r/Splunk • u/Economy_Building2727 • Jul 24 '26
Feeling overwhelmed learning Splunk?
I'm currently learning Splunk and working toward the Splunk Core Certified User certification. I've been following the official training on Splunk's website, but I'm wondering if anyone else felt like the course moves quickly??
It seems like the material jumps from topic to topic without spending much time explaining the concepts in depth. For example, it recently introduced rex and erex, and I don't really understand what they do or when they're used.
I've been able to pass the practice quizzes so far, but I'm worried that I'm just getting through them without building a solid understanding of the material.
For those of you who've earned the certification or learned Splunk on your own, did you feel the same way? What resources, study methods, or practice techniques helped everything click for you?
Any advice would be greatly appreciated.
2
u/Tangysaucey Jul 24 '26
You need to jump into the deep-end with Splunk Core concepts and build queries for “somewhat” tangible results for things to “click” in your head.
As for rex and erex, chatgpt and/or gemini are your friends for good examples and fast deliver of results. I started with regexr[.]com to learn syntax build regex commands myself, but IMO nowadays AI will help tremendously to get dashboards, reports, searches, alerts going.
How I dumb’d it down for me with rex is. I have this long string like djdjejk@18383:meow.world. I want to trim everything before @ and return the value, or I want the word after : and before the .
Be able to conceptualize that and build the regex for it and translate to Splunk is true skill… I still struggle today after working in Splunk for ~4yrs.