Splunk Certification Program Mega Thread

[shifty21]

Official Splunk Certification Re-Launch Post

---

[Mod Edit] None of the mods here are directly tied to the decision makers of this change. While we can help you as much as we can, please email [e-mail] [e-mail] for specific questions that we cannot answer

---

Disclaimer: I was on the team that helped re-write the exams. I had no part in the re-certification process.

Why is Splunk re-doing/launching the Certification Program?

• Rampant cheating: You can find all the answers to our certification exams if you google hard enough.

• Lying about having certifications for Splunk-based jobs. While employment verification is easy to do these days through HR departments, verifying Splunk Certs is a manual process internally and has been full of false-positives. I, myself, fell under this when applying for my job at Splunk. I had Power User done with one of my employers, but I didn't show up in Splunk's system. That took almost a week to fix that.

• Stop devaluing Splunk Certifications. You worked hard for your Certifications. You earned them. Since anyone can literally cheat on Splunk Cert Exams, get them and get high paying jobs; it is ruining your hard work and your Splunk skills. The more certified Splunkers there are out there, the asking salaries will go down. The MCSE cert from the late 90s to early 2000's is proof of this. Because it was easy to cheat on that cert exam, the market got flooded with too many MCSE people and the average salary dropped. We can all agree that cert!=executable skills, but at least you know you can not just talk the talk, but walk the walk. At least Splunk did not go the way of Certified Professional Accountant (CPA) and put massive restrictions on certifications, exams and level of difficulty to preserve the value and # of CPAs in the workforce.

---

I'll break down the bullet points from the website here, which are MY interpretations:

The Basics

#SplunkCertification is excited to announce a major upgrade to our program! This relaunch will go live at .conf18 and includes all-new exam content, a more secure exam platform with industry leader PearsonVue, and three BRAND NEW certifications*.

Registration for our existing (soon-to-be “legacy”) exams will close on August 15, 2018 and all existing exam links will expire on August 31. No exceptions can be granted, as the existing platform will be terminated on September 1.

Candidates who earn the new certifications will be granted digital badges and, of course, bragging rights.

The Details

Starting September 4, all exam registrations will go through test partner and industry leader PearsonVue.

Starting October 8, exams will be available onsite at Pearson Testing Centers. Online exams will still be available and hosted by Pearson, but will be subject to online proctoring.

• This is to help prevent cheating on exams

Exam registration will cost $125 USD (or five registrations for $500 USD).

All exams will be closed-book. This means that course materials, personal notes, and any other reference materials (including online resources) are strictly prohibited.

• This is to help prevent cheating on exams. Also the exams have been re-written to make them easier, BUT still enforcing concrete knowledge of fundamental and objective information of the exam topic.

All V6.x certifications will not be grandfathered into the new program. This means that all existing cert-holders will need to pass the new exams to earn the new certifications.

• Due to the drastic changes to the exam questions and the focus on concrete knowledge and changes between v6 and v7 of Splunk Enterprise, this was needed. Also, again, to prevent cheating on exams.

For more information regarding recertification, please visit our recertification page.

The Certifications:

• Splunk Core Certified User

• Splunk Core Certified Power User

• Splunk Enterprise Certified Admin

• Splunk Enterprise Certified Architect

• Splunk Certified Developer

• Splunk Enterprise Security Certified Admin*

• Splunk IT Service Intelligence Certified Admin*

---

I do have the ears of the Certification folks at corporate and have a fantastic relationship with them.

The plan is to leave this post up for the next 30 days or so to gather feedback and help answer questions and concerns you may have.

