Core skills
- Splunk fundamentals, events, fields, indexes, sourcetypes, and search habits.
- SPL commands, dashboards, reports, alerts, and simple troubleshooting.
- Administration basics: users, roles, forwarders, indexers, search heads, and data onboarding.
- SIEM and SOC context: alert triage, incident investigation, and security monitoring.