Splunk Enterprise Certified Architect

About Splunk Enterprise Certified Architect (SPLK-2002) Exam

The Splunk Enterprise Certified Architect exam is the end-stop in achieving the Splunk Enterprise Certified Architect certification. The Splunk Enterprise Certified Architect exam assesses a candidate's expertise and skills in Splunk Deployment Methodology.

The SPLK-2002 contains a total of 85 questions. The exam must be done in 90 minutes. It is only available in English. The exam costs USD 125.

Who is eligible for this exam? 

Candidates must complete the lecture, hands-on labs, and quizzes in the Architecting Splunk Enterprise Deployments, Troubleshooting Splunk Enterprise, and Splunk Enterprise Cluster Administration courses, as well as the Splunk Enterprise Deployment Practical Lab, to be qualified for this exam.

What are the requirements?

Splunk Enterprise Certified Architect  requires:

1. The Splunk Core Certified Power User
2. Splunk Enterprise Certified Admin tests.

Benefits of SPLK-2002 Certification

Splunk Enterprise Certified Architect certification adds a new edge to the career path; it also establishes your expertise in the widely used Enterprise System of  Splunk. SPLK-2002  gives you numerous benefits. Here are some of them:

• Expand your knowledge base and validate your skill: 

Splunk Enterprise Certified Architect certification will help you become a Splunk Certified Architect. Becoming a Splunk Certified Architect will help you boost your career as the credentials validate your skills to implore potential employers and expand your knowledge base.

• Stand out from the crowd:

SPLK-2002 certification will give you a chance to stand out from your colleague and make your employers spot you. It will help you get a job with a higher salary much faster than your fellow peers. In short, it improves your potential earning power.

• Boosts your reputation

Having the SPLK-2002 certification on your resume boosts your reputation. Along with your reputation, your trustworthiness and credibility will also increase. Thus it also helps to increase your prestige. 

• Access Digital badge

You will access a secure digital badge that you can add to your social media profiles. Having the Splunk certification will get you into an elite group of some thousand recognized and wanted worldwide. 

• Become hirable

Many corporations are constantly in search of talented and certified individuals. Those working with Splunk products, especially the Splunk Enterprise Certified Architect, will be more than willing to hire you, giving you many benefits as an employee.

Certification Syllabus Content

The following subject areas serve as general guidelines for the SPLK-2002 exam's content:

1. Introduction 2% 
2. Project Requirements 5% 
3. Infrastructure Planning: Index Design 5% 
4. Infrastructure Planning: Resource Planning 7% 
5. Clustering Overview 5% 
6. Forwarder and Deployment Best Practices 6% 
7. Performance Monitoring and Tuning 5% 
8. Splunk Troubleshooting Methods and Tools 5% 
9. Clarifying the Problem 5% 
10. Licensing and Crash Problems 5% 
11. Configuration Problems 5%
12. Search Problems 5%
13. Deployment Problems 5% 
14. Large-scale Splunk Deployment Overview 5% 
15. Single-site Indexer Cluster 5%
16. Multisite Indexer Cluster 5% 
17. Indexer Cluster Management and Administration 7% 
18. Search Head Cluster 5% 
19. Search Head Cluster Management and Administration 5% 
20. KV Store Collection and Lookup Management 3% 

The topics listed below are general recommendations for the material that is likely to be included on the exam; however, other relevant topics may also appear on any particular exam delivery. The guidelines below can adjust at any time without notice to better represent the exam contents and for clarification purposes.

