Search-Time Field Extractions
Module 5 – Build a Dashboard
Module 6 – Submit Work for Grading
Distributed Search Migration Lab
In this self-graded lab, candidates must emulate the process of expanding a Splunk infrastructure from a single all-in-one node to a distributed (multi-indexer, plus search head) configuration.
Indexer Cluster Lab
In this self-graded lab, candidates connect a "pre-existing" infrastructure formed of two unclustered indexers, a search head, and a monitoring console, then migrate this stand-alone structure to take on a new cluster master. The new cluster master will manage the indexers in a newly-formed indexer cluster, connect the search head to the indexers, and manage index replication. Finally, the customer's data must be migrated into the clustered bucket format so that the data can be replicated across the cluster.
Please note: All candidates must be Splunk Enterprise Certified Architects to access the lab bundle.
