Splunk Core Certified User Practice Questions: 60 Questions in 60 Minutes
Sixty questions in sixty minutes at $130, and Splunk does not publish the pass mark. The pacing is the real constraint - here is how to read SPL fast enough, with five drills on the searches that actually appear.
- 60Questions
- 60 minTime
- $130Cost
- 3 yearsValid
Table of Contents
The Splunk Core Certified User paper is 60 questions in 60 minutes and costs $130. Exactly one minute per question is the defining constraint. Splunk does not publish a pass mark or domain weights, so preparation is about reading SPL quickly rather than optimising against a weighting.
What follows is the question split by domain, then five practice questions written to Splunk’s published objectives, each with the reasoning for the right answer and for every wrong one. These are original practice items, not real exam content – the point is to show you how the questions are shaped and where the traps sit.
How the 60 questions split
Splunk lists the exam sections but does not publish percentage weights for this exam, so nobody can tell you an exact question count per domain. The honest version is below: the sections, and what an even split across a 60-question paper would look like.
| Domain | Weight | If even | |
|---|---|---|---|
| Splunk basics and navigation | not published | ~12 | |
| Basic searching and SPL fundamentals | not published | ~12 | |
| Fields, lookups and field extraction | not published | ~12 | |
| Reports, dashboards and visualisations | not published | ~12 | |
| Alerts and scheduling | not published | ~12 |
Be sceptical of precise weightings. Sites quoting exact percentages for this exam are inventing them. Splunk has not published them, so revise the sections evenly and spend your extra time on whichever one you can least explain out loud.
Five practice questions
Answer each one before reading the key underneath it.
Which search returns the ten most common values of the status field?
- A index=web | stats count by status | head 10
- B index=web | top limit=10 status
- C index=web | rare limit=10 status
- D index=web | table status | head 10
Answer: B
top returns the most common values of a field with counts and percentages, and limit=10 caps it at ten. It is the purpose-built command for this question.
Why the others fail
A This counts by status but head 10 takes the first ten rows in whatever order stats produced, which is not sorted by count.
C rare returns the least common values - the exact opposite.
D table lists raw values without aggregating, so head 10 returns ten events rather than ten ranked values.
A lookup file maps product_id to product_name. Which command enriches search results with the product name?
- A inputlookup products.csv
- B lookup products product_id OUTPUT product_name
- C outputlookup products.csv
- D join products.csv
Answer: B
lookup enriches events already in the pipeline by matching a field against the lookup and adding the requested output fields.
Why the others fail
A inputlookup reads the lookup file itself as the search result set, replacing your events rather than enriching them.
C outputlookup writes results out to a lookup file - the opposite direction.
D join joins two searches and is not the syntax for applying a lookup table.
What is the practical difference between saving a search as a report and saving it as an alert?
- A A report can be scheduled; an alert cannot
- B An alert runs on a schedule or in real time and triggers actions when its condition is met; a report produces results for viewing or sharing
- C Reports are private and alerts are always shared
- D Alerts cannot be based on a search
Answer: B
An alert is a search plus a triggering condition plus actions such as email or a webhook. A report is a saved search whose output you view, schedule or embed.
Why the others fail
A Reports can be scheduled too, which is exactly why the distinction is the triggering condition rather than scheduling.
C Permissions on both are set by the owner and are unrelated to the object type.
D An alert is built on a search by definition.
Selecting a narrower time range before running a search matters most because:
- A Splunk charges per search regardless of range
- B The time range determines how many events are scanned, which drives how fast the search returns
- C Searches fail if the range exceeds 24 hours
- D Field extraction only works on ranges under one hour
Answer: B
Time range is the first and biggest filter in Splunk. Narrowing it reduces the events scanned, which is the single most effective thing a new user can do for search performance.
Why the others fail
A Licensing is based on indexed data volume, not on searches run.
C Ranges far longer than 24 hours are routine.
D Field extraction is unrelated to the length of the time range.
An alert should fire when failed logins exceed 50 in five minutes. Which pairing is correct?
- A A real-time alert with a per-result trigger condition
- B A scheduled alert running every five minutes with a trigger condition on the number of results
- C A report scheduled every five minutes with an email action
- D A dashboard panel refreshing every five minutes
Answer: B
The requirement is a threshold over a window, which maps to a scheduled search on that window with a trigger condition comparing the result count against 50.
Why the others fail
A A per-result condition fires on each matching event, which would trigger on the first failed login rather than the fiftieth.
C A scheduled report emails results unconditionally; it has no threshold to evaluate.
D A dashboard displays data. It notifies nobody.
What catches people out
- Sixty questions in sixty minutes. If a question needs more than a minute, flag it and move - the clock fails more candidates here than the content does.
- Splunk does not publish the pass mark or the domain weights. Any site quoting an exact percentage is inventing it; work from the official test blueprint instead.
- Know which command belongs at which stage of the pipeline. top versus stats, lookup versus inputlookup, and report versus alert are the recurring confusions.
- This is the entry-level credential and assumes no prior Splunk experience, so questions test the intended use of a command rather than exotic syntax.
What it really costs to pass
The sticker price is $130, but that is the cost of passing first time. The number worth budgeting is different.
- First attempt