Bob Salmans
Cybersecurity & Governance, Risk, and Compliance (GRC)
Splunk Training & Certification Courses for Security and Operations Teams
Train your SOC and IT operations team on Splunk — searching, reporting, dashboards, and alerting through Power User knowledge objects, data models, and the CIM add-on, with hands-on labs at every step.
3
Courses
31
Labs
239
Videos
30h
Total
Start here
New to Splunk? Begin with this course.
Many security and operations teams collect large volumes of machine data but lack a shared, repeatable way to search it and act on what they find. This course gives IT Directors and Training Managers a consistent Splunk baseline for SOC analysts, security analysts, SIEM users, and IT operations staff. Across 11 skills and about 9.3 hours, learners move from Splunk navigation and basic management into searching with indexes, hosts, and fields. They write foundational SPL, summarize data with the top, rare, and stats commands, and build reports, dashboards, lookups, scheduled reports, and alerts. All practice runs in an isolated lab loaded with realistic data from many system types, so no one touches production while they learn. The course aligns with the Splunk Core Certified User certification and fits teams adopting Splunk or moving past basic navigation into repeatable reporting. Assign it through Playlists, and use Team Reporting to track progress across your SOC and operations staff. The Splunk Core Certified Power User course is the natural next step.
Start hereEntryLabs
Splunk Core Certified User
Many security and operations teams collect large volumes of machine data but lack a shared, repeatable way to search it and act on what they find. This course gives IT Directors and Training Managers a consistent Splunk baseline for SOC analysts, security analysts, SIEM users, and IT operations staff. Across 11 skills and about 9.3 hours, learners move from Splunk navigation and basic management into searching with indexes, hosts, and fields. They write foundational SPL, summarize data with the top, rare, and stats commands, and build reports, dashboards, lookups, scheduled reports, and alerts. All practice runs in an isolated lab loaded with realistic data from many system types, so no one touches production while they learn. The course aligns with the Splunk Core Certified User certification and fits teams adopting Splunk or moving past basic navigation into repeatable reporting. Assign it through Playlists, and use Team Reporting to track progress across your SOC and operations staff. The Splunk Core Certified Power User course is the natural next step.
Erik Choron, Bob Salmans
Where teams start
Most Popular Splunk Certifications
Core Splunk paths for teams standardizing search, reporting, alerting, and shared knowledge objects — Splunk Core Certified User (SPLK-1001) first, then Power User (SPLK-1002).
EntryLabs
Splunk Core Certified User
Many security and operations teams collect large volumes of machine data but lack a shared, repeatable way to search it and act on what they find. This course gives IT Directors and Training Managers a consistent Splunk baseline for SOC analysts, security analysts, SIEM users, and IT operations staff. Across 11 skills and about 9.3 hours, learners move from Splunk navigation and basic management into searching with indexes, hosts, and fields. They write foundational SPL, summarize data with the top, rare, and stats commands, and build reports, dashboards, lookups, scheduled reports, and alerts. All practice runs in an isolated lab loaded with realistic data from many system types, so no one touches production while they learn. The course aligns with the Splunk Core Certified User certification and fits teams adopting Splunk or moving past basic navigation into repeatable reporting. Assign it through Playlists, and use Team Reporting to track progress across your SOC and operations staff. The Splunk Core Certified Power User course is the natural next step.
Erik Choron, Bob Salmans
EntryLabs
Splunk Core Certified Power User
When only one or two analysts understand the saved searches, dashboards, fields, and event mappings a SOC depends on, every shift change and staff departure becomes a risk. This course helps IT Directors and Team Leads move Splunk users from personal searches to shared knowledge objects and repeatable workflows the whole team can rely on. Built for SOC analysts, SIEM administrators, and IT practitioners who already work with Splunk, the training covers charts, filtering and formatting, event correlation, fields, tags, event types, macros, workflow actions, data models, and the Common Information Model (CIM) add-on. Throughout, the instructor frames Splunk objects around SOPs, corporate policy, and team handoffs, so the skills apply directly to how your SOC operates. At 6.6 hours across eight skills, Training Managers can assign the course in short blocks alongside daily operations. CBT Nuggets Virtual Labs provide a Splunk VM with a preconfigured data set for hands-on practice, and the course aligns with the Splunk Core Certified Power User certification, a practical next step for teams standardizing Splunk skills.
Bob Salmans, Erik Choron
ProfessionalLabs
Splunk Certified Cybersecurity Defense Analyst
This course gives IT Directors and SOC leads a shared, repeatable detection and response process built on Splunk Enterprise Security (ES). It is built for SOC analysts, SIEM administrators, and security engineers who already work in Splunk. Your team will learn to run common SPL triage queries and map activity to attack vectors and adversary TTPs. They will also enrich findings with asset and identity context and work through defined investigation stages. Later skills cover risk-based alerting, correlation searches, threat hunting, adaptive response, and SOAR playbooks, which shortens the path from detection to containment. Sequence it after Splunk Core Certified User with CBT Nuggets Playlists, and use Team Reporting to track per-learner progress and export completions as audit evidence.
Erik Choron
Capability ladder
Splunk Certifications by Level
The most popular Splunk courses at each certification level — from first credentials for new team members through expert and specialty tracks.
1
Certification tier
Tier 1 — Entry Certifications
First credentials for new team members and cross-trained roles — the on-ramp before vendor specialization.
