Expected SPLK-5002 Exam Topics, as suggested by Splunk :

• Module 1: Data Engineering: This section of the exam measures the skills of Security Analysts and Cybersecurity Engineers and covers foundational data management tasks. It includes performing data review and analysis, creating and maintaining efficient data indexing, and applying Splunk methods for data normalization to ensure structured and usable datasets for security operations.
• Module 2: Detection Engineering: This section evaluates the expertise of Threat Hunters and SOC Engineers in developing and refining security detections. Topics include creating and tuning correlation searches, integrating contextual data into detections, applying risk-based modifiers, generating actionable Notable Events, and managing the lifecycle of detection rules to adapt to evolving threats.
• Module 3: Building Effective Security Processes and Programs: This section targets Security Program Managers and Compliance Officers, focusing on operationalizing security workflows. It involves researching and integrating threat intelligence, applying risk and detection prioritization methodologies, and developing documentation or standard operating procedures (SOPs) to maintain robust security practices.
• Module 4: Automation and Efficiency: This section assesses Automation Engineers and SOAR Specialists in streamlining security operations. It covers developing automation for SOPs, optimizing case management workflows, utilizing REST APIs, designing SOAR playbooks for response automation, and evaluating integrations between Splunk Enterprise Security and SOAR tools.
• Module 5: Auditing and Reporting on Security Programs: This section tests Auditors and Security Architects on validating and communicating program effectiveness. It includes designing security metrics, generating compliance reports, and building dashboards to visualize program performance and vulnerabilities for stakeholders.

• Module 1: Splunk Architecture and Deployment: The Splunk Architecture and Deployment section offers a detailed understanding of Splunk’s structure and deployment methods. It covers the core components of Splunk Enterprise, such as the Indexer, Search Head, and Forwarder. This section involves examining the design of Splunk deployments, including how these components interact and their specific roles.
• Module 2: Installation and Configuration: In the Installation and Configuration section, the focus is on the procedures for installing and setting up Splunk Enterprise. This includes the installation process across different operating systems and the configuration of necessary components to ensure proper functionality. Key topics include installing the Splunk software, setting up the Deployment Server, and configuring Data Inputs for data collection and indexing.
• Module 3: Data Management and Indexing: The Data Management and Indexing section explores how Splunk processes data ingestion and indexing. It details the data pipeline, covering the stages of data collection, parsing, and indexing. This section also includes configuring data inputs and indexing settings, as well as managing indexing performance and data retention policies.
• Module 4: User Management and Security: The User Management and Security section focuses on controlling user access and securing the Splunk environment. It covers how to set up roles and permissions to manage access to Splunk features and data. This includes user authentication methods, such as integrating with external systems and managing user accounts. The section also discusses security best practices to protect against unauthorized access and ensure data confidentiality and integrity.
• Module 5: Monitoring and Performance Tuning: The Monitoring and Performance Tuning section addresses strategies for overseeing and optimizing the performance of a Splunk deployment.
• Module 6: Troubleshooting and Maintenance: The Troubleshooting and Maintenance section focuses on diagnosing and resolving issues within a Splunk deployment. This involves using diagnostic tools and logs to troubleshoot common problems such as data ingestion issues, search performance, and system errors.
• Module 7: Data Integration and Apps: The Data Integration and Apps section explores how to integrate Splunk with other systems and utilize Splunk apps to extend its functionality. This includes integrating Splunk with external data sources and third-party applications, as well as configuring data inputs and outputs.

Expected SPLK-4001 Exam Topics, as suggested by Splunk :

• Topic 1: General OpenTelemetry Concepts/ Use the Cluster Analyzer to pinpoint the root of some problems
• Topic 2: View and alert on weekly, daily, or hourly comparisons/ Create detectors to monitor populations
• Topic 3: Deploy the OTel Collector on Linux/ Discriminate between types of metadata
• Topic 4: Introduction to Alerting on Metrics with Detectors/ Identify common issues with detectors
• Topic 5: Create single-instance dashboards/ Use built-in Kubernetes Dashboards to investigate and troubleshoot
• Topic 6: Correctly apply rollups and analytic functions/ Apply analytic functions over moving and calendar time windows
• Topic 7: Distinguish between different chart visualization types/ Interact with data using built-in content
• Topic 8: Apply analytics functions to a subset of MTS in a signal/ Troubleshooting common errors
• Topic 9: Create Efficient Dashboards and Alerts/ Create dashboards and dashboard groups
• Topic 10: List the components of a datapoint/ Use percentages and ratios to understand trends

