Splunk Core Certified Consultant 

About Splunk Core Certified Consultant

The Splunk Core Certified Consultant certification exam is the final step in the Splunk Core Certified Consultant track. This highly technical certification exam evaluates a candidate’s knowledge and skills in Splunk Deployment Methodology and best-practices for planning, data collection, and sizing, managing, and troubleshooting a standard with indexer and search head clustering. This certification demonstrates a Consultant's ability to properly size, install, and implement Splunk environments and to advise others on how to utilize the product and maximize its value for their needs. 

A Splunk Core Certified Consultant has a knowledge and understanding of Splunk Deployment Methodology and implementation in large Splunk installations and has expert-level knowledge of multi-tier Splunk architectures, clustering, and scalability topics. 

Required Prerequisite Certification:

• Splunk Enterprise Certified Admin
• Splunk Core Certified Power User
• Splunk Enterprise Certified Architect

Recommended Prerequisite Courses

Candidates for the exam are recommended to complete the lecture, hands-on labs, and quizzes that are part of the course which are:

• Fundamentals 3
• Creating Dashboards with Splunk
• Advanced Searching and Reporting courses by Splunk Education
• Core Consultant labs
• Services: Core Implementation Instructor-Led Training course

Important Learning Skills 

The following content areas are general guidelines for the content to be included on the exam:

• Splunk Validated Architectures
• Monitoring Console configuration
• Authentication Protocols
• Splunk to Splunk (S2S) Communication
• Data Inputs
• Forwarder Types
• HEC Tokens
• Fishbucket Records
• Pretrained Sourcetypes
• Indexing Buckets
• Event Processing
• Indexing Intervals
• Data Retention
• Search Head Dispatch
• Sub-searches
• Deployment Apps
• Deployment Server
• Indexer Clustering
• Upgrading an Indexer Cluster
• Indexer Cluster Failure Modes
• Multi-site Clustering
• Indexer Migration
• Search Head Clustering

Course Structure

Topic 1: Deploying Splunk 5%

1.1 Define Splunk Validated Architectures

1.2 Articulate how and why Splunk grows from standalone environment to distributed environment with indexer and Search Head clustering

1.3 Explain the difference between High Availability and Disaster Recovery and how both can be addressed in Splunk.

Topic 2: Monitoring Console 8%

2.1 Describe which instances are suitable to configure as the Monitoring Console

2.2 Articulate how to configure the MC for a single or distributed environment

2.3 Examine how the MC uses the server roles and groups

2.4 Describe how MC health checks are performed and can be extended.

Topic 3: Access and Roles 8%

3.1 Identify authentication methods

3.2 Describe LDAP concepts and configuration

3.3 List SAML and SSO options

3.4 Define roles and articulate how roles are used to secure data

Topic 4: Data Collection 15%

4.1 Articulate the different ways data can be ingested by an indexer

4.2 Articulate how one Splunk instance communicates with another Splunk instance (S2S)

4.3 Describe the types and configuration of data inputs

4.4 Describe ways to troubleshoot data inputs

Topic 5: Indexing 14%

5.1 List indexing artefacts and locations

5.2 Describe event processing and data pipelines

5.3 Describe the underlying text parsing and indexing process

5.4 List data retention controls

Topic 6: Search 14%

6.1 Describe how to use search job inspection, Explain the inner-workings of a search

6.2 List the different search types

6.3 Describe how to maximize search efficiency

6.4 Describe how sub-searches work

Topic 7: Configuration Management 8%

7.1 Describe a deployment app

7.2 Articulate how a Deployment Server works

7.3 Describe deployment system configuration

7.4 Articulate how to manage deployment Server

Topic 8: Indexer Clustering 18%

8.1 Describe deployment and component configuration

8.2 Describe the life cycle of data using buckets

8.3 Determine failure modes and recovery processes

8.4 Articulate how multi-site clustering works

8.5 List migration procedures

Topic 9: Search Head Clustering 10%

9.1 Articulate how to manage and deploy a Search Head cluster

9.2 Determine when a Search Head Cluster may be needed and when a Search Head Cluster would not be recommended

9.3 Describe content management using the Deployer

9.4 Describe the role of the cluster members and the Captain

9.5 Articulate how Captain election works (RAFT)

Exam Pattern 

• Exam Name: Splunk Core Certified Consultant
• Number of Questions: 86 Questions
• Length of Time:  120 minutes
• Exam Language: English
  

What do we offer?

• Full-length mock test with unique questions in each test set
• Practice objective questions with section-wise scores
• An in-depth and exhaustive explanation for every question
• Reliable exam reports evaluating strengths and weaknesses
• Latest Questions with an updated version
• Tips & Tricks to crack the test
• Unlimited access

What are our Practice Exams?

• Practice exams have been designed by professionals and domain experts that simulate real time exam scenario.
• Practice exam questions have been created on the basis of content outlined in the official documentation.
• Each set in the practice exam contains unique questions built with the intent to provide real-time experience to the candidates as well as gain more confidence during exam preparation.
• Practice exams help to self-evaluate against the exam content and work towards building strength to clear the exam.
• You can also create your own practice exam based on your choice and preference 

100% Assured Test Pass Guarantee

We have built the TestPrepTraining Practice exams with 100% Unconditional and assured Test Pass Guarantee!