Splunk Core Certified User (SPLK-1001): Guide 2026

What is Splunk Core Certified User?

The Splunk Core Certified User certification is the entry-level credential for Splunk professionals. It validates your ability to navigate Splunk, use search commands, create reports, alerts, and dashboards in Splunk Enterprise or Splunk Cloud.

This certification is designed for candidates with little to no prior Splunk experience and serves as the foundation for the Splunk certification track.

Exam Topics

• Splunk Basics: Interface navigation, apps
• Basic Searching: Search commands, time ranges
• Using Fields: Field extraction, sidebar
• Reports and Dashboards: Creating, saving
• Alerts: Creating and managing alerts
• Lookups: Using lookup tables

Key Skills

Search Fundamentals

• Search Processing Language (SPL) basics
• Boolean operators and wildcards
• Time range selection
• Search modes (Fast, Smart, Verbose)

Working with Fields

• Extracted vs selected fields
• Field operators and comparisons
• Statistical commands (stats, chart, timechart)

Visualization

• Creating reports
• Building dashboards
• Chart types and options
• Sharing and scheduling

Certification Path

• Core Certified User (this exam)
• Core Certified Power User
• Core Certified Advanced Power User
• Enterprise Certified Admin

Career Impact

• Average salary: $70,000 - $95,000 USD
• SOC Analyst and Security roles
• IT Operations and monitoring positions
• Foundation for advanced Splunk certs