Hi @venal,
Experience querying and pivoting relational data provides a solid foundation for analyzing data in Splunk; however, Splunk data is stored as a time series and streamed to clients as events. "Splunk SPL for SQL Users" is a good starting point, although it can lead to bad habits if not supplemented by other documentation and formal training.
If you're a database administrator with combined Microsoft SQL Server and Microsoft Windows experience, you'll find many parallels between how a Microsoft SQL Server failover cluster is managed and how a simple Splunk Enterprise indexing cluster is managed; however, the product architectures diverge very quickly.
Experience with Microsoft Windows and a server-oriented Linux distribution, e.g. Red Hat Enterprise Linux, are important for supporting Splunk Enterprise on-premises or in a self-managed hybrid/cloud environment. If your target is Splunk Cloud, operating system experience is still required to effectively support Splunk Universal Forwarder on endpoints/servers and Splunk Enterprise configured as a heavy forwarder.
Splunk administrators install, configure, and maintain all aspects of Splunk Enterprise or configure and maintain customer-accessible aspects of Splunk Cloud.
A Splunk "developer" can be a content developer (searches, reports, and dashboards), an app developer (add-ons and technology integrations), a back-end developer (primarily web services), a front-end developer (Splunk SDK and third-party clients), or any combination of the four.
Splunk certification paths are published at https://www.splunk.com/en_us/training/certification.html.
The Splunk Success Framework describes the typical roles associated with Splunk deployments and provides corresponding learning paths: https://lantern.splunk.com/Splunk_Success_Framework/People_Management/Setting_roles_and_responsibili...
