Execution layer

Turn curiosity into a study schedule that produces visible outcomes.

These playbooks convert the homepage guidance into 30-60-90 day action plans, portfolio ideas, and interview preparation steps.

Non-tech playbook

30-60-90 day plan for non-technical learners

Days 1-30

Finish the fundamentals overview and create a glossary notebook.
Watch or read enough material to explain logs, alerts, dashboards, fields, and incidents without jargon.
Study three real use cases: failed login monitoring, website error tracking, and service outage detection.
Write one page describing how a SOC team uses data during incident triage.

Days 31-60

Start reading dashboards and sample searches.
Practice telling the difference between data source, field, event, and report.
Create two mini presentations: one for business stakeholders, one for a technical team lead.
Translate five common security or operations problems into plain-English questions a dashboard should answer.

Days 61-90

Build a beginner portfolio: one glossary, one dashboard explanation, one incident summary, one learning roadmap.
Record yourself explaining why machine data matters and refine until you sound precise instead of vague.
Start light SPL literacy so you can read simple examples during interviews.
Package the journey for LinkedIn, resume bullets, and screening calls.

Technical playbook

30-60-90 day plan for practitioners

Days 1-30

Learn the data model of the platform: index, host, source, sourcetype, event, field.
Master core SPL commands and keep a command notebook with examples and failure notes.
Ingest at least one clean dataset and build three useful searches from it.
Understand why field quality determines almost everything downstream.

Days 31-60

Create dashboards and scheduled alerts tied to actual questions.
Practice extraction, enrichment, and normalization on messy data.
Write simple detections and tune them until they are interpretable.
Learn role design, app separation, and retention basics.

Days 61-90

Complete a small investigation using endpoint, authentication, or web data.
Write a detection pack with a search, expected behavior, false-positive notes, and response guidance.
Document a secure deployment checklist for a small team.
Publish or save screenshots and explanations that demonstrate evidence of work.

Proof of work

Portfolio ideas that actually help

For non-tech

A dashboard interpretation pack
A glossary in plain language
A short case study on a simulated incident
A learning roadmap that shows structured thinking

For tech

Three tuned SPL searches with explanations
A dashboard pack with business purpose
An alerting workflow with tuning notes
A detection write-up using sample logs or BOTS data

Interview prep

Questions you should be ready for

Non-tech interview prompts

What problem does Splunk solve for a company?
What is the difference between a dashboard and an alert?
How would you explain a spike in failed logins to a manager?
Why is clean data important even for non-engineers?

Technical interview prompts

How do index, source, and sourcetype differ?
How would you debug a search returning inconsistent results?
What makes a detection useful instead of noisy?
How would you onboard a new data source safely?