Splunk Core Certified Consultant Practice Exam

The Splunk Core Certified Consultant exam equips individuals with a deep understanding of Splunk deployment methodologies, multi-tier Splunk architectures, clustering, and scalability. As a Splunk Core Certified Consultant, you'll possess the expertise to accurately size, install, and implement Splunk environments. This encompasses advanced-level knowledge and the capability to offer guidance on maximizing the effectiveness of these solutions.

Who should take the exam?

This exam is ideal for individuals who aspire to excel in Splunk consulting, offering an unparalleled array of practical labs and a week-long bootcamp to hone both technical and soft skills necessary for success in the upper Splunk certification. This includes:

• Splunk experts
• Splunk PS partners
• Independent platform consultants

Prerequisite certification:

• Splunk Core Certified Power User
• Splunk Core Certified Advanced Power User
• Splunk Enterprise Certified Admin
• Splunk Enterprise Certified Architect

Exam Details 

• Exam Name: Splunk Core Certified Consultant
• Level: Expert
• Length: 120 minutes
• Format: 86 multiple choice questions
• Pricing: $130 USD per exam attempt

Exam Course Outline 

The Exam covers the given topics  - 

Domain 1: Deploying Splunk 5%

1.1 Define Splunk Validated Architectures (SVA)

1.2 Articulate how and why Splunk grows from standalone environment to distributed environment with indexer and search head clustering

1.3 Explain the difference between high availability and disaster recovery and how both can be addressed in Splunk

Domain 2: Monitoring Console 8%

2.1 Describe which instances are suitable to configure as the Monitoring Console

2.2 Articulate how to configure the MC for a single or distributed environment

2.3 Examine how the MC uses the server roles and groups

2.4 Describe how MC health checks are performed and can be extended

Domain 3: Access and Roles 8%

3.1 Identify authentication methods

3.2 Describe LDAP concepts and configuration

3.3 List SAML and SSO options

3.4 Define roles and articulate how roles are used to secure data

Domain 4: Data Collection 15%

4.1 Articulate the different ways data can be ingested by an indexer

4.2 Articulate how one Splunk instance communicates with another Splunk instance (S2S)

4.3 Describe the types and configuration of data inputs

4.4 Describe ways to troubleshoot data inputs

Domain 5: Indexing 14%

5.1 List indexing artifacts and locations

5.2 Describe event processing and data pipelines

5.3 Describe the underlying text parsing and indexing process

5.4 List data retention controls

Domain 6: Search 14%

6.1 Describe how to use search job inspection; explain the inner-workings of a search

6.2 List the different search types

6.3 Describe how to maximize search efficiency

6.4 Describe how sub-searches work

Domain 7: Configuration Management 8%

7.1 Describe a deployment app

7.2 Articulate how a deployment server works

7.3 Describe deployment system configuration

7.4 Articulate how to manage deployment server

Domain 8: Indexer Clustering 18%

8.1 Describe deployment and component configuration

8.2 Describe the life cycle of data using buckets

8.3 Determine failure modes and recovery processes

8.4 Articulate how multi-site clustering works

8.5 List migration procedures

Domain 9: Search Head Clustering 10%

9.1 Articulate how to manage and deploy a search head cluster

9.2 Determine when a search head cluster may be needed and when a search head cluster would not be recommended

9.3 Describe content management using the deployer

9.4 Describe the role of the cluster members and the Captain

9.5 Articulate how captain election works (RAFT)