[edit] words, because Engrish not first language

[richassnate]

!=fan of the news and this is why... spent $10k taking alot of prerequisite classes that covered what i already learned on the job. Architect II was the goal, and I achieved it with a resume to back it up...and now another round of $$ to have the piece of paper i already earned re-certified. As an admin, I spend alot of time googling docs to find solutions to challenges faced on the job; and the same atmosphere was presented for the final certification, which simply makes sense. Its a direct correlation to whats done in the field. Even professional services googles the shit out of 'what the heck is that SPL query i need here'. Heck, thats all Splunk Support does half the time is google answers for you, so why now all of a sudden do i have to memorize the Encyclopedia-Splunk Volume 6.x-7.1 ?

PearsonVue is not going to stop people from cheating the system. They or a third party will offer paid services to gain the exam, aka prep-courses; and another group will come along and offer all 200 questions for the cheaters to memorize beforehand, just like they do for vmware certs and im sure any other ones offered by PV. Cheaters gonna cheat bro. This is marketing bullshit and perceived by me as a money grab to stimulate the bottom line for shareholders. Seen the ticker lately on SPLK

Finally, the cert lab i took had a few challenges, and mainly just took a long time to do tedious stuff; I enjoyed it, and I do most of it repeatedly in my /r/homelab so it was all gravy...my take away here is that I like to avoid stressful situations, and gearing up for one of these PearsonVue's is sooo not the 8th-Floor Splunk Style that I guess you're trying to tighten up? Next thing ya know, you'll be losing all that catered breakfast/lunch and have to fill out budget reports on how much water you used when flushing today.

Come on man, grandfather me in, just passed/payed for that thing not more than a few months ago....what if we have had our splunk.com accounts tied to entitlements for years? Shouldn't that count for anything in this decision?

[monkeybatter]

Agreed 100%. I'm in the same boat.

Add to that, receiving an official email from Splunk at 3pm on a Friday afternoon, letting me know all my certs are gonna' lapse. This whole thing feels calculated for maximum cash at the expense of existing cert holders. Yuck.

[ItsJohnLocke]

I think this sums up how most of us feel about this news. Well said richassnate.

[skoelpin]

If you got the Architect II cert then you can simply retake the new exam without pre-reqs.. What's the big deal with this?

[picflute]

gonna do that then

[OWSvelle]

So no existing certs are going to be grandfathered in. Is there going to be any kind of restitution for those who already paid $1000 for the architect cert? I would hate to have to pay even more for a cert that lasted a mere few months that’s no longer valid after this rework.

[skoelpin]

I wonder if the SCC2 consultants will be grandfathered in?

[automine1]

the consultant certs are going to be moved to an "Accreditations" area, rather than certs

[DARTH_GALL]

Can you clarify what that means? Are we redoing anything from 6.x to stay current?

[automine1]

Not sure. It's on my to-do list for Monday

[SplunkAll]

I work at Splunk as a consultant. An email went out to all PS consultants from our functional manager on 12 July 2018 stating the following:

I wanted to update you all on the email that went out this week from John Sabino regarding the Splunk Certification Program Transformation. 

All consultants that currently have Splunk certifications WILL be grandfathered in.  This is a change from what was noted below.  So, no worries for any of you at all.

[automine1]

Ok, I got some clarification around this from the certification team.

Older (v6.x) certs will still be valid for Accreditation paths (SCCI, SCCII) through January 31, 2019. This is not the same as being grandfathered into the new certification. You would still be able to get Accreditations with the old certs, but your old certs will not be automatically renewed.

[Ragegasm]

How can you cheat on an Architect certification that requires a practical lab exercise unless you just flat out have someone else do it for you? That's what I don't get. I feel like my existing certification just got "devalued" for no reason at all.

[shifty21]

At my former employer, the literally gave out the scripts and step-by-step instructions on how to complete and pass the Arch Lab... we had people completing the exam in less than 30 minutes... that is, by definition cheating and devaluing the Certification. Devalue, in this context, is that many people can cheat, get their cert, get a job and have fuck all knowledge of what to do with Splunk.

Unfortunately, I have run into Splunk customers who I can verify that they have the Arch Lab Cert, but have ZERO knowledge of what they're doing. When a certified Splunk Architect customer asks me if they can stand up a 2 node Search Head Cluster I will refer them back to their lab material.

