“Never become so much of an expert that you stop gaining expertise.” – Denis Waitley
In all professions, and especially information services (IT), success and marketability depends upon an individual’s propensity for continued learning. With Splunk, there exist a number of options for increasing your knowledge and expertise. The following are just a few. We’ll start with the obvious choices:
Certifications,- Formal training,
- Product documentation and
- The company’s website.
Certifications
Similar to most main-stream technologies, Splunk offers various certifications and as of this writing, Splunk categorizes certifications into the following generalized areas:
The Knowledge Manager
A Splunk Knowledge Manager creates and/or manages knowledge objects that are used in a particular Splunk project, across an organization or within a practice. Splunk knowledge objects include saved searches, event types, transactions, tags, field extractions and transformations, lookups, workflows, commands and views. A knowledge manager not only will have a though understanding of Splunk, the interface, general use of search and pivot, etc. but also possess the “big picture view” required extend the Splunk environment, through the management of the Splunk knowledge object library.
The Administrator
A Splunk Administrator is required to support the day-to-day “care and feeding” of a Splunk installation. This requires “hands-on” knowledge of best practices, configuration details as well as the ability to create and manage Splunk knowledge objects, in a distributed deployment environment.
The Architect
The Splunk Architect will include both knowledge management expertise, administration know-how and the ability to design and develop Splunk Apps. Architects must also possess the ability to focus on larger deployments, learning best practices for planning, data collection, sizing and documenting in a distributed environment.
Supplementary Certifications
In addition to these 3 certifications, there are also a number of supplemental certifications that are only available to Splunk Partners.
Partnering
Splunk currently extends an offering based upon level of expertise, experience or interests. You have the ability to become a:
- Powered Associate Partner
- Consulting Partner
- Developing Partner
- Reselling Partner
- Service Providing Partner or a
- Technology Partner
Splunk partners are individuals or organizations that can be an excellent source of knowledge as you progress towards mastering Splunk (eventually, you may want to consider becoming a Splunk Partner yourself). To find out more about the partnering program or to identify a partner, you can use the Splunk website and it is recommended that you establish your own splunk.com account and login to the website as a “returning Splunker”.
Formal Training
The conventional method of Splunk education- instructor-led classes – is offered both virtually and “at your site”. The complete Splunk curriculum is offered once a month and all classes include lots of hands-on exercises focused on:
- Power users
- App development
- Administration
- Architecting
- Security
Product Documentation
The perhaps most-obvious learning option is exploring the actual product documentation. Splunk has done a fine job providing explicit details and working examples that are valuable to all levels of users.
If you go online and visit docs.splunk.com/Documentation/Splunk (and be sure to bookmark it) you will have the choice of select the (Splunk) version that you are interested in and examine (at your own speed and on your own schedule):
- Release notes
- Tutorials on searching, data models and Pivot, etc.
- Administration manuals
- Installation Instructions
- Alerting Manuals
- Dashboard & Visualizations
- Distributed deployments
- Forwarding
- Knowledge Manager
- Module system references
- Pivoting
- API reference
- Search reference
- Trouble shooting
- Developing Views & Aps for Splunk Web
- Distributed Searching
- Getting Data in
- Indexing and Clustering
- Modules System User Manual
- Reporting
- Security
- Updating your instances
www.Splunk.com
The company’s website is online and available 24-7. It is a particularly well done searchable portal to all kinds of Splunk related information that is organized into areas such as:
- Basic product information,
- Solutions,
- Industries,
- Partners,
- About (Splunk),
- Support,
- Services,
- Resources,
- Etc.
Also on the website you will find:
Splunk Answers
Engage with everyone within the Splunk community for fast answers to your Splunk questions.
Splunkbase
A searchable knowledgebase of Splunk Apps, answers and advice and where you can earn points and badges to increase your Splunkbase “rank” – making a name for yourself on the Splunkbase leadership board as your expertise grows (you can also access splunk.com and spunk documentation sites from the location).
The Support Portal
Accessible from the main Splunk website splunk.com (under the menu item “Support”), the support portal is where you can become a “Splunker” by creating a Splunk.com account to:
- Down load Splunk software and updates
- Participate in online forums and submit support issues
- Access and download application guides and whitepapers
- Access future product roadmaps and add comments
- Get technical updates, the SplunkVox newsletter and plenty of other “goodies”
The Splexicon
The word “lexicon” derives from the Greek and means “of or for words”. The Splunk lexicon (or the “Sp-lexicon”) defines all of the technical terms that are specific to Splunk. These definitions include links to related information from within the Splunk product documentation. The Splexicon can be used as an “intelligent interface” to the online Splunk manuals allowing you to quickly lookup Splunk terminology and then quickly access the product documentation details pertaining to that term.
“How-to” Tutorials
As of this writing, the Splunk Education team offers roughly 9 or 10 video instructions with topics including:
- Installing Splunk (on both MS windows and Linux)
- Adding data to Splunk
- Basic searching fundamentals
- Use of fields
- How to saving & share your searches
- Splunk Tags and
- Reports and dashboards
Note: Splunk Education also offers a number of free self-paced eLearning courses that are designed to teach the end-user level features of Splunk through content, simulations, and quizzes. All you need to do is create your own online profile.
User conferences, blogs & news groups
There is an almost endless amount and variety of conferences open to anyone to attend to increase the breadth of ones exposure to Splunk. The most popular is SplunkLive!
SplunkLive is your opportunity to learn more about the most recent announcements, ways to extend the platform, updates on hot topics – such as Splunk delivered in the Cloud, Splunk for Mobile, Splunk Analytics for Hadoop and a brevity Apps available in the Splunk App store SplunkLive always include general sessions, speakers, and detailed breakout sessions
Professional Services
Finally, it’s important to point out that there is always the opportunity to take advantage of the skill and expertise offered by the Splunk professional services team who provide custom services scoped according to your specific requirements. These may include development of applications, implementation of use cases, workshops and design sessions, or other services requiring Splunk-related expertise.
Time to get Splunking!
