Candi dat e Handbook - v. 03. 03. 2022 - Splunk

1 Candidate Handbook - v. Splunk Brannan Francisco, CERTIFICATIONC andidate HandbookTable of ContentsProgram Certification the Results/Digital Accommodations Certification A(Certification Track Details)..29 Appendix B(Exam Development Process)..40 Appendix C( Splunk Policies and Terms of Use)..41 Appendix D(Pearson VUE Facial Comparison Policy)..42 Splunk Certification |Candidate Handbook (link totop)1 PROGRAM INTRODUCTIONH ello and welcome to Splunk Certification. This Handbook is designed as a comprehensive resource forcandidates looking to learn more about the program, to gain understanding about our policies andprocedures, and to select the certification track of their should I get Splunk Certified?To put it plainly: Splunk Certification are Splunk Certified earn anaverage of16%morethan their uncertified peers. Organizations whoinvest in Splunk Certification earnfaster time tovalueand are more likely to renewand CERTIFICATION OFFERINGSW hich path is right for me?

2 Great question. We have a fulldeckof program offerings,but the basics are provided here. Organizationslooking tohirecandidates with any of these skillscan check out ourSplunk Earner Directoryfor ProductsSplunk Core Certified UserPerforms basic searches, uses fields,creates alerts, uses look-ups, andcreates basic statistical reports EnterpriseSplunk CloudSplunk Core Certified Power UserUnderstands SPL searching andreporting commands and createsknowledge objects, uses field aliasesand calculated fields, creates tags andevent types, uses macros, createsworkflow actions and data models, andnormalizes data with the CommonInformation EnterpriseSplunk CloudSplunk Core Certified Advanced Power UserAuthors complex searches andreporting commands, implementsadvanced use cases of knowledgeobjects, and understands bestpractices for building dashboards EnterpriseSplunk CloudSplunk Cloud Certified AdminManages and configures details forSplunk Cloud.

3 Including data inputsand forwarder configuration, datamanagement, user accounts, andbasic monitoring and problem CloudSplunk Certification |Candidate Handbook (link totop)2 CertificationSkillsRelated ProductsSplunk Enterprise Certified AdminManages various components ofSplunk Enterprise on a daily basis,including license management,indexers and search heads,configuration, monitoring, and gettingdata into EnterpriseSplunk Enterprise Certified ArchitectUnderstands Splunk DeploymentMethodology and best-practices forplanning, data collection, and sizing fora distributed and troubleshoots a standarddistributed deployment with indexerand search head EnterpriseSplunk Core Certified ConsultantUnderstands Splunk DeploymentMethodology and implementation inlarge Splunk installations and hasexpert-level knowledge of multi-tierSplunk architectures, clustering, andscalability EnterpriseSplunk Certified DeveloperBuilds apps using the Splunk EnterpriseSplunk Enterprise Security Certified AdminManages a Splunk Enterprise Securityenvironment, including ES eventprocessing and normalization,deployment requirements, technologyadd-ons, settings, risk analysissettings, threat intelligence andprotocol intelligence configuration, ESSplunk IT Service IntelligenceInstalls and configures Splunk 's appfor IT Service Intelligence (ITSI),including ITSI architecture, deploymentplanning, service design andimplementation, notable events, anddeveloping glass tables and ITSIS plunk SOAR Certified Automation Developer*Installs, configures, and uses SOAR servers and plans, designs, creates,and debugs basic playbooks forSplunk SOAR.

4 Understands complexSOAR solution development, and canintegrate SOAR with Splunk as well asdevelop playbooks requiring customcoding and REST API SOAR*Formerly referred to as Splunk Phantom Certified AdminPlease visitAppendix Afor the full requirementsof each certification path listed above, including links todownload the test blueprints and certification track flowcharts. This information is also readily available For sample test questions, pleasesee ourSplunk Certification Exams Certification |Candidate Handbook (link totop)3 CERTIFICATION CANDIDATE REQUIREMENTSAs part of our program s partnership with PearsonVUE, all exam registrants must adhere to a fewuniversal guidelines (no exceptions):Must have a account/username, linked to a valid, current email create an account with : the name usedfor exam registration must match the full name on the candidate s photo be at least 18 years of age.