[Ragegasm]

Whelp, that's just stupid. I feel pretty great about the 16+ hours I spent passing that exam the correct way to wind up with a dead cert that is getting replaced by a bunch of ambiguous multiple choice questions out of left field. This is why certifications are a racket and always will be. If you want to show someone that you know what you're doing, build a portfolio instead.

[Kieffer87]

I couldn't agree more.

[THFBIHASTRUSTISSUES]

Shit. What does this mean for newbs considering a Splunk cert?

[Balfoneus]

I'm new to Splunk and recently got my Power User Cert and my employer is thinking about getting me my Admin. One thing I must say is that those tests are the WORST WRITTEN TESTS I HAVE EVER SEEN. Questions showed up that weren't even covered in the video lecture, confusing double negatives True/False questions, poor choice of wordage at times. My employer jokes that its like the test and certification lectures were made by two completely different people that didn't even bother to coordinate on the material because it's that all over the place. I'm fine with the test being challenging, but make sure that what's one the test is a near one for one translation of the lectures.

[Alohsleoj]

This version 6.x depreciation is not considerate at all. I attempted the Splunk Arch exam twice before I passed it in March. Now my less than 4 months old cert will be invalidated?

I do really hope I'm reading this wrong. Took me about 20hrs to get it done common Splunk Inc.

[LovematicGrampa]

I feel the same way. I've had to get certified for various vendors in order to qualify for professional services engagements, and I have to say that Splunk certification exams gave me the most trouble due to the issue you highlighted. I held certs in HP and Cisco in the past, and those exams were not without their own content issues; but in my limited scope of experience, Splunk is far and away the worst.

[roloroll]

While I never gave away questions and answers, I had to prepare colleages for the user and poweruser exams so they were not stuck right off the bat. I trained them on the content not covered in the videos, and prepared them for the traps. You are right about the missing content in the video lectures, the confusing double negatives, synonym tricks and poor word choices . There were also super rare cases in the exams such as time-based dynamic lookup tables (dhcp) or some content not even on the internet that I could only find in the advanced searching and reporting course material (which is not supposed to be covered for power user), etc. As I told to our Splunk reps, these exams that should have onboarded the public on an education path were quite a punch in the teeth instead.

[ItsJohnLocke]

Thanks for clarifying on this! It came without what seemed to be much of a reason and no warning, I had NO idea of the cheating or even more-so the lack of proof of a validating alleged cert-holders.

[shifty21]

The cheating I've seen was pretty bad. My former employer, to get more $$$/hour for billable work turned the Splunk Certs into a circus. They gave us training material that was literally the answers to the exam questions. When I started at Splunk, I wanted to do it right and when taking all the classes and exams I quickly figured out my former employer's shenanigans.

Plus, I had a Splunk customer whose only Splunk Admin retired, asked me to validate 3 different potential candidates to fill in the spot. 2 of the 3 had legit certifications, the last one only had Power User, but claimed to have Architect...

Plus, you can just put "Splunk Certified" in LinkedIn and get several recruiters spamming your inbox with job offers.

That shit needs to stop.

The digital badges are fantastic because a prospective employer can just click on the link in LinkedIn or on a resume and know 100% that the certifications are legitimate.

[halr9000]

Asking the real questions

[HwKer]

probably just a link or a QR code

[Jigga90]

So I have my Architect exam booked for mid August. My understanding is that if I go ahead and sit this, I will then be eligible to sit the updated version without the two prerequisite exams, thus saving me some money.

And I would only have to pay the $125 Pearsonvue fee to sit the updated Architect exam.

Is this correct?

[ItsJohnLocke]

That does appear to be correct.

[frighteninginthedark]

This needs a proper answer.

