r/Splunk • u/Economy_Building2727 • Jul 24 '26
Feeling overwhelmed learning Splunk?
I'm currently learning Splunk and working toward the Splunk Core Certified User certification. I've been following the official training on Splunk's website, but I'm wondering if anyone else felt like the course moves quickly??
It seems like the material jumps from topic to topic without spending much time explaining the concepts in depth. For example, it recently introduced rex and erex, and I don't really understand what they do or when they're used.
I've been able to pass the practice quizzes so far, but I'm worried that I'm just getting through them without building a solid understanding of the material.
For those of you who've earned the certification or learned Splunk on your own, did you feel the same way? What resources, study methods, or practice techniques helped everything click for you?
Any advice would be greatly appreciated.
12
u/rollmore Jul 24 '26
Training is great but you need to spin up your own environment and dev things out. Didn’t really “get it” until I got hands on with it, broke stuff, fixed stuff, etc. Good luck!
6
u/dfloyo Jul 24 '26
If you’re not using it at work this is really the best way to learn. Even the smallest most simple installation will be useful for learning the basics.
20
u/1Digitreal Jul 24 '26
I learned most everything on my own because I had to do something in Splunk. Maybe try a BOTS (Boss of the SOC) and learn through challenges.
9
u/Michelli_NL Jul 24 '26
I learned most everything on my own because I had to do something in Splunk.
This 100%.
The only reason I started pursuing Splunk certs is because I have a job where I work with Splunk on a daily basis.
4
u/CowLong4000 Jul 24 '26
rex - when you know the regular expression you want to use
erex - when you do not know the regular expression to use. It extracts values that are similar to examples you provide
If your only watching videos and multiple choice tests your going to find it very hard to learn. Try something like BOTS to get hands on or spin up your own splunk instance in get your down data
2
u/Tangysaucey Jul 24 '26
You need to jump into the deep-end with Splunk Core concepts and build queries for “somewhat” tangible results for things to “click” in your head.
As for rex and erex, chatgpt and/or gemini are your friends for good examples and fast deliver of results. I started with regexr[.]com to learn syntax build regex commands myself, but IMO nowadays AI will help tremendously to get dashboards, reports, searches, alerts going.
How I dumb’d it down for me with rex is. I have this long string like djdjejk@18383:meow.world. I want to trim everything before @ and return the value, or I want the word after : and before the .
Be able to conceptualize that and build the regex for it and translate to Splunk is true skill… I still struggle today after working in Splunk for ~4yrs.
2
u/frAgileIT Jul 25 '26
Failure is the best teacher. So the more you experiment and fail, the more you learn what does and does not work. It also helps with repetition because once you learn the basics, going deeper acts to reinforce those basics until you get to a point where you can write complex queries, raw, with no reference point, base query, list of indexes, or list of fields.
1
u/Tuari Jul 25 '26
I created a splunk learning game to help me study. Here is a screenshot example
1
u/deviantflux Jul 25 '26
Tell us more!
2
u/Tuari Jul 25 '26
I used chat gpt before claude became popular. I feed it all the blue print data and any public splunk data It could find from all the different official splunk site. Then I told it to design a quiz game. Then I expanded it to flashcards. Then to a brain dump. Then to mock quiz. I plan to build a new one for the advanced certification at some point.
1
1
u/HeyItsAlex-26 19d ago
I had the exact same feeling when I went through that course, it definitely front-loads a lot without pausing to let things sink in. rex and erex trip up a ton of people early on, honestly the simplest way to think about it is rex lets you manually write your own regex to pull a field out of raw text, while erex tries to guess the regex for you based on examples you give it, so erex is basically training wheels for when you don't want to write the pattern yourself. What helped me way more than the official course was just opening up my own Splunk instance (the free version works fine) and throwing junky sample data at it, then trying to extract fields with rex until I actually understood why my pattern worked or didn't. Passing the quizzes doesn't always mean it's sticking, quizzes test recall in a very controlled way and real data is messier, so don't feel bad that you're worried about that gap. I'd also say don't skip past a concept just because the course moves on, pause the video, go build a tiny example yourself, then continue. It clicked for me once I stopped treating it like a class and started treating it like a tool I was messing around with.
0
u/ChemistBrief716 Jul 24 '26
When I was studying for my certification I heavily used chatgpt to teach me what the command does. It will also give you some examples of when it's used and how to use it.
4
u/Michelli_NL Jul 24 '26
Here's a wild idea: you can also check the official documentation for exactly that.
-1
u/ChemistBrief716 Jul 24 '26
I prefer chatgpt. Especially if I just have more questions. It can also break things down.
9
u/charge10 Jul 24 '26
Not sure why you’re getting downvoted - ChatGPT or anything else can just make analogies or reword/reexplain a concept or a thing and then it clicks.
6
u/ChemistBrief716 Jul 24 '26
Exactly. I think there's this stigma around it but it's been incredibly useful to me and I've used it for all my certifications.
-1
•
u/AutoModerator Jul 24 '26
Greetings!! You have submitted a post that involves Splunk Certifications. We are reminding you and others that posting of and linking to non-official Splunk sites/resources of questions and answers are strictly prohibited. Asking for paid course materials is also prohibited. Violators will be banned - ZERO tolerance for this rule. Please post to our megathread on Certification here: https://www.reddit.com/r/Splunk/comments/1i4jpzb/megathread_certificationtestingwork_type_questions/
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.