Hi @kzjbry  This means that the modules that make up the course have no cost (ie Free), however the exam is $130USD. See https://www.splunk.com/en_us/training/certification-track/splunk-core-certified-power-user.html for more info. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @irisywang  You will need to contact [email protected] and they should be able to help you. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Kobi998  From my memory from recertifying at the start of the year its mainly based on ES7 and the 'concepts' so not always version specific. That said if you're familiar with either 7 or 8 you shouldnt have too much trouble with it.  Its worth noting that this is now a legacy exams (see https://www.splunk.com/en_us/pdfs/training/splunk-certification-changes.pdf) and instead I would recommend persuing: Splunk Certified Cybersecurity Defense Analyst and Splunk Certified Cybersecurity Defense Engineer 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing     ... View more

Hi @farinaahmedkhan  Links to internal/non-public Splunk systems shouldnt be posted here, however searching for 'Sales Rep l' in the Learning system (linked from Partner Portal) works for me. It might help to select 'Series' from the Filters section on the left. If you're struggling I would recommend reaching out to your partner manager as you might not have access. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Jackie1  You will need to speak with ManTech to find out what agreements they have with Splunk for free/paid for training. To get started you probably want to look at the User Certification - check out https://www.splunk.com/en_us/training/certification-track/splunk-core-certified-user.html for more information on this. In the meantime, you can start today by looking at the free courses available at https://www.splunk.com/en_us/training/free-courses/overview.html which create a foundation required to take on the further paid-for training and certification tracks. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @MikeKeddie  I would recommend looking into Splunk4Rookies and the content it covers, that is often used as a starter and can take a couple of hours. If there is time remaining you could look at things like Dashboard Studio and talk about how to create dashboards, including going into more details about the different types of searches. 3 hours isnt really enough to teach a group but that would be a good start, there are also free training courses at https://www.splunk.com/en_us/training/free-courses/overview.html  which you could go through together maybe? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Sneha_1  You can create a new account using the following URL: https://idp.login.splunk.com/signin/register Note, you will probably need to complete the User and Power user exam certifications before you're able to do the Certified Admin exam. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Ananyabachan  How does your app generate the logs? Is this to a file on your server or do you send this from the client/server to a remote endpoint? If the latter then HEC might be a good option for this, however if it logs to a file on disk then you should probably look at creating a "monitor" stanza in your Universal Forwarder (UF) to pick up these files. See https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.4/get-data-from-files-and-directories/monitor-files-and-directories-with-inputs.conf for more info. Splunk usually does a pretty good job of parsing JSON logs so I'd start by setting this up and then start searching the data in Splunk UI to get a feel for how you might like to present it. Ultimately the searches required for your dashboard will depend entirely on the fields within the data. I'd recommend checking out the Splunk tutorial (https://help.splunk.com/en/splunk-enterprise/get-started/search-tutorial/10.0/introduction/about-the-search-tutorial) if you are new to Splunk and also checking out the free training courses as this is great place to start learning how to write the searches you will need (https://www.splunk.com/en_us/training/free-courses/overview.html) 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Kevin_Brian  For the Splunk Certified Cybersecurity Defense Engineer (SPLK-5002) exam I would recommend checking out the track details at https://www.splunk.com/en_us/pdfs/training/splunk-certified-cybersecurity-defense-engineer-track.pdf and also the blueprint at https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-cybersecurity-defense-engineer.pdf as this contains all the details about what will be tested and the split of marks across each section. There are no Splunk-provided sample exam questions for this exam, but hopefully the above info helps!   Please be wary of external website offering sample questions, these come with a number of complications due to being potentially incorrect questions/answers (you dont want to learn the wrong answers by copying someone elses homework!) but also this would be a breach of the Exam Terms and Conditions (see section 4.5) and could mean revocation of your certification. Lastly, good luck! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @sankardevarajan  Please be wary of external website offering sample questions, these come with a number of complications due to being potentially incorrect questions/answers (you dont want to learn the wrong answers by copying someone elses homework!) but also this would be a breach of the Exam Terms and Conditions (see section 4.5) and could mean revocation of your certification. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing cc @exam-dev-staff2  ... View more