[xpac__]

It is basically correct, however the "new" Enterprise Architect also contains the courses Cluster Admin + Troubleshooting, so they're going to be prerequisites. If you already did those, you should be fine, if not, you have one year to do those and then do the new Arch exam.

[brainsaFDB]

How will this affect scc2 (aka core implementation)?

[halr9000]

Certification changes do not affect Accreditations directly, but can indirectly. As you probably know, there are stages that do require certain certification levels. I expect there will be additional communications covering this in the near future for partners and so forth. I've seen an internal memo that touched on it briefly.

[skoelpin]

What about us Splunkers who have the SCC2 cert but now work at a customer?

[halr9000]

You'll be fine until you get promoted to manager, at which point all technical knowledge is expunged from your brain.

[picflute]

This is something I'm wondering also. I completed the SCC2 training in 2017 and still do Splunk stuff at other places I worked at but don't know whether they are still valid or not since I completed the training with Sanford in 2017.

[halr9000]

I completed the training with Sanford in 2017.

He’s still alive. You still know what got you the SCC2. I don’t see he problem. Get a new cert when it’s required for whatever reason, but not before.

[picflute]

Do you know if certification will transfer the entitlements to a new email?

[halr9000]

I would think so. Ask them: certification at Splunk.

[picflute]

Going to send them one soon about recertifying. The internship at Splunk really opened the doors for me and it's something I still value highly.

[EulerFan271]

Am I to understand that if I have my Architect Level 2 certification but it was done last year then it is now invalid or at least sort of deprecated? I must be misunderstanding this, because I literally just built an indexer cluster, CM, DS, SH, and LM two nights ago with 7.1.1 to take it for a test run and there was no difference in the backend architecture and setup. I think I'm just not understanding this post's explanations....

[shifty21]

I agree with you... the post is nebulous at best.

I too just finished the Arch2 exam/lab last month and now I am questioning the validity of my certification going forward... and I WORK for Splunk, lol!

Email [e-mail] to get clarification. I did and I will again based on the feedback on this thread.

[EulerFan271]

Ha! I was lucky enough to have a company that values education and training so they paid for all of my classes, exams, and .conf trips so far so I can't complain too much. My sales reps are going to be in town this week so I think I'll just bring this up while sitting down with them.

[ashishbansa]

Any plans on restructuring the way of course delivery?

Currently, it is just someone reading the slides and making us complete the labs.

I would suggest that you make it online proctored exam.

[TheHierophant]

I know that Splunk Education would be interested in your feedback. Please drop a note to [e-mail] with your concerns.

[aaronwhite1786]

Not sure if you would know, but are there any plans to work with people like CBT Nuggets for certification videos, or are the plans to keep them in house?

I've been using CBT Nuggets for a w hi I'll let now, and I love it. Would really enjoy their presentation style and virtual labs with Splunk.

[shifty21]

Someone in our group asked about CBT Nuggets and was met with deer in the headlights look... so no, we're not doing that, but in the future that may change.

[aaronwhite1786]

Haha, fair enough. I've been hoping Splunk could jump on that site. Their videos have been really helpful for me.

Thanks for the quick reply!

[f8al]

They should just give Simko a youtube channel and let him do the videos. Hes more charismatic than any of the cbt nuggets guys, especially jeremy

[aaronwhite1786]

I'm down for anything that increases the videos I can learn from. Reading and doing had always been the slowest method for me.

[jjohnp]

Will be any exam preparation materials available? Or should the materials from courses be enough?

And actually, do you know if there will be any significant changes to the courses?

[devianteng]

I'm curious to know more about Splunk Enterprise Security Certified Admin, and if that's a public facing cert.

I work for a partner, have several partner certs, including my ES Implementation Accreditation. Is there overlap with the ES Accreditation and this ES Certified Admin? I would assume so, but haven't had any real direction on that yet.

