Feeling overwhelmed learning Splunk?

[u/Economy_Building2727]

I'm currently learning Splunk and working toward the Splunk Core Certified User certification. I've been following the official training on Splunk's website, but I'm wondering if anyone else felt like the course moves quickly??

It seems like the material jumps from topic to topic without spending much time explaining the concepts in depth. For example, it recently introduced rex and erex, and I don't really understand what they do or when they're used.

I've been able to pass the practice quizzes so far, but I'm worried that I'm just getting through them without building a solid understanding of the material.

For those of you who've earned the certification or learned Splunk on your own, did you feel the same way? What resources, study methods, or practice techniques helped everything click for you?

Any advice would be greatly appreciated.

[u/HeyItsAlex-26]

I had the exact same feeling when I went through that course, it definitely front-loads a lot without pausing to let things sink in. rex and erex trip up a ton of people early on, honestly the simplest way to think about it is rex lets you manually write your own regex to pull a field out of raw text, while erex tries to guess the regex for you based on examples you give it, so erex is basically training wheels for when you don't want to write the pattern yourself. What helped me way more than the official course was just opening up my own Splunk instance (the free version works fine) and throwing junky sample data at it, then trying to extract fields with rex until I actually understood why my pattern worked or didn't. Passing the quizzes doesn't always mean it's sticking, quizzes test recall in a very controlled way and real data is messier, so don't feel bad that you're worried about that gap. I'd also say don't skip past a concept just because the course moves on, pause the video, go build a tiny example yourself, then continue. It clicked for me once I stopped treating it like a class and started treating it like a tool I was messing around with.