Excellent - congratulations @sankardevarajan  🙂   ... View more

Hi @sankardevarajan  Ultimately you are provided the study materials when doing the training modules recommended for SOC Administrator roles using ES: https://www.splunk.com/en_us/training/course-catalog.html?sort=Newest&filters=filterGroup4SplunkEnterpriseSecurity%2CfilterGroup3SOCAdministrator For self-study, I'd recommend using the official Splunk Enterprise Security Certified Admin Exam Blueprint which lists all tested topics and recommended learning paths - this will help focus on which areas are covered in the exam and allow you to tick off what you've learnt. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @sankardevarajan  For practicing and taking mock tests before your Splunk Certified Admin Exam, here are some recommended sites and resources: Splunk Certified Admin Exam Blueprint - https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-enterprise-admin.pdf - This has a great breakdown of the kind of things which will be asked - showing the split of marks available against various areas.    Splunk Certified Admin Track - https://www.splunk.com/en_us/pdfs/training/splunk-enterprise-certified-admin-track.pdf - This shows the pre-reqs and further info about what to expect and what is required.   You can also check out the Splunk YouTube for some useful videos that might help! http://splk.it/How-To   There are no Splunk-provided sample exam questions for this exam, but hopefully the above info helps!   Please be wary of external website offering sample questions, these come with a number of complications due to being potentially incorrect questions/answers (you dont want to learn the wrong answers by copying someone elses homework!) but also this would be a breach of the Exam Terms and Conditions (see section 4.5) and could mean revocation of your certification. Lastly, good luck! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Praz_123  When you click on Session Details for the top two sessions does it give you any further options?  Is there any particular reason you havent done the "optional" session? Its worth doing this to get the best value out of your course.  If this does not get you anywhere then I think the best option would be to email [email protected] with your query as they may not see your question on here. They should be able to advise how to get this resolved for you. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @mrbugs  This is an automatic process, so either the stack has failed to be built and thus not triggered, or the email was sent and wasnt received (e.g. bounced by your provider or in Spam folder).  Please can you double check your Spam folder and if you have nothing then please contact either Splunk Support or Sales  There are additional contact methods at https://www.splunk.com/en_us/about-splunk/contact-us.html where someone from within Splunk should be able to investigate this for you. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @judoka  Check out https://www.splunk.com/en_us/pdfs/training/how-to-view-your-splunk-certifications.pdf for details on how to get your PDF Certificate, this can be printed out and is a "proper" certificate, not an exam history or score card.  Instructions for Customers: 1. Log into your splunk.com account. 2. Click Support > Support Portal. 3. Click Get Started > Certifications. Status column shows Active (current) vs. Inactive (expired). Certificate and Badges columns show options for download. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @CindyGrisby  Congrats on passing your Splunk Enterprise Certified Architect exam.   Please be wary of external website offering sample questions, these come with a number of complications due to being potentially incorrect questions/answers (you dont want to learn the wrong answers by copying someone elses homework!) but also this would be a breach of the Exam Terms and Conditions (see section 4.5) and could mean revocation of your certification. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing cc @exam-dev-staff2  ... View more

Hi @bradnoris26  For practicing and taking mock tests before your Splunk 1005 exam, here are some recommended sites and resources: Splunk Cloud Certified Admin Exam Blueprint - https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-cloud-admin.pdf - This has a great breakdown of the kind of things which will be asked - showing the split of marks available against various areas.    Splunk Cloud Certified Admin Track - https://www.splunk.com/en_us/pdfs/training/splunk-core-certified-consultant-track.pdf - This shows the pre-reqs and further info about what to expect and what is required. You can also find an overview of the areas covered at https://www.splunk.com/en_us/pdfs/training/splunk-cloud-certified-admin-track.pdf   You can also check out the Splunk YouTube for some useful videos that might help! http://splk.it/How-To   There are no Splunk-provided sample exam questions for this exam, but hopefully the above info helps!   Please be wary of external website offering sample questions, these come with a number of complications due to being potentially incorrect questions/answers (you dont want to learn the wrong answers by copying someone elses homework!) but also this would be a breach of the Exam Terms and Conditions (see section 4.5) and could mean revocation of your certification. Lastly, good luck! