| Topic | Details |
| Topic 1 | - Splunk Indexes: Relevant to Splunk Administrators, this section covers the structure and types of index buckets, data retention policies, integrity checks, and the role of the fishbucket in tracking file inputs.
|
| Topic 2 | - Monitor Inputs: Targeted at Splunk Administrators, this domain involves creating and customising monitor inputs for files and directories, including the deployment of remote monitors.
|
| Topic 3 | - Network and Scripted Inputs: Security Operations Engineers are assessed on setting up and customising TCP and UDP network inputs, as well as implementing basic scripted inputs for dynamic data ingestion.
|
| Topic 4 | - Parsing Phase and Data: Security Operations Engineers are tested on their understanding of event parsing, timestamp recognition, and the use of data preview tools to verify data correctness prior to indexing.
|
| Topic 5 | - Configuring Forwarders: Splunk Administrators are assessed on the deployment and configuration of forwarders, along with recognition of additional forwarder functionalities essential for scalable data ingestion.
|
| Topic 6 | - License Management: Designed for Splunk Administrators, this domain addresses types of Splunk licenses, how to manage them effectively, and the implications of license violations on operational continuity.
|
| Topic 7 | - Agentless Inputs: Designed for Security Operations Engineers, this section covers creating agentless inputs using WMI and HTTP Event Collector (HEC), particularly for integrating data from Windows and RESTful sources.
|
| Topic 8 | - Getting Data In ¨C Staging: This section is relevant to Splunk Administrators and focuses on the three stages of data indexing¡ªinput, parsing, and indexing¡ªand outlines data ingestion options and configurations.
|
| Topic 9 | - Fine Tuning Inputs: Splunk Administrators are evaluated on their ability to customise input processing, including sourcetype identification, character encoding, and other configurations for accurate data onboarding.
|
| Topic 10 | - Forwarder Management: This section, intended for Splunk Administrators, tests the candidate's understanding of deployment servers, forwarder apps, client group management, and monitoring forwarder activities across distributed environments.
|
| Topic 11 | - Splunk Admin Basics: This section evaluates the foundational knowledge required of a Splunk Administrator, focusing on identifying core components such as indexers, search heads, and forwarders within a Splunk deployment.
|
| Topic 12 | - Splunk User Management: Aimed at Splunk Administrators, this area focuses on user account creation, role-based access controls, and custom role development to maintain a secure and organised user environment.
|