• Module 1: Describe how to use search job inspection, Explain the inner-workings of a search/ Describe LDAP concepts and configuration
• Module 2: Describe the underlying text parsing and indexing process/ Articulate how to configure the MC for a single or distributed environment
• Module 3: Articulate how one Splunk instance communicates with another Splunk instance/ Describe how to maximize search efficiency
• Module 4: Articulate the different ways data can be ingested by an indexer/ Describe which instances are suitable to configure as the Monitoring Console
• Module 5: Articulate how to manage deployment Server/ Describe how MC health checks are performed and can be extended
• Module 6: Explain the difference between High Availability and Disaster Recovery and how both canbe addressed in Splunk/ Identify authentication methods
• Module 7: Define roles and articulate how roles are used to secure data/ Describe event processing and data pipelines
• Module 8: Examine how the MC uses the server roles and groups/ Describe deployment system configuration
• Module 9: Describe the types and configuration of data inputs/ Define Splunk Validated Architectures
• Module 10: Describe ways to troubleshoot data inputs/ Articulate how a Deployment Server works/ List indexing artefacts and locations

• Module 1: Identify What ITSI Does/ Describe Reasons for Using ITSI/ Examine the ITSI User Interface
• Module 2: Glass Tables, Describe Glass Tables/ Use Glass Tables/ Design Glass Tables/ Configure Glass Tables
• Module 3: Managing Notable Events/ Define Key Notable Events Terms and their Relationships/ Describe Examples of Multi-KPI Alerts
• Module 4: Describe the Notable Events Workflow/ Work with Notable Events/ Investigating Issues with Deep Dives/ Describe Deep Dive Concepts and Their Relationships/ Describe Deep Dive Concepts and Their Relationships/ Use Default Deep Dives
• Module 5: Create and Customize New Custom Deep Dives/ Add and Configure Swim Lanes/ Describe Effective Workflows for Troubleshooting
• Module 6: Installing and Configuring ITSI/ List ITSI Hardware Recommendations/ Describe ITSI Deployment Options/ Identify ITSI Components
• Module 7: Describe the Installation Procedure/ Identify Data Input Options for ITSI/ Add Custom Data to an ITSI Deployment
• Module 8: Given Customer Requirements, Plan an ITSI Implementation/ Identify Site Entities/ Data Audit and Base Searches
• Module 9: Use a Data Audit to Identify Service Key Performance Indicators/ Use a Service Design to Implement Services in ITSI/ Thresholds and Time Policies
• Module 10: Create KPIs with Static and Adaptive Thresholds/ Use Time Policies to Define Flexible Thresholds/ Entities and Modules, Importing Entities
• Module 11: Using Entities in KPI Searches/ Templates and Dependencies/ Use Templates to Manage Services/ Define Dependencies Between Services
• Module  12: Anomaly Detection/ Enable Anomaly Detection/ Work with Generated Anomaly Events/ Correlation and Multi KPI Searches/ Define New Correlation Searches
• Module 13: Define Multi KPI Alerts/ Manage Notable Event Storage/ Aggregation Policies/ Create New Aggregation Policies
• Module 14: Configure User Access Control/ Create Service Level Teams/ Troubleshooting ITSI/ Backup and Restore/ Maintenance Mode, Creating Modules, Troubleshooting

• Module 1: Data Center Overview: This section measures the skills of Network Administrators and covers the need for data centers due to the increasing amount of data that enterprises process. It focuses on understanding the centralized processing of data and the components of a data center, including computing, storage, and network systems. It also covers application scenarios in various sectors like finance and government.
• Module 2: Data Center Network Overview: This section measures the skills of Data Center Architects and introduces Data Center Networking (DCN), which is the infrastructure carrying services within a data center and responsible for data forwarding. It focuses on the Spine-Leaf architecture using VXLAN for connecting branches to the Internet or WAN. Key concepts include Spine nodes, Leaf nodes, and Fabric.
• Module 3: Overview of Key DC Technologies: This section measures the skills of Network Administrators and provides knowledge of key technologies within data centers, including integrated cabling (ToR, EoR, MoR) and equipment room modules. It also covers iMaster NCE as a system for autonomous driving control within data center networks.

