Splunk Cloud Certified Admin
The Splunk Cloud Certified Admin exam is designed for individuals responsible for managing and configuring Splunk Cloud. This includes handling data inputs, forwarder setup, user accounts, basic monitoring, and troubleshooting. Whether you’re new to Splunk administration or transitioning to Splunk Cloud, this certification strengthens your skills in core management and configuration tasks, from data input and forwarder setup to monitoring and isolating issues, giving you a solid operational foundation.
Exam Prerequisite
To qualify for this certification, you must first complete the Splunk Core Certified Power User exam.
Who should consider this exam?
Whether your organization is newly adopting Splunk Cloud or transitioning from an on-prem setup, this certification is your path to proving expertise as a Splunk Cloud administrator.
- Career Growth Seekers: Elevate your career by achieving a certification that establishes you as a skilled Splunk professional, ready for advancement.
- Platform Administrators: Strengthen your credentials as a platform administrator, showcasing your proficiency in managing the Splunk Cloud environment.
- Cloud Migration Specialists: Transition confidently to Splunk Cloud while securing your role as a valuable asset within your organization.
Exam Details
The Splunk Cloud Certified Admin exam is a professional-level certification requiring the Splunk Core Certified Power User as a prerequisite. The exam consists of 60 multiple-choice questions, has a 75-minute time limit, and is administered through our testing partner, Pearson VUE.
Course Outline
The topics listed below provide a general overview of content likely to be covered on the exam; however, related subjects may also be included in specific versions of the exam. The topics for the Splunk Cloud Certified Admin exam are:
1.0 Splunk Cloud Overview 5%
1.1 Describe Cloud topology
1.2 Describe tasks managed by the Splunk cloud administrator (Splunk Documentation: Admin tasks with Splunk Web)
1.3 List the primary differences between Splunk Cloud and Splunk Enterprise (Splunk Documentation: Splunk Enterprise VS Splunk Cloud)
1.4 List differences between Self-Service Cloud and Managed Cloud (Splunk Documentation: Fundamental Splunk and Splunk Cloud Platform concepts)
2.0 Index Management 5%
2.1 Define a Splunk index (Splunk Documentation: Indexes, indexers, and indexer clusters)
2.2 Create indexes in cloud (Splunk Documentation: Manage Splunk Cloud Platform indexes)
2.3 Delete data from an index (Splunk Documentation: Remove indexes and indexed data)
2.4 Monitor indexing activities (Splunk Documentation: Use the Indexing dashboards)
3.0 User Authentication and Authorization 5%
3.1 Administer Splunk user roles (Splunk Documentation: Configure users and roles)
3.2 Integrate Splunk with LDAP, Active Directory, or SAML (Splunk Documentation: Securing Splunk Enterprise)
4.0 Splunk Configuration Files 5%
4.1 Review Splunk configuration files and directories (Splunk Documentation: Configuration file directories)
4.2 Review configuration file precedence (Splunk Documentation: Configuration file precedence)
4.3 Review index and search time processes (Splunk Documentation: Optimize indexing and search processes)
5.0 Getting Data in Cloud 15%
5.1 List Splunk forwarder types (Splunk Documentation: Types of forwarders)
5.2 Describe the role of forwarders
5.3 Configure a forwarder to Splunk Cloud (Splunk Documentation: Deploy the universal forwarder)
5.4 Test the forwarder connection
5.5 Describe optional forwarder settings (Splunk Documentation: Types of forwarders)
6.0 Forwarder Management 5%
6.1 Describe Splunk Deployment Server (Splunk Documentation: Deployment server architecture)
6.2 Explain the use of forwarder management (Splunk Documentation: Forwarder management overview)
6.3 Configure forwarders to be deployment clients (Splunk Documentation: Configure deployment clients)
6.4 Managing forwarders using deployment apps (Splunk Documentation: Use forwarder management to manage apps)
7.0 Monitor Inputs 15%
7.1 Describe the Splunk process for inputting data
7.2 Create file and directory monitor inputs (Splunk Documentation: Monitor files and directories)
7.3 Use optional settings for monitor inputs
8.0 Network and Other Inputs 10%
8.1 Create network (TCP and UDP) inputs (Splunk Documentation: Configure inputs using TCP or UDP)
8.2 Create a basic scripted input (Splunk Documentation: Setting up a scripted input)
8.3 Describe optional settings for network inputs
8.4 Identify Windows input types and uses
8.5 Use the HTTP Event Collector (HEC) to get data into Splunk (Splunk Documentation: Set up and use HTTP Event Collector in Splunk Web)
9.0 Fine-tuning Inputs 5%
9.1 Describe the default processing that occurs during the input phase (Splunk Documentation: How data moves through Splunk deployments: The data pipeline)
9.2 Configure input phase options, such as sourcetype fine-tuning and character set encoding (Splunk Documentation: Configure character set encoding)
10.0 Parsing Phase and Data Preview 10%
10.1 Describe the default processing that occurs during parsing (Splunk Documentation: How indexing works)
10.2 Optimize and configure event line breaking (Splunk Documentation: Configure event line breaking)
