Splunk Core Certified User Fact Sheet¶
Exam Overview¶
Exam Code: Not stated on the Splunk certification page or the test blueprint Exam Name: Splunk Core Certified User Level: Foundational (the blueprint and page both say entry-level) Duration: 60 minutes total seat time, which includes 3 minutes to review the exam agreement Format: Multiple choice, delivered by Pearson VUE Questions: 60 Passing Score: Not stated on the pages read Cost: USD 130 per exam attempt (listed 2026-11-07) Valid For: Not stated on the pages read Prerequisites: None (no prerequisite exams) Languages: Not stated on the pages read
Verified facts and sources (checked 2026-11-07)¶
| Fact | Value | Source |
|---|---|---|
| Name, level, delivery | Splunk Core Certified User, entry-level, Pearson VUE | Splunk certification page |
| Questions and time | 60 questions, 60 minutes (includes 3 minutes for the agreement) | page and test blueprint |
| Price | USD 130 per attempt | Splunk certification page |
| Prerequisites | None | page and blueprint |
| Domains and weights | 8 domains, listed below | test blueprint (PDF read with a text extractor) |
| Registration | Candidates use Cisco's registration, exam history and support | Splunk certification page |
| Passing score, validity, retake policy, languages | Not stated | Not on the pages read; the page links separate FAQs that were not read |
Verify before booking. Splunk certification moved to Cisco's systems, and the blueprint says its guidelines may change at any time without notice. Confirm price, policy and the current blueprint on the official page. Items marked "not stated" were not on the pages read, so this guide does not guess them.
Exam Domains (from the test blueprint)¶
| # | Domain | Weight | Notes |
|---|---|---|---|
| 1.0 | Splunk Basics | 5% | 01 |
| 2.0 | Basic Searching | 22% | 01 |
| 3.0 | Using Fields in Searches | 20% | 02 |
| 4.0 | Search Language Fundamentals | 15% | 02 |
| 5.0 | Using Basic Transforming Commands | 15% | 03 |
| 6.0 | Creating Reports and Dashboards | 12% | 04 |
| 7.0 | Creating and Using Lookups | 6% | 05 |
| 8.0 | Creating Scheduled Reports and Alerts | 5% | 06 |
Topics listed under each domain¶
- Splunk Basics: Splunk components, uses of Splunk, apps, customizing user settings, basic navigation
- Basic Searching: run basic searches, set the time range, identify the contents of results, refine searches, use the timeline, work with events, control a search job, save results
- Using Fields in Searches: understand fields, use fields in searches, use the fields sidebar
- Search Language Fundamentals: review basic commands and practices, examine the search pipeline, specify indexes, use
table,rename,fields,dedupandsort - Basic Transforming Commands:
top,rare,stats - Reports and Dashboards: save a search as a report, edit reports, statistics and visualization reports, create a dashboard, add a report to it, edit it
- Lookups: describe lookups, examine a lookup file, create a file and a definition, configure an automatic lookup, use it in searches
- Scheduled Reports and Alerts: describe and configure scheduled reports, describe and create alerts, view fired alerts
Suggested training (from the blueprint)¶
The blueprint lists these Core Certified User learning path courses as suggested and non-exhaustive: Intro to Splunk, Using Fields, Scheduling Reports and Alerts, Visualizations, Working with Time, Statistical Processing, Leveraging Lookups and Subsearches, Search Optimization. It also says candidates may use the Splunk How-To YouTube channel and Splunk Docs.
Related¶
- Same ladder, next step: Splunk Core Certified Power User (listed on the same Splunk page; not covered by a guide here)
- Splunk provider page