• Module 1: Describe a Deployment Plan/ Define the Deployment Process/ Project Requirements/ Estimate Storage Requirements
• Module 2: Identify Critical Information About Environment, Volume, Users, and Requirements/ Apply Checklists and Resources to Aid in Collecting Requirements
• Module 3: Infrastructure Planning: Index Design/ Understand Design and Size Indexes/ Identify Relevant Apps/ Infrastructure Planning: Resource Planning
• Module 4: List Sizing Considerations/ Identify Disk storage Requirements/ Define Hardware Requirements for Various Splunk Components/ Describe ES Considerations for Sizing and Topology
• Module 5: Describe ITSI Considerations for Sizing and Topology/ Describe Security, Privacy, and Integrity Measures/ Clustering Overview/ Identify Storage and Disk Usage Requirements for Indexer Clustering
• Module 6: Identify Search Head Clustering Requirements/ Forwarder and Deployment Best Practices/ Identify Best Practices for Forwarder Tier Design
• Module 7: Understand Configuration Management for all Splunk Components, Using Splunk Deployment Tools/ Performance Monitoring and Tuning
• Module 8: Use limits.conf to Improve Performance/ Use Indexes.conf to Manage Bucket Size/ Tune Props.conf/ Improve Search Performance/ Splunk Troubleshooting Methods and Tools
• Module 9: Splunk Diagnostic Resources and Tools/ Clarifying the Problem/ Identify Splunk’s Internal Log Files/ Identify Splunk’s Internal Indexes/ Licensing and Crash Problems
• Module 10: License Issues, Crash Issuea/ Configuration Problems, Input Issues, Search Problems, Search Issues, Job Inspector/ Deployment Problems, Forwarding Issues
• Module11: Eployment Server Issues/ Large-Scale Splunk Deployment Overview/ Identify Splunk Server Roles in Clusters/ License Master Configuration in a Clustered Environment
• Module 12: Single-Site Indexer Cluster/ Splunk Single-Site Indexer Cluster Configuration/ Multisite Indexer Cluster/ Splunk Multisite Indexer Cluster Overview
• Module 13: Multisite Indexer Cluster Configuration/ Cluster Migration and Upgrade Considerations/ Indexer Cluster Management and Administration
• Module 14: Indexer Cluster Storage Utilization Options/ Peer Offline and Decommission/ Master App Bundles/ Monitoring Console for Indexer Cluster Environment
• Module 15: Search Head Cluster/ Splunk Search Head Cluster Overview/ Search Head Cluster Configuration/ Search Head Cluster Management and Administration/ Search Head Cluster Deployer

• Module 1: Splunk Cloud Overview: In this topic, aspiring Splunk Cloud administrators cover cloud topology. Moreover, the topic focuses on the differences between Splunk Cloud and Splunk Enterprise.
• Module 2: Index Management: Splunk Cloud administrators get knowledge about Splunk index, indexes in the cloud and data from an index, and monitoring indexing activities.
• Module 3: User Authentication and Authorization: Splunk Cloud administrators learn how to administer Splunk user roles and integrate Splunk with LDAP.
• Module 4: Splunk Configuration Files: In this SPLK-1005 exam topic, the Splunk Cloud administrator learns about Splunk configuration files and directories. Moreover, this topic addresses the configuration of file precedence.
• Module 5: Getting Data in Cloud: Aspiring Splunk Cloud administrators cover Splunk forwarder types, configuration of a forwarder to Splunk Cloud and the role of forwarders.
• Module 6: Forwarder Management: The SPLK-1005 exam covers Splunk Deployment Server in this topic. Also, the topic teaches Splunk Cloud administrator about forwarder management configuration of forwarders to be deployment clients.
• Module 7: Monitor Inputs: The topic tests knowledge of Splunk Cloud administrator about Splunk process for creating file and inputting data.
• Module 8: Network and Other Inputs: The SPLK-1005 exam covers creation of network (TCP and UDP) inputs. Aspiring Splunk Cloud administrators also learn about creating a basic scripted input in this topic.
• Module 9: Fine-tuning Inputs: The topic assesses the knowledge of Cloud administrators about processing that occurs during the input phase. It also covers the configuration of input phase options, including source type fine-tuning and character set encoding.
• Module 10: Parsing Phase and Data Preview: The SPLK-1005 exam topic gives Splunk Cloud administrators knowledge about the default processing that occurs during parsing. It also includes sub-topics about optimization and configuration of event line breaking.
• Module 11: Manipulating Raw Data: The topic gives Cloud administrators knowledge on how data Transformations are defined and invoked. It also covers the usage of transformations with props.conf and transforms.conf for the modification of raw data.
• Module 12: Installing and Managing Apps: Splunk Cloud administrators get knowledge about reviewing the process for installing apps. Moreover, the topic focuses on private apps and how apps are managed.
• Module 13: Working with Splunk Cloud Support: Splunk Cloud administrators attempting the SPLK-1005 exam learn about isolating problems before contacting Splunk Cloud Support. Furthermore, the topic defines the process for working with Splunk Cloud Support.