Splunk Certified Developer

SPLK-2001 (Splunk Certified Developer) is a professional certification for Splunk platform development. Key difficulty factors: (1) Solid Python programming skills are required for custom search command development and Modular Inputs development using the Python Splunk SDK; (2) The REST API section tests HTTP request construction, authentication methods (Session Token vs Bearer Token vs Basic Auth), and common endpoint usage; (3) Dashboard development in Simple XML and Dashboard Studio requires basic frontend technology understanding (HTML/CSS/JavaScript); (4) Understanding Splunk App directory structure conventions and Add-on metadata configuration is essential. Recommend having SPLK-1002 as a foundation with intermediate Python skills, with 4-8 weeks of preparation time.

REST API accounts for approximately 20% of SPLK-2001. Core topics: (1) Authentication: Session Token (obtained via /services/auth/login) vs Bearer Token (recommended in Splunk 9.x) vs Basic Auth — differences and use cases; (2) Common endpoints: /services/search/jobs (create search jobs), /services/search/jobs/{sid}/results (get results), /services/data/inputs (manage inputs), /services/apps/local (manage apps); (3) Data ingestion: writing events via /services/receivers/simple and HTTP Event Collector (/services/collector); (4) KV Store operations: CRUD via /servicesNS/.../storage/collections/data/{collection}; (5) Response formats: XML vs JSON output (output_mode=json parameter). Focus on constructing correct HTTP request headers and handling responses.

Yes, custom development capabilities are core SPLK-2001 topics. Key knowledge: (1) Custom command types: Streaming (processes each event independently — efficient) vs Reporting (aggregates all events before processing) vs Eventing (can generate new events) — understand the differences; (2) Python SDK development workflow: inherit the appropriate base class, implement transform()/reduce() methods, register the command in commands.conf; (3) Modular Inputs: define scheme.xml describing input parameters, implement data collection logic, configure triggers in inputs.conf; (4) Splunk Add-on Builder can simplify Add-on and Modular Input development; (5) Debugging and logging: use the logging module to write to splunkd.log, search debug info via index=_internal.

Both are within exam scope with different emphasis. Key differences: (1) Simple XML is the traditional Splunk dashboard framework using XML declarative syntax for panels/charts/inputs — mature and stable, supports deep customization via JavaScript extension points; (2) Dashboard Studio (formerly React Dashboard) is the new framework using JSON configuration, natively supporting richer visualization types and layouts — Splunk's recommended future direction; (3) The exam still emphasizes Simple XML, testing XML tag structure, token variable passing, drilldown configuration, and form input (time range, dropdowns) configuration; (4) Dashboard Studio primarily tests basic JSON configuration structure and Simple XML migration; (5) Custom CSS and JavaScript: injected through the /appserver/static/ directory.

KV Store is an important SPLK-2001 topic, accounting for approximately 10-15%. Key knowledge: (1) KV Store definition: define collection structure in collections.conf (field types: string/number/boolean/array); (2) Access permissions: define lookup tables in transforms.conf, set permissions in metadata; (3) SPL operations: | outputlookup to write, | inputlookup to read, | lookup for join queries; (4) REST API operations: GET (query), POST (insert), PUT (replace), DELETE via /servicesNS/.../storage/collections/data/{collection}; (5) SDK operations: use Python SDK's KVStore class for CRUD; (6) Bulk operations: batch_save() for performance. KV Store's advantages over CSV Lookup include REST API dynamic updates, concurrent write support, and no filesystem access requirements.

SPLK-2001 is an important credential in Splunk development: (1) Suitable roles: Splunk Platform Engineer, Splunk App Developer, Security Integration Developer, SIEM Engineer; (2) Certification path context: SPLK-2001 follows the development track, distinct from the administration track (SPLK-1003) and analysis track (SPLK-1002) — different career paths; (3) Market demand: growing enterprise need to extend Splunk functionality including REST API integrations with ServiceNow, Jira, AWS, and customized dashboard development; (4) Salary range: in Australian and North American markets, Splunk developers typically earn $90K-$130K AUD annually; (5) Recommend taking SPLK-2001 after SPLK-1002 to build a combined 'analysis + development' Splunk expert profile. Certification is valid for 3 years.