> ## Documentation Index
> Fetch the complete documentation index at: https://splunk-training.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Welcome

> Intellectual Point Splunk Core Certified Power User training.

![Welcome to Splunk Power User. Learn to search, analyze, and visualize data to uncover meaningful insights.](https://mintcdn.com/ip-splunk-training/m8vVYMLEfGxzBfbY/images/banners/splunk-power-user.png?fit=max\&auto=format\&n=m8vVYMLEfGxzBfbY\&q=85\&s=23d7cb445c5f65e0cab4d8791940a12d)

You are here for **Splunk Core Certified Power User**. The course covers two exams: **SPK-101** (Core User, Modules 1 to 13) and **SPK-102** (Power User, Modules 14 to 26). Use the **SPK-101** and **SPK-102** switch in the sidebar to change between them. Labs and playgrounds run in the [IP Lab Portal](https://labs.intellectualpoint.com). Homework goes to MyIP Portal, not here.

## Your instructors

![Tim Euler](https://mintcdn.com/ip-splunk-training/m8vVYMLEfGxzBfbY/images/instructors/tim-euler.jpeg?fit=max\&auto=format\&n=m8vVYMLEfGxzBfbY\&q=85\&s=dd05863adebabc4509f84f49a8146c69)

Tim Euler
Splunk instructor

Tim teaches the [Weekend · IAD1-A](https://splunk-training.ipoint-labs.com/study-plan/weekend-iad1-a.md) and [Evening · IAD1-B](https://splunk-training.ipoint-labs.com/study-plan/evening-iad1-b.md) cohorts.

![Joel Duhon](https://mintcdn.com/ip-splunk-training/m8vVYMLEfGxzBfbY/images/instructors/joel-duhon.jpeg?fit=max\&auto=format\&n=m8vVYMLEfGxzBfbY\&q=85\&s=15edd04341d82ff062cb509a07f289eb)

Joel Duhon
Splunk instructor

Joel teaches the [Weekday · IAD1-B](https://splunk-training.ipoint-labs.com/study-plan/weekday-iad1-b.md) and [Weekend · IAD1-B](https://splunk-training.ipoint-labs.com/study-plan/weekend-iad1-b.md) cohorts.

## What you'll walk away with

Searching with confidence
How Splunk indexes data, how to write SPL, and how to keep searches fast.

Reports, dashboards, and alerts
Turn a search into something your team checks every morning.

22 guided labs
Each module page links to its lab. Launch it in the IP Lab Portal and do the steps as admin.

Playgrounds of your own
Run Splunk empty or with the course data for 1, 2, or 4 hours. See [labs and playgrounds](#labs-and-playgrounds) below.

Knowledge objects
Fields, lookups, tags, event types, macros, workflow actions, data models, and the CIM.

Two exams, new codes
Since Cisco acquired Splunk, the exams are SPK-101 and SPK-102. Older guides say SPLK-1001 and SPLK-1002.

## Labs and playgrounds

Every lab and playground runs in the [IP Lab Portal](https://labs.intellectualpoint.com). You sign in to Splunk as **admin**.

[Open the IP Lab Portal](https://labs.intellectualpoint.com)

### Guided labs

Each lab takes about 45 minutes on its own Splunk machine. Open a lab page from your module in the sidebar, then click **Launch**. Starting a lab counts as an attempt.

| Lab | Module | Exam |
| - | - | - |
| [Lab 1: Exploring the Splunk Web Interface and Settings](https://splunk-training.ipoint-labs.com/spk-101/module-01/lab-01.md) | Module 1 | SPK-101 |
| [Lab 2: Getting Data Into Splunk](https://splunk-training.ipoint-labs.com/spk-101/module-04/lab-02.md) | Module 4 | SPK-101 |
| [Lab 3: Searching with Splunk](https://splunk-training.ipoint-labs.com/spk-101/module-06/lab-03.md) | Module 6 | SPK-101 |
| [Lab 4: Basic Commands](https://splunk-training.ipoint-labs.com/spk-101/module-08/lab-04.md) | Module 8 | SPK-101 |
| [Lab 5: Transforming Commands](https://splunk-training.ipoint-labs.com/spk-101/module-09/lab-05.md) | Module 9 | SPK-101 |
| [Lab 6: Creating Reports and Dashboards](https://splunk-training.ipoint-labs.com/spk-101/module-10/lab-06.md) | Module 10 | SPK-101 |
| [Lab 7: Using Pivot](https://splunk-training.ipoint-labs.com/spk-101/module-11/lab-07.md) | Module 11 | SPK-101 |
| [Lab 8: Creating Lookups](https://splunk-training.ipoint-labs.com/spk-101/module-12/lab-08.md) | Module 12 | SPK-101 |
| [Lab 9: Creating Alerts](https://splunk-training.ipoint-labs.com/spk-101/module-13/lab-09.md) | Module 13 | SPK-101 |
| [Lab 10: Beyond Search Fundamentals](https://splunk-training.ipoint-labs.com/spk-102/module-14/lab-10.md) | Module 14 | SPK-102 |
| [Lab 11: Commands for Visualizations](https://splunk-training.ipoint-labs.com/spk-102/module-15/lab-11.md) | Module 15 | SPK-102 |
| [Lab 12: Advanced Visualizations](https://splunk-training.ipoint-labs.com/spk-102/module-16/lab-12.md) | Module 16 | SPK-102 |
| [Lab 13: Filtering and Formatting Data](https://splunk-training.ipoint-labs.com/spk-102/module-17/lab-13.md) | Module 17 | SPK-102 |
| [Lab 14: Correlating Events](https://splunk-training.ipoint-labs.com/spk-102/module-18/lab-14.md) | Module 18 | SPK-102 |
| [Lab 15: Working with Knowledge Objects](https://splunk-training.ipoint-labs.com/spk-102/module-19/lab-15.md) | Module 19 | SPK-102 |
| [Lab 16: Creating and Managing Fields](https://splunk-training.ipoint-labs.com/spk-102/module-20/lab-16.md) | Module 20 | SPK-102 |
| [Lab 17: Field Aliases and Calculated Fields](https://splunk-training.ipoint-labs.com/spk-102/module-21/lab-17.md) | Module 21 | SPK-102 |
| [Lab 18: Creating Tags and Event Types](https://splunk-training.ipoint-labs.com/spk-102/module-22/lab-18.md) | Module 22 | SPK-102 |
| [Lab 19: Macros](https://splunk-training.ipoint-labs.com/spk-102/module-23/lab-19.md) | Module 23 | SPK-102 |
| [Lab 20: Workflow Actions](https://splunk-training.ipoint-labs.com/spk-102/module-24/lab-20.md) | Module 24 | SPK-102 |
| [Lab 21: Data Models](https://splunk-training.ipoint-labs.com/spk-102/module-25/lab-21.md) | Module 25 | SPK-102 |
| [Lab 22: Using the CIM](https://splunk-training.ipoint-labs.com/spk-102/module-26/lab-22.md) | Module 26 | SPK-102 |