5 Candidates age 13-17 who wish to participate must provide asignedparental acknowledgement pay the registration fee of $125 USD per exam attempt (or $500 USD for 5 examregistrations).As of February 28, 2022, the priceof a single registration will increase to$130 USD per exam provide valid photo IDanda second form of identificationshowing legal name ( creditcard, military ID, student ID, etc.) at the time of exam. To view the full ID policy, please agree to Splunk Certification Agreement (see page 13, also foundhere).Must agree to the Pearson VUE Candidate Rules Agreement (foundhere).Candidates who wish to schedule an exam appointment using the online portal must agree to thePearson VUE Facial Recognition Policy. SeeAppendixDfor more proctoring candidates must meet the PearsonVUE system requirements (available ). Splunk Certification |Candidate Handbook (link totop)4 EXAM REGISTRATIONWhen you re ready to take a Splunk Certification exam, please see ourExam Registration Tutorialforregistration a reminder, as of February 28, 2022, each exam attempt costs $130 USD.

6 Bulk registration voucherscan be purchased at a discounted price of five registrations for $500 are three ways to purchase a PearsonVUE registration from is the most streamlinedapproach. Follow the steps for accountcreation and exam registration provided will becollected at the time of registration. You can also visit the Pearson VUEvoucher storefor Splunk (as an individual).Log into your existingaccount at topurchase a registration code. Payment can be made via credit card or existing Splunk Educationcredits. Splunk will email you a unique registration code, which can be used for registration Splunk (as an account). Splunk Sales Reps canadd certification exams to any the number of vouchers has been requested, Splunk will email your unique registrationcodes, which can be used for registration scheduled exams are subject to a minimum 48-hour cancellation and/or rescheduling policy.

7 Failure tocancel or reschedule an exam within this timeframe results in forfeiture of registration refer to the PearsonVUEFAQ pagefor more Certification |Candidate Handbook (link totop)5 TAKING THE EXAMT here are two options for taking an exam through )In-person at a Pearson Test )At home via online proctor*. Splunk Certification exams arenotopen-note. Thismeans that any reference material (notes, coursedocumentation, access to Splunk Docs or Splunk Answers, etc.) is strictly prohibited. Both on-site andonline proctors are trained to identify unauthorized materials or perceived violation oftheclosed-book policy will result in automatic failure and forfeiture of registration Certification Exams Study Guide, alongwith Splunk Education course materials, is your bestresource for exam preparation and includes sample test questions for most of the exams and links to thetest blueprints, which provide detailed information on exam exam times include 3 minutes to review theSplunkCertification Agreement.

8 All candidates mustaccept the agreement within the testing platform prior to the 3-minute timer or the test session will beterminated. For this reason, we strongly encourage candidates to review the agreement prior to theirexam appointment. Both onsite and online exams will provide candidates with a running clock for timemanagement purposes. Candidates are responsible for managing their time more information regarding exam length and seat time, the exam, candidatescanmark questions Flagfor Review , go back to previously answeredquestions, and will have a final opportunity to review all answers prior to submitting the exam for submitted, all scores are considered final.*Please note - candidates who opt for online proctoring must complete (and pass) a SYSTEM TEST from the same computer andlocation which will be used for the exam prior to exam day. Administrative rights on the computer are required to download thesoftware.

9 The system test is available via: your system does not meet therequirements, please register to take the exam at a testing center. If your computer is found not to meet requirements and you havemissed the 24-hour cancellation window, you are unlikely to receive a refund. Please readthis overviewpriorto scheduling an examvia online Certification |Candidate Handbook (link totop)6 EXAM RESULTS/SCORE REPORTINGI mmediately after submitting the exam, the candidate s results (pass or fail) will be displayed. Forcandidates testing onsite, a printout of these results will be provided by the on-site proctor. Candidatestesting via online proctoring will not receive a hard copy of their results, but will have the option to print ascore report via their Pearson online (both onsite and online) who pass the exam will not receive any additional feedback regardingexam candidates(both onsite and online) canaccess additional information (including sectionfeedback) via their Pearson online account.

10 A question-by-question analysis willnotbe who believe they have discovered an error in exam content or believe that a specific questionon a Splunk Certification exam is invalid can report this information via ourExam Challenge BADGINGC andidates who pass the exam will also receive, via email, adigital badgefor use in an email signature,on networking/social media sites ( LinkedIn), or for professional qualification verification purposes( HireRight or other recruiting agencies).Digital badges are unique to the candidates who earn them and cannot be altered, edited, or shared. Thismeans your digital badges areyours(not your company sor organization s).For this reason, we highlyrecommend using your personal/permanent email address for your Credly meansthat, regardless of your career path or employer, you always have access to your digital badges. You canadd additional email addresses to your account, as well as many as you more information on your digital badging account, please Certification |Candidate Handbook (link totop)7 RETAKE POLICYC andidates who do not pass an exam on their first attempt must wait 7 days to retake the exam.