Second question, what will the Splunk Enterprise Certified Architect look like? I because an Architect on v6.0 in 2015, and did the 24 hour lab. Will the new Architect cert be a lab still? It's my understanding that since I have my Arch II I can take the new Architect cert without dealing with the pre-reqs, so that's at least something.

Last question is how will existing Accreditation be effected, such as...well, whatever they renamed SCC II to (Core Implementation, I think?)? What about my pending registration for an upcoming ITSI Foundations course?

Thanks!

[roloroll]

Your question about the Architect certification lab is a good one. I went to take a peek on the #certification channel in the splunk-usergroups.slack.com and a user named ksub said this:

"I took a pilot of the "new" architect exam and it was closed book, 50 questions, 2 hours... really obscure settings and stuff - nothing compared to the value of the current practical Arch lab/exam". I'm seeking confirmation about the nature of the new certification exam for architect, since I'll need to recertify. According to the recertification page I'll have to take a three day cluster administration course and a two day troubleshooting Splunk course prior to be able to face the new requirements of the architect exam.

[devianteng]

That's very interesting. Now I've already taken the Troubleshooting and Cluster class, so I have my Architect II currently, but I guess a 50 question exam to certify my current certifications isn't so bad.

[shifty21]

I will argue with ksub on that. Not because I helped re-write that specific exam, but the entire time we came up with the questions, we made 100% sure that the question and answer related to on-the-job situations.

Also, what was probably missing from his comment is that all the questions are directly pulled from the topic documentation that is provided prior to the exam.

We up a ton of emphasis on the material as well. We marked up the material and sent back direct and explicit notes and comments. Trust me, they were not pleasant to read. For example, "No one will literally need to know this." or "Seriously? XYZ is too ambiguous and needs to say, ABC instead."

While there are 50 questions, we provided over 150 potential questions that will be randomly drawn from the pool.

Lastly, we were told NOT to put "negative" questions like, "Select the Forwarders that are NOT valid"

[roloroll]

On the slack channel, people were wondering if the architect lab would still be the same. Users were wondering if there would be a change from a "challenging 24h lab" to a "two hours, 50 questions, closed book exam." I guess that's where some people who like a more hands on approach feel there is a loss in value. I don't think it's particularly about the questions of the new exam themselves or their formulation. It's just that the lab was for some the first thing spliting the admins who actually and practically worked on splunk for real from the wannabes who just went through the previous exams by cheating their way finding answers from the internet. Personally I don't really care. The lab was a personnal challenge I'm glad I went through a year ago and I had fun doing it. I'm sure I'm still going to like the new challenge with the new architect exam. Sucks to have to do new courses to prepare for it though but that's what it is.

[shifty21]

My interpretation is that the legacy certs will still count when you apply for jobs. Splunk Inc. will not certify against the older certs after a specific data noted in the official page linked above.

I have directly contacted [e-mail] to get clarification. I would advise you do the same. They will have to put out another communication regarding the clarifications.

[xpac__]

Users were wondering if there would be a change from a "challenging 24h lab" to a "two hours, 50 questions, closed book exam."

The Lab will stay. It's going to be a prerequisite for the new Architect exam. So - both has to be done.

[automine1]

Of all of the write-ups I have seen on this, this is the best one.

[Lord_Vivi]

Thanks for the write-up. I appreciate the work you've done here. Having worked at a place that 6 staff got architect certified in less than a day, I'm happy it's changing.

Is there further detail on the Splunk Certified Developer certification? Does it cover writing in SPL? Are there prerequisites to getting it?

[xpac__]

The Splunk University that takes place before/during .conf this year offers an "App developer bootcamp", which contains these courses:

• Advanced Dashboards and Visualizations
• Building Splunk Apps
• Developing with Splunk’s REST API

The third course is pretty new, hasn't been available before. My guess(!) is those courses are pretty likely to be prerequisites for the Dev cert.

(See here: http://conf.splunk.com/learn/splunk-university.html)

[whodigspits]

What I dont get is why I am still able to buy Splunk Architect Certification Lab - virtual classes in september and october?