### Playgrounds

A playground is a Splunk machine of your own to explore freely. Pick a run time of **1 hr**, **2 hr**, or **4 hr**. It shuts down automatically when the time is up.

Playground
Splunk (empty)
*A fresh Splunk instance with no data.*

Playground
Splunk with data
*Splunk with the course datasets already indexed: web access, Linux secure, and database audit logs.*

Run time
1, 2, or 4 hours
*Shuts down on its own*

Use **Splunk with data** to replay searches from class. Use **Splunk (empty)** to practice getting data in from scratch.

## Who is it for?

![Engineer avatar](https://mintcdn.com/ip-splunk-training/m8vVYMLEfGxzBfbY/images/avatars/technical.svg?fit=max\&auto=format\&n=m8vVYMLEfGxzBfbY\&q=85\&s=0d109fe5edc97d5d78d86cdb45891304)

Engineers

![Builder avatar](https://mintcdn.com/ip-splunk-training/m8vVYMLEfGxzBfbY/images/avatars/builder.svg?fit=max\&auto=format\&n=m8vVYMLEfGxzBfbY\&q=85\&s=cdff36f774d0a5fb997ea5c1106a05c6)

Builders

![Cloud architect avatar](https://mintcdn.com/ip-splunk-training/m8vVYMLEfGxzBfbY/images/avatars/admin.svg?fit=max\&auto=format\&n=m8vVYMLEfGxzBfbY\&q=85\&s=086195577388e589d1e9a603b5ceb46a)

Cloud architects

![DevOps avatar](https://mintcdn.com/ip-splunk-training/m8vVYMLEfGxzBfbY/images/avatars/operator.svg?fit=max\&auto=format\&n=m8vVYMLEfGxzBfbY\&q=85\&s=92faab73d7162d8988a7070110f1eba2)

DevOps

![Cloud engineer avatar](https://mintcdn.com/ip-splunk-training/m8vVYMLEfGxzBfbY/images/avatars/analyst.svg?fit=max\&auto=format\&n=m8vVYMLEfGxzBfbY\&q=85\&s=9570ef9b5678f0232c4cf14fb649c04d)

Cloud engineers

![Software engineer avatar](https://mintcdn.com/ip-splunk-training/m8vVYMLEfGxzBfbY/images/avatars/knowledge.svg?fit=max\&auto=format\&n=m8vVYMLEfGxzBfbY\&q=85\&s=0a1000424fb06cc99b6f705875b93e19)

Software engineers

![Developer avatar](https://mintcdn.com/ip-splunk-training/m8vVYMLEfGxzBfbY/images/avatars/finance.svg?fit=max\&auto=format\&n=m8vVYMLEfGxzBfbY\&q=85\&s=853dc12d4269cc9f400a44c8fe9461fe)

Developers

**80%** of who it's for

**20%** of who it's for

Most of the room already works with logs or dashboards. If you are new to Splunk, Module 1 starts from zero.

## Ground rules

No question is too dumb
If you are wondering it, three other people in the room are too. Ask.

Interrupt me whenever
This is a workshop, not a webinar. Stop me the moment something does not click.

Do the labs
Reading is not the same as clicking. Use the IP Lab Portal. Submit homework in MyIP Portal.

## How to move through the material

01
Open the module
Each module has its own section in the sidebar. **Module N Material** holds the slides. Start with the [course introduction](https://splunk-training.ipoint-labs.com/spk-101/module-01/introduction.md).

02
Do the lab
The lab page under the module says what you will do. Click the launch button to open it in the IP Lab Portal.

03
Sit SPK-101, then SPK-102
Finish Modules 1 to 13 for SPK-101. Modules 14 to 26 prepare you for SPK-102.

Sidebar labels stay short. Open the page for the full lesson title.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.