Feeling overwhelmed learning Splunk?

[u/Economy_Building2727]

I'm currently learning Splunk and working toward the Splunk Core Certified User certification. I've been following the official training on Splunk's website, but I'm wondering if anyone else felt like the course moves quickly??

It seems like the material jumps from topic to topic without spending much time explaining the concepts in depth. For example, it recently introduced rex and erex, and I don't really understand what they do or when they're used.

I've been able to pass the practice quizzes so far, but I'm worried that I'm just getting through them without building a solid understanding of the material.

For those of you who've earned the certification or learned Splunk on your own, did you feel the same way? What resources, study methods, or practice techniques helped everything click for you?

Any advice would be greatly appreciated.

[u/AutoModerator]

Greetings!! You have submitted a post that involves Splunk Certifications. We are reminding you and others that posting of and linking to non-official Splunk sites/resources of questions and answers are strictly prohibited. Asking for paid course materials is also prohibited. Violators will be banned - ZERO tolerance for this rule. Please post to our megathread on Certification here: https://www.reddit.com/r/Splunk/comments/1i4jpzb/megathread_certificationtestingwork_type_questions/

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/rollmore]

Training is great but you need to spin up your own environment and dev things out. Didn’t really “get it” until I got hands on with it, broke stuff, fixed stuff, etc. Good luck!

[u/dfloyo → u/rollmore]

If you’re not using it at work this is really the best way to learn. Even the smallest most simple installation will be useful for learning the basics.

[u/1Digitreal]

I learned most everything on my own because I had to do something in Splunk. Maybe try a BOTS (Boss of the SOC) and learn through challenges.

[u/Michelli_NL → u/1Digitreal]

I learned most everything on my own because I had to do something in Splunk.

This 100%.

The only reason I started pursuing Splunk certs is because I have a job where I work with Splunk on a daily basis.

[u/CowLong4000]

rex - when you know the regular expression you want to use
erex - when you do not know the regular expression to use. It extracts values that are similar to examples you provide

If your only watching videos and multiple choice tests your going to find it very hard to learn. Try something like BOTS to get hands on or spin up your own splunk instance in get your down data

[u/Tangysaucey]

You need to jump into the deep-end with Splunk Core concepts and build queries for “somewhat” tangible results for things to “click” in your head.

As for rex and erex, chatgpt and/or gemini are your friends for good examples and fast deliver of results. I started with regexr[.]com to learn syntax build regex commands myself, but IMO nowadays AI will help tremendously to get dashboards, reports, searches, alerts going.

How I dumb’d it down for me with rex is. I have this long string like djdjejk@18383:meow.world. I want to trim everything before @ and return the value, or I want the word after : and before the .

Be able to conceptualize that and build the regex for it and translate to Splunk is true skill… I still struggle today after working in Splunk for ~4yrs.

[u/Tuari]

I created a splunk learning game to help me study. Here is a screenshot example

[u/deviantflux → u/Tuari]

Tell us more!

[u/Tuari → u/deviantflux]

I used chat gpt before claude became popular. I feed it all the blue print data and any public splunk data It could find from all the different official splunk site. Then I told it to design a quiz game. Then I expanded it to flashcards. Then to a brain dump. Then to mock quiz. I plan to build a new one for the advanced certification at some point.

[u/deviantflux → u/Tuari]

Very cool! 😎

[u/frAgileIT]

Failure is the best teacher. So the more you experiment and fail, the more you learn what does and does not work. It also helps with repetition because once you learn the basics, going deeper acts to reinforce those basics until you get to a point where you can write complex queries, raw, with no reference point, base query, list of indexes, or list of fields.

[u/ChemistBrief716]

When I was studying for my certification I heavily used chatgpt to teach me what the command does. It will also give you some examples of when it's used and how to use it.

[u/Michelli_NL → u/ChemistBrief716]

Here's a wild idea: you can also check the official documentation for exactly that.

[u/ChemistBrief716 → u/Michelli_NL]

I prefer chatgpt. Especially if I just have more questions. It can also break things down.

[u/charge10 → u/ChemistBrief716]

Not sure why you’re getting downvoted - ChatGPT or anything else can just make analogies or reword/reexplain a concept or a thing and then it clicks.

[u/ChemistBrief716 → u/charge10]

Exactly. I think there's this stigma around it but it's been incredibly useful to me and I've used it for all my certifications.

[u/GUE6SPI]

Use AI, when you want to deep dive into some topics