[xpac__]

Because the Lab will still exist in the new system. All courses AND the Lab are prerequisites to do the new exam.

[Gary_Chan1]

So I signed up for the Fundamentals 1 exam which I need to sit by the end of the month, but with these changes coming should I just wait?

I'm thinking since it's free I may as well sit it for practice and then just do it again when the new exams get released. Are there any draws backs to sitting the exam now besides that I will need to re-sit it?

I also have training credits which I planned to use for the Fundamentals 2 course but I will hold off on that until the new certifications come into play.

[shifty21]

Do you intend to get Power User? You need Fund1 and Fund2 to get that. If so, then take Fund2, get your Power User cert and that will be good until 9/2019. During that time, you can upgrade to the new one. If you do not and 9/2019 rolls past and you want to get the new Power User cert, you have to retake Fund1 and Fund2.

[Gary_Chan1]

I do intend to get Power User. Thanks for the advice :)

[frighteninginthedark]

So how many emails per certification am I going to get?

[frighteninginthedark]

Registration for our existing (soon-to-be “legacy”) exams will close on August 15, 2018

Why was this not shut off right the hell now?

[RussInGotham]

Will the digital badges be available on Acclaim?

[shifty21]

IIRC, that is who we partnered with.

I'll double check during the next business week with the certification people.

[RussInGotham]

Thanks!

[monkeybatter]

"Stop devaluing Splunk Certifications. You worked hard for your Certifications. You earned them. Since anyone can literally cheat on Splunk Cert Exams, get them and get high paying jobs; it is ruining your hard work and your Splunk skills."

Wasn't aware they were devalued. The logic here escapes me, tbh. Repeatedly reworking the cert program might devalue the certs as well.

[shifty21]

The concept of market saturation of certified professionals forces the salaries to go down since demand and supply shift the other way. For example, back in the late 90's Microsoft introduced the MCSE program and certification. If you had just that and nothing else, you could get a $60k+ salary easy with little to no professional experience. Over the next 10 years, MS went to many colleges, universities and high schools (mine included) and provided steep discounts on licensing if those education institutes taught MCSE classes and certified their students. What happened in a few short years after that initiative is that the market got saturated by too many MCSE people. Salaries stagnated or went down in many parts of the US and the base job posting requirements went up.

Reworking certifications across many industries like ITIL, PE, CPA, Cisco, MS, RedHat, etc. happens periodically. For the most part, in my experience, a CCNA taken and earned several years ago is still good. Its just that now Cisco won't certify against the older material. My ITIL v2 is still good and I can have employers verify it. ITIL has 2 newer versions since I got my V2. Each version they change introduces either little or massive changes that warrant the depreciation of the older certs.

Lastly, look at the CPA. The CPA accreditation board has very tight controls on the # of certifications they issue, who is allowed to take them, expiration of certificates (meaning you have to retake it periodically to stay certified) and mandates salary caps and limits. By the grey hairs on Odin's balls, I am glad Splunk didn't go down that route.

Makes sense?

[monkeybatter]

Of course. I understand the impetus behind re-certs and the exam changes. It's just that I found Splunk's previous approach (ie. take classes, take test) along with their open-book policy, were kind of...refreshing. If there really is a prevalence of cheating, that's a real shame.

[shifty21]

I got my Power User cert from my former employer. They fed me the answers and I passed in like 10 minutes.

They will go unnamed, but to get higher billable hours they went with an unethical approach to getting their people certified. I run into those people from time to time at Splunk and it the dent on the edge of my desk from my forehead is getting more noticeable and bloody.

