Splunk Core Certified User¶
The entry-level Splunk certification. It checks that you can use Splunk Enterprise or Splunk Cloud Platform as a person who asks questions of data: search it, use fields, build simple statistics, save reports, make a dashboard, enrich events with a lookup and set up a basic alert. You do not install or administer anything.
If you have never seen Splunk, this is the right first step. If you already write stats and timechart searches daily, you can skim the notes and spend your time on the blueprint's wording.
Exam Details (checked 2026-11-07)¶
- Exam Code: Not stated by Splunk
- Duration: 60 minutes total seat time (includes 3 minutes for the exam agreement)
- Questions: 60 multiple choice
- Passing Score: Not stated on the pages read
- Cost: USD 130 per attempt (listed 2026-11-07)
- Validity: Not stated on the pages read
- Prerequisites: None
- Format: Multiple choice, delivered by Pearson VUE
Full detail and sources in the fact sheet.
Domains¶
| Domain | Weight | Notes |
|---|---|---|
| Splunk Basics | 5% | 01 |
| Basic Searching | 22% | 01 |
| Using Fields in Searches | 20% | 02 |
| Search Language Fundamentals | 15% | 02 |
| Using Basic Transforming Commands | 15% | 03 |
| Creating Reports and Dashboards | 12% | 04 |
| Creating and Using Lookups | 6% | 05 |
| Creating Scheduled Reports and Alerts | 5% | 06 |
Searching, fields and the search language together are 57% of the exam. If your time is short, make those three domains automatic first.
Study sequence¶
- Learn the pipeline of forwarder, indexer and search head, then the search page layout (note 01).
- Learn field rules, the pipe, and the five named commands (note 02).
- Learn
top,rareandstatsuntil you can pick the right one from a description (note 03). - Reports, dashboards, lookups, alerts: the order of the steps matters (notes 04 to 06).
Schedule in the practice plan. Common mistakes are in scenarios and strategy.
Study resources¶
- 📖 Splunk Core Certified User page - registration and logistics
- 📖 Test blueprint (PDF) - the domains and weights this guide follows
- 📖 Splunk Search Tutorial - hands-on walk-through with sample data
- 📖 Splunk Search Reference - every command
A free way to practice is a Splunk Enterprise trial installed locally or a Splunk Cloud trial; check Splunk's current download page for terms.
Related¶
- Splunk provider page
- Datadog Fundamentals - the same job (ask questions of telemetry) in a different vendor's tool
- OpenTelemetry Certified Associate - the open standard that produces much of this data
- Prometheus Certified Associate - metrics and alerting in the open source world