1.0 Introduction 2% 

1.1 Describe a deployment plan 

1.2 Define the deployment process 

2.0 Project Requirements 5%

2.1 Identify critical information about environment, volume, users, and requirements 

2.2 Apply checklists and resources to aid in collecting requirements 

3.0 Infrastructure Planning: Index Design 5% 

3.1 Understand design and size indexes 

3.2 Estimate non-smart store-related storage requirements 

3.3 Identify relevant apps 

4.0 Infrastructure Planning: Resource Planning 7% 

4.1 List sizing considerations 

4.2 Identify disk storage requirements 

4.3 Define hardware requirements for various Splunk components 

4.4 Describe ES considerations for sizing and topology 

4.5 Describe ITSI considerations for sizing and topology 

4.6 Describe security, privacy, and integrity measures 

5.0 Clustering Overview 5% 

5.1 Identify non-smart store-related storage and disk usage requirements 

5.2 Identify search head clustering requirements 

6.0 Forwarder and Deployment Best Practices 6% 

6.1 Identify best practices for forwarder tier design 

6.2 Understand configuration management for all Splunk components, using Splunk deployment tools 

7.0 Performance Monitoring and Tuning 5% 

7.1 Use limits.conf to improve performance 

7.2 Use indexes.conf to manage bucket size 

7.3 Tune props.conf 

7.4 Improve search performance 

8.0 Splunk Troubleshooting Methods and Tools 5% 

8.1 Splunk diagnostic resources and tools 

9.0 Clarifying the Problem 5% 

9.1 Identify Splunk’s internal log files 

9.2 Identify Splunk’s internal indexes 

10.0 Licensing and Crash Problems 5% 

10.1 License issues 

10.2 Crash issues 

11.0 Configuration Problems 5% 

11.1 Input issues 

12.0 Search Problems 5% 

12.1 Search issues 

12.2 Job inspector 

13.0 Deployment Problems 5% 

13.1 Forwarding issues 

13.2 Deployment server issues 

14.0 Large-scale Splunk Deployment Overview 5% 

14.1 Identify Splunk server roles in clusters 

14.2 License Master configuration in a clustered environment 

15.0 Single-site Indexer Cluster 5% 

15.1 Splunk single-site indexer cluster configuration 

16.0 Multisite Indexer Cluster 5% 

16.1 Splunk multisite indexer cluster overview 

16.2 Multisite indexer cluster configuration 

16.3 Cluster migration and upgrade considerations 

17.0 Indexer Cluster Management and Administration 7% 

17.1 Indexer cluster storage utilization options 

17.2 Peer offline and decommission 

17.3 Master app bundles 

17.4 Monitoring Console for indexer cluster environment

18.0 Search Head Cluster 5% 

18.1 Splunk search head cluster overview 

18.2 Search head cluster configuration 

19.0 Search Head Cluster Management and Administration 5% 

19.1 Search head cluster deployer 

19.2 Captaincy transfer 

19.3 Search head member addition and decommissioning 

20.0 KV Store Collection and Lookup Management 3% 

20.1 KV Store collection in Splunk clusters

Career Opportunities

Once you achieve Splunk Enterprise Certified Architect, you can get many exciting career opportunities along with excellent pay.

How can I attend the exam?

Applicants can schedule the Splunk Enterprise Security Certified Admin exam directly from PearsonVUE. Follow the steps to create and register your account at home.pearsonvue.com/splunk. Payment shall be collected at the time of registration. You can also visit the Pearson VUE voucher shop for direct purchase.

Step 1 First-time registrants: Connect your Splunk account to the Pearson VUE platform

• If you are taking the Pearson VUE Certification Exam for the first time, click here to fill out the form to connect your Splunk account to the Pearson VUE platform.
• If you are not currently logged in to your Splunk.com account, you will first be redirected to the login page. The form must be submitted only once.
• If you have already completed this step and have not received your approval for testing emails, please contact certification@splunk.com for assistance.
• If you have already created a Splunk account with Pearson VUE, please skip to Step 5 directly.

Step 2 Submit complete, accurate contact information to Pearson VUE testing partner.

• The full name provided must match the candidate's photo ID, which will be checked at the examination time.
• Select the country of residence from the drop-down menu.
• Incomplete or incorrect information will result in delayed registration.

Step 3 Wait for Authorization to Test email from Pearson View. 

• After submitting your form, please wait two business days for your e-mail authorization to test. After two business days have passed, please contact certification@splunk.com if you have not received any emails.
• You may receive multiple Authorization to Test emails, but you may use the links in any of the emails to access your Pearson VUE account.

Step 4 Create an account with Pearson VUE. 

• If you have any problems with creating an account, please contact certification@splunk.com.
• If you are notified that you already have an existing Pearson VUE account and need login assistance, please contact Pearson VUE support.

Step 5 Schedule an exam appointment. 

Your Pearson VUE Home screen provides a complete list of the exams that you are eligible for. If you think the exam is missing from this list, please contact certification@splunk.com.

Click through the verification screens and proceed to Schedule this Exam, followed by Scheduling.

Step 6 Check-out.

• Verify exam appointment details.
• Confirm your contact information.
• Accept the policies (please read them carefully).
• Enter your payment information (or your voucher code, if applicable).
• Submit your order.

Recertification Policy 

All Splunk Certifications are subject to a three-year life cycle beginning on completing the highest-level qualifying exam. To verify the expiry date of your certification, please visit Acclaim to check the date of issue of your badge.

Certification Cancellation Policy

Please contact Pearson VUE Customer Support directly to change or cancel your current appointment less than 48 hours in advance. All other appointment changes can be made through your Pearson VUE account.

How to Prepare for the Certification?

STEP 1: Strategic study

You're just a bystander with no strategy. Next, the student must write down his approach. To ensure the performance of the test phase, the strategy must include both short-term and long-term goals. Second, focus on your weakest places, and then expand your market to smaller groups.

STEP 2: Join Splunk Free Online Courses

Some of the most immersive ways to study for the exam are online classes and instructor-led courses. Many reputable websites include amiable instructors as well as excellent preparation material. Since we are all used to teaching in the classroom, these courses will be near replacement with the bonus of attending a class from anywhere. 

STEP 3: Attend the Exam Prep Sessions

Exam prep teachers can assist you in preparing for interview questions and exams after class. Before attending these sessions, go through the necessary content. Make a list of the places where you have questions and where you can develop your skills. To pass the test, be prepared to learn, practice, and ask questions.

STEP 4: Practice papers and test series

Your preparation is a crucial factor in determining how well you passed the test. Take as many Splunk Enterprise Certified Architect practice tests and test series as you possibly can. They will assist you in determining your degree of readiness, identifying your gaps, and identifying the weak points that need additional attention. Numerous reputable educational websites provide excellent content and assist you in achieving success.

STEP 5: Relax for the exam

You did all of the preparation. It's time to unwind and focus on the test. Bring a good outlook and make sure you've had enough sleep. Make sure your exam room is calm so that you can concentrate. Notify the testing center right away if any sounds are distracting you.