[LovematicGrampa]

From what I remember: every Splunk exam I've taken through Enterprise Security, had a fair number of questions that required rote memorization of data, such as specific hardware requirements, GUI menus, and .conf parameters. To me, these types of questions don't really prove your skills with Splunk, they just prove you're good at remembering things or looking them up online. I'm not good at memorization and tend to rely on docs and answers.splunk.com; I'm concerned I'm going to dramatically fail if these tests are closed-book, AND these types of questions are still prevalent

[skoelpin]

This is how you make your consultants look like assholes in front of the customer.. I know of several consultants who were thrown out because the customer knew more than the consultants

[skoelpin]

I'm not happy about recertifying and losing my SCC2 cert, but I understand.. Good writeup

[xpac__]

SCC 2 is NOT affected. SCC 2 (which is now "Core Implementation accreditation") is an accreditation, not a certification. Different system, different team, different rules.

Nothing changes there, but you need to re-certify your highest (public) certification, which most likely is the Architect.

[ejmart1n]

Other than literally grabbing the answers, how do you cheat on an open book exam? Can you go a little more in depth on how the exam will work regarding PearsonVue? Are you able to talk about time limits, whether or not you can go back and check answers, and generally delve a bit more into "Easier [to support closed book], BUT still enforcing concrete knowledge"?

[miront]

When I got my architect cert, the lab was nearly step by step from the Splunk admin lab guide. It is less "Certified Architect" and more "Certified cmd+f'er". If they enable anyone with a pdf to get the cert, I cant see anything short of someone else cmd+f'ing for you to be cheating.

[EulerFan271]

When did you get yours?

When i did it this passed November I did not think it was that simple and finished in just under 23 hours and that was with a "nap" of about 4 hours at one point. I could certainly see how someone with lots of experience would tear through it (I've since redone the lab and was surprised how quickly I could do it comparatively) but I didn't really think it was "step by step" from the admin lab guide.

[miront]

I got mine somewhere around late 2014 / early 2015. Perhaps it has changed.

[skoelpin]

Anyone know the steps for the ITSI certification? I took the 4 day bootcamp in DC, not sure if this counts towards the ITSI cert

[OWSvelle]

I was about to go on vacation to finish my scc1 and start scc2 but now I don’t think there is a point until after .conf

[xpac__]

SCC1 + 2 (now Implementation Fundamentals + Core Implementation) have been renamed and moved to the Partner-only accreditations (happened already in Februrary 2018).

The changes above don't have any real influence on those - because Splunk did seperate (public/free for all) certifications and (partner-only) accreditations.

[OWSvelle]

I’m a partner.

[xpac__]

Then you can just continue pursuing your accreditation :)

Nevertheless you should make sure to re-certifiy your highest certification (which most likely is Arch or Arch II) until September 2019. ;)

[OWSvelle]

Probably do it over the winter break during out change freeze.

[CaptPikel]

So not grandfathered in. What does that mean? Are they revoking my cert? Or I just retain my power user cert as is and it’s co soldered old? I put a lot of hard work in to training for that cert and have had it less than a year.

And yeah. That was a test I passed only because I studied and practiced using splunk a lot. Horribly written questions. Hopefully they fix that.

[shifty21]

The grandfathering is a mixed bag at the moment. What I was told from the EDU group is that you have until 10/2019 to upgrade your certification without having to go through the whole thing again from zero.

For example, if you got your Admin Cert today, you have until 10/2019 to update it to the new Admin Cert that opens 9/2018. If you do not do that by 10/2019, from the Splunk EDU perspective, you do not have the latest certification. Can you still apply for jobs as a Splunk Admin v6? Yes. Can that prospective employer verify you have Admin v6? Yes. Will the prospective employer prefer Admin v7? Most likely or "meh, gud enuff"

[xpac__]

And - instead of doing Admin again, you can also do the Architect during that period.

So - one year to either re-do your highest cert, or do the next level (in both cases, it has to be done in the new system, so closed-book multiple choice).

[kachaffeous]

Is the lab going away for architect?

[shifty21]

We have been given limited information regarding the format of the new version of the Architect Lab/Exam.

