Thanks, I am going to check this out. ... View more

Thanks @sleclerc1 !  Thanks for these tips! How's the performance impact of this on 600k users? Good point about testing with Graph Explorer. I unpacked the SPL and found that py script to dig into.  ... View more

It depends. When you get to the higher certs, yes.  One example: Splunk Enterprise Certified Architect requires 4 Splunk courses and previous Splunk Enterprise Certified Admin.  But if you're starting out, you can obtain Splunk Core Certified Power User with no required prereqs, you can self study however you want and no official Splunk courses are required. Once you obtain Power User, you can proceed to take the exam for Splunk Certified Enterprise Admin without any Splunk courses, either. The handbook already called out in this thread is the best resource I found that explains it all by cert, especially Appendix A. https://www.splunk.com/pdfs/training/Splunk-Certification-Candidate-Handbook.pdf ... View more