EntryLabs
Splunk Core Certified User
Many security and operations teams collect large volumes of machine data but lack a shared, repeatable way to search it and act on what they find. This course gives IT Directors and Training Managers a consistent Splunk baseline for SOC analysts, security analysts, SIEM users, and IT operations staff. Across 11 skills and about 9.3 hours, learners move from Splunk navigation and basic management into searching with indexes, hosts, and fields. They write foundational SPL, summarize data with the top, rare, and stats commands, and build reports, dashboards, lookups, scheduled reports, and alerts. All practice runs in an isolated lab loaded with realistic data from many system types, so no one touches production while they learn. The course aligns with the Splunk Core Certified User certification and fits teams adopting Splunk or moving past basic navigation into repeatable reporting. Assign it through Playlists, and use Team Reporting to track progress across your SOC and operations staff. The Splunk Core Certified Power User course is the natural next step.
Erik Choron, Bob Salmans
EntryLabs
Splunk Core Certified Power User
When only one or two analysts understand the saved searches, dashboards, fields, and event mappings a SOC depends on, every shift change and staff departure becomes a risk. This course helps IT Directors and Team Leads move Splunk users from personal searches to shared knowledge objects and repeatable workflows the whole team can rely on. Built for SOC analysts, SIEM administrators, and IT practitioners who already work with Splunk, the training covers charts, filtering and formatting, event correlation, fields, tags, event types, macros, workflow actions, data models, and the Common Information Model (CIM) add-on. Throughout, the instructor frames Splunk objects around SOPs, corporate policy, and team handoffs, so the skills apply directly to how your SOC operates. At 6.6 hours across eight skills, Training Managers can assign the course in short blocks alongside daily operations. CBT Nuggets Virtual Labs provide a Splunk VM with a preconfigured data set for hands-on practice, and the course aligns with the Splunk Core Certified Power User certification, a practical next step for teams standardizing Splunk skills.
Bob Salmans, Erik Choron
2
Certification tier
Tier 2 — Professional Certifications
Advanced credentials for the engineers who own design, escalation, and complex environments.
ProfessionalLabs
Splunk Certified Cybersecurity Defense Analyst
This course gives IT Directors and SOC leads a shared, repeatable detection and response process built on Splunk Enterprise Security (ES). It is built for SOC analysts, SIEM administrators, and security engineers who already work in Splunk. Your team will learn to run common SPL triage queries and map activity to attack vectors and adversary TTPs. They will also enrich findings with asset and identity context and work through defined investigation stages. Later skills cover risk-based alerting, correlation searches, threat hunting, adaptive response, and SOAR playbooks, which shortens the path from detection to containment. Sequence it after Splunk Core Certified User with CBT Nuggets Playlists, and use Team Reporting to track per-learner progress and export completions as audit evidence.
Erik Choron
Recently added
Newest Releases
The latest Splunk training added to the catalog — new courses land here within a day of publication.
Discipline crossover
Splunk Training by Path
Where Splunk training overlaps the disciplines your team hires for — each path page shows the full picture.
ProfessionalLabs
EntryLabs
EntryLabs
Hands-on Splunk practice
Human-led training is the point: engineers practice real skills with expert guidance, not just video playback.
Why CBT Nuggets
How CBT Nuggets is different for Splunk teams
The platform features IT directors comparing training platforms ask about most often.
Taught by IT professionals
Splunk training your team learns from
Built and taught by engineers with decades of experience running real-world IT infrastructure — not crowdsourced contributors.
Erik Choron
Offensive Security & Security Operations
Team outcome
Operational readiness for critical roles
Structured networking and infrastructure paths give teams a shared baseline before outages, migrations, and escalations test them.
What the team gets: Reduce single points of failure across network, cloud, security, and systems administration responsibilities.
Frequently asked questions about Splunk training
Common questions IT directors ask when evaluating Splunk training for their team.
Which Splunk training should our team start with?
Start with Splunk Core Certified User (SPLK-1001) for anyone new to Splunk — navigation, SPL search fundamentals, fields, lookups, reports, dashboards, and alerts. Move analysts who already run their own searches into Splunk Core Certified Power User (SPLK-1002) for shared knowledge objects, tags, event types, macros, data models, and the CIM add-on.
What is the difference between Splunk Core Certified User and Power User?
Core Certified User validates that someone can navigate Splunk, run searches, use fields and lookups, and build basic reports, dashboards, and alerts. Power User builds on that with the knowledge objects a whole team relies on — event types, tags, macros, workflow actions, field aliases, calculated fields, and data models normalized through the Common Information Model.
How should managers organize Splunk training by role?
Assign Core Certified User to SOC analysts, IT operations staff, and anyone who reads Splunk dashboards or runs searches during triage. Assign Power User to SIEM administrators, senior analysts, and the people who own the saved searches, alerts, and dashboards the rest of the team depends on.
Does the training include hands-on Splunk practice?
Yes. Both courses pair video lessons with isolated virtual labs — a Splunk environment preloaded with realistic log data from multiple system types — so analysts can practice searches, dashboards, and knowledge objects without touching production.
Does this training apply to Splunk Cloud as well as Splunk Enterprise?
Yes. Both certifications cover Splunk Enterprise and Splunk Cloud Platform, and the search language, knowledge objects, and data models taught in these courses work the same way on either.
How do you measure ROI on Splunk training?
Track who can run and refine their own searches without escalating, how many saved searches, alerts, and dashboards are shared team objects rather than one analyst's personal setup, and whether triage and reporting stay consistent when a key person is out.
Can CBT Nuggets support Splunk training for teams?
Yes. Managers can assign Splunk paths by role, track completion and progress across the team, and document readiness for the SPLK-1001 and SPLK-1002 exams.