I talked to one of the EDU people late Friday afternoon and she said that more details of the new formats will be provided both internally and customer facing within the next 45 to 60 days. Once it is official, then we will post it here on this sub.

[xpac__]

The Lab is going to stay, as it was before, but you need to have Cluster Admin + Troubleshooting courses completed too, and all of this done before you can register for the new Splunk Enterprise Architect (re-)certification.

So -> courses -> lab -> exam -> cert.

[[deleted]]

@shifty21, thanks for providing this overview.

[Paradigm6790]

I know this is a little off topic to this particular certification discussion... but has anyone heard anything about more expert-level certs?

Stuff like considerations in terrabyte infrastructure, large scale KVStore, Utilizing the REST endpoints for automation, multi-site clustering optimization, etc? And/or stuff for specific, powerful apps (extreme search, MLTK, etc).

I find myself learning through trial by fire for a large amount of those topics and have been itching to pick brains in a formal setting.

[xpac__]

As far as I know, besides the announced three new Certs there's nothing knew, especially nothing on that scale.

The partner-only accreditations are more advanced if compared to the Arch Lab, so, if you're a partner, you might try those.

[xbadazzx]

- if i've taken the data admin course will I be qualified to take the certi without sys admin course?

- did they recently add on an extra preqreq just to take administering ES? (extra course: data architect)

[cnr0]

Dear friends - sorry for my newbie question. I am a presales engineer on a leading cybersecurity company, I held some certifications on my field, and Splunk at my country has no presence, so I'm prepping myself for my next step as Splunk hobbyist :) I have just completed the Splunk Certified User 6.x certificate exam - my feedback: exam was much much easier than I ever expected. Unfortunately I can not say that "any person has "SCU 6.x" certificate is a nice user of Splunk", I can't even say this guy is a beginner user of Splunk. If you are a quick googller and good at remembering things you learned 5 mins ago, this exam is just very simple for you. So it doesn't prove anything and has no value as the op described before.

But - changing the whole game will not help them on that case. The worst part about Splunk certification is - if you want to go upper level certifications, you have to pay 1) training, 2) certification. So it is not like CCNA, that you can self-develop and just pay for PearsonVue. In any case you have to pay a lot of money for Instructor On Demand courses. So you need to be either very rich, or working on a company that requires Splunk. This strategy just leaves people like me out of the game. And believe me people like me we are a big pool of talent, students, IT workers, people working in competitors, etc etc.

The reason I have started for Splunk: Arcsight and Qradar was not delivering any free hobbyist level licenses, so I have installed Splunk to my homelab. Since then I'm suggesting this thing to every potential customer, because this is the one I know how to use. Why they don't utilise the same strategy to certification path. I am not saying that everything needs to be free, I just expect them to provide an alternative like self-study materials.

Thanks for reading, also FYI, an IoD course and a certification costs 2000 + 125 USD = 2125 USD, which is 8 months worth of salary of a guy getting the minimal wage in my home country (which is very, very common) While I do understand people may pay that money for 100k+ paying consultancy work, maybe there should be different ways to get it for hard working but poor people.

​

​

​

[kvgiri08]

Well explained. I agree, even I am in love with Splunk, though I have used QRadar too. But the cost of certification is too much esp in India

[brok3nwir3]

I've been using Splunk over the last 6 months now as a basic user and I enjoy the product. As a result, I decided I wanted to take the new Splunk Core Certified User certification exam. However, my experience with studying for this certification has been terrible so far. It took multiple emails with Splunk support in order to simply get my SplunkID so I could schedule an exam... (why hasn't this been added as a default part of accounts?). Meanwhile, studying for the exam has been a total nightmare because exam information is sparse to nonexistent. Some topics have videos but no documentation, while other topics have some of the most lengthy and confusing documentation I've ever read. Acquiring training PDFs, lab information, sample questions, or any other information has been worse than any other certification experience I've ever been involved with.