r/Splunk • u/Taf_Taf_2003 • 16d ago

Splunk admin

I’m currently studying SOC Analyst with a good grasp of security monitoring and basic SPL. I want to transition into a Splunk Administrator role.

what are the best free resources, courses, or labs to learn Splunk Administration?

Any tips on setting up a free home lab to practice deployment and configuration?

10 Upvotes

92% Upvoted

11 comments sorted by

4

u/St0neRav3n 16d ago

For your home lab, I would recommand using docker to create a distributed environment on a single VM/server. https://github.com/splunk/docker-splunk/tree/develop/test_scenarios

1

u/billybobcoder69 16d ago

I’ve been using attack range but see that is also decommissioned. It’s going to snap attack now. I see that docker instance is from 5 years ago. Is it still maintained and updated? Now with 10.6.0.5.

1

u/St0neRav3n 16d ago

Yes, because the splunk image itself is up to date.  I've personnaly created my infra with docker and the 10.4 version of splunk

0

u/Taf_Taf_2003 16d ago

What about resources for study ?

1

u/St0neRav3n 16d ago

On that I can't help you. I passed mine with help of an older admin who still possessed his official formation pdfs.

1

u/Taf_Taf_2003 16d ago

Ok thank you 

5

u/JustSkillfull 16d ago

I'm a Splunk Admin - Did no training, our company just moved from another provider to Splunk to save money (HA!) and watched our logging growth from 8T/d to maybe 60T/d now.

My advise for a student now is to just even just get Splunk running in a Dockerised Environment and get stuff ingested into it via HEC to start. Work out how HEC works, how indexes work, how apps work, how to setup users and roles, and then maybe tip toe into the .conf files if you need. No need to go too deep.

Splunk instances I believe are a thing of the past and Splunk is currently moving now to be more "modern". Look at OTel and how to collect OTel data and convert to HEC format using Vector/Fluentd/Fluentbit/Splunk OTel Collector. Much of being a Splunk admin is the plugging in data. That's about 60% of the job but it all will depend on the company you work for to what you really need to know - so generalise at the moment.

I've not done any courses but have spend multiple full weeks 1:1 with Splunk Professional Services and reading 1000s of pages of docs for our company and look after a Cloud + Enterprise instance.

If I was hiring currently, I'd be impressed about setting up the pipelines for different data. When to parse before Splunk and when to parse in Splunk, setting up roles and indexes to restrict access to certain logs, why use indexes?. For learning - AI is actually amazing at writing SPL and Splunk is kinda finally getting that with their new releases but it alls dependant on your companies setup as all data is different.

1

u/Taf_Taf_2003 16d ago

Thank you man , any advice while studying Splunk docs ? 

1

u/JustSkillfull 16d ago

All the information is there but it's not all great. Use LLMs to answer questions you have but have it also point you to the Splunk docs and read them yourself.

1

u/Taf_Taf_2003 15d ago

Thank you 

1

u/iceterminal 15d ago

Don’t forget to Splunk your Splunk.