10.3 Explain how timestamps and time zones are extracted or assigned to events (Splunk Documentation: How timestamp assignment works)
10.4 Use Data Preview to validate event creation during the parsing phase
11.0 Manipulating Raw Data 10%
11.1 Explain how data transformations are defined and invoked (Splunk Documentation: Use the Field transformations page)
11.2 Use transformations with props.conf and transforms.conf to modify raw data (Splunk Documentation: transforms.conf)
11.3 Use SEDCMD to modify raw data (Splunk Documentation: Anonymize data)
12.0 Installing and Managing Apps 5%
12.1 Review the process for installing apps (Splunk Documentation: Review your apps and add-ons)
12.2 Describe private apps (Splunk Documentation: Manage private apps on your Splunk Cloud Platform deployment)
12.3 Describe how apps are managed (Splunk Documentation: Managing app and add-on configurations and properties)
13.0 Working with Splunk Cloud Support 5%
13.1 Isolate problems before contacting Splunk Cloud Support
13.2 Define the process for working with Splunk Cloud Support
Splunk Cloud Certified Admin: FAQs
Splunk Certification Candidate Handbook
The Splunk Certification Candidate Handbook is a valuable resource for anyone pursuing a Splunk certification. It provides comprehensive information on the certification process, from understanding exam formats to knowing the eligibility requirements and policies. This guide offers insights into what to expect before, during, and after the exam, helping candidates feel prepared and informed. Additionally, it covers key guidelines on retakes, recertification, and the steps to schedule exams, making it essential for those looking to navigate the certification journey smoothly and with confidence.
Splunk Cloud Certified Admin Exam Study Guide
1. Understanding the Exam
Before diving into the study material, it’s crucial to understand the exam format and content. Familiarize yourself with the Splunk Cloud Certified Admin exam blueprint, which outlines the specific topics and their weightage. This will help you prioritize your study efforts.
2. Use Splunk Documentation
The Splunk Documentation is a comprehensive resource that provides in-depth information on various aspects of the Splunk platform. It covers a wide range of topics, from basic concepts to advanced administration and development. This documentation is invaluable for both beginners and experienced Splunk users. The documentation is well-organized and easy to navigate, with clear explanations, step-by-step instructions, and practical examples. It includes detailed information on data ingestion, search processing language (SPL), data modeling, visualization, alerting, and security. Additionally, it provides guidance on configuring and managing Splunk Enterprise and Splunk Cloud deployments.
3. Splunk Training
Splunk offers a comprehensive training program to equip individuals with the skills needed to effectively utilize its platform. This training program caters to a wide range of users, from beginners to advanced administrators and developers. Splunk provides both self-paced and instructor-led training options. Self-paced training includes a variety of online courses, tutorials, and documentation that can be accessed at your convenience. These resources cover fundamental concepts, advanced techniques, and specific use cases. Instructor-led training, on the other hand, provides a structured learning experience with hands-on exercises and expert guidance. The courses are:
- Splunk Cloud Administration: This course is specifically designed for new Splunk Cloud administrators. It covers the core concepts and skills needed to manage a Splunk Cloud instance.
- Transitioning to Splunk Cloud: This course is for experienced Splunk Enterprise administrators who are transitioning to Splunk Cloud. It highlights the key differences between the two platforms.
4. Join Study Groups
Joining study groups can be incredibly beneficial for preparing for the Splunk Cloud Certified Admin exam. Study groups allow candidates to collaborate, share knowledge, and discuss key topics like data inputs, forwarder configurations, monitoring, and problem-solving in Splunk Cloud. These groups foster an interactive learning environment where members can exchange exam tips, clarify complex concepts, and tackle challenging areas together. Connecting with others also builds motivation, accountability, and provides access to diverse perspectives, ultimately enhancing readiness and confidence for exam day.
5. Take Practice Tests
Taking practice tests is an essential strategy for preparing for the Splunk Cloud Certified Admin exam. These tests help familiarize candidates with the exam format and types of questions they may encounter, allowing for effective time management and pacing during the actual exam. By simulating real exam conditions, practice tests enable candidates to identify their strengths and weaknesses, focus their study efforts on challenging areas, and build confidence in their knowledge of Splunk Cloud concepts. Regularly assessing progress through practice tests can significantly enhance retention of information and improve overall performance, making them a crucial component of a comprehensive study plan.