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @ezamit  You could look at signing up to https://preview.dev.splunk.com/ - This has links to SCDE (Splunk Cloud Developer Edition), however I believe new registrations are currently closed but hopefully once you have access to the preview site you will be notified when this is open. Once you have access you can login to SCDE at https://edition.dev.splunk.com/ 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @MyFairLady  If it helps I got some previously the same day and the request must be sent at least 24 hours before the the training credits are due to expire. For more info check out https://www.splunk.com/en_us/pdfs/training/splunk-certification-candidate-handbook.pdf 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @CooperRay  For practicing and taking mock tests before your Splunk 1005 exam, here are some recommended sites and resources: Splunk Cloud Certified Admin Exam Blueprint - https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-cloud-admin.pdf - This has a great breakdown of the kind of things which will be asked - showing the split of marks available against various areas.    Splunk Cloud Certified Admin Track - https://www.splunk.com/en_us/pdfs/training/splunk-core-certified-consultant-track.pdf - This shows the pre-reqs and further info about what to expect and what is required. You can also find an overview of the areas covered at https://www.splunk.com/en_us/pdfs/training/splunk-cloud-certified-admin-track.pdf   You can also check out the Splunk YouTube for some useful videos that might help! http://splk.it/How-To   There are no Splunk-provided sample exam questions for this exam, but hopefully the above info helps!   Please be wary of external website offering sample questions, these come with a number of complications due to being potentially incorrect questions/answers (you dont want to learn the wrong answers by copying someone elses homework!) but also this would be a breach of the Exam Terms and Conditions (see section 4.5) and could mean revocation of your certification. Lastly, good luck! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @bsirisha  The error "command not found" for vim indicates that the vim text editor is either not installed on your Google Cloud instance or is not in the system's PATH for the user you are logged in as. This is a standard Linux operating system issue, not specific to Splunk. You might find that other tools such as "vi" or "nano" are installed instead of vim, but if you wish to install vim specifically then you might find the following guide helpful: Check if vim is installed: Open your terminal and run which vim. If it returns a path (like /usr/bin/vim), it's installed. If not, you'll likely get the "command not found" error again. Install vim (if not installed): Use your distribution's package manager. For Debian/Ubuntu-based systems (like many Google Cloud images), use: sudo apt-get update sudo apt-get install vim For RHEL/CentOS/Fedora-based systems, use: sudo yum update sudo yum install vim You will need sudo privileges to install software. Locate Splunk configuration files: Splunk configuration files (.conf files like inputs.conf, outputs.conf, etc.) are located within the Splunk installation directory, typically under $SPLUNK_HOME/etc/. The most common locations for local configurations are: $SPLUNK_HOME/etc/system/local/ (for system-wide settings) $SPLUNK_HOME/etc/apps/<app_name>/local/ (for app-specific settings) The default $SPLUNK_HOME is /opt/splunk. Navigate and edit files: Once vim is installed and you know the location, navigate to the directory and use sudo vim to edit the file, as configuration files are often owned by the splunk user or root. Always make a backup of configuration files before editing them. After editing Splunk configuration files, you often need to restart Splunk or reload the deployment server/client for changes to take effect. For more information on Splunk configuration files and their locations, refer to the Splunk documentation. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @Brackia_Jackson  Congrats on completing the exam - however using unauthorised materials violates Splunk’s exam policies and can result in disqualification or revocation of certifications. My advice to anyone else would be to avoid these - not only are you using copyright material, but there is also no guarantee the answers these sites provide are even correct!  There are no official practice papers for the exams, however I have always found that reviewing the blueprints such as  (https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-es-admin.pdf) is always a good starting point as this tells you what is covered in each area, and the weighting of the scores, so it can help you prioritise revision and highlight any areas you might want to focus on. Other than that, hands-on experience always helps. This will help with some of the muscle-memory type questions such as how to find certain parts of the system, how things connect together etc. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @ajitabh  You might have resolved this but just incase, or if its useful for others in the future, there is a really useful PDF provided by the education team at https://www.splunk.com/en_us/pdfs/training/how-to-view-your-splunk-certifications.pdf which shows the current process for retrieving your certificate. TLDR: If you are a Partner you can download them from https://splunk.my.site.com/partner/s/credentials If you are not a partner visit: https://splunk.my.site.com/customer/s/list-views/certifications If you have any issues then [email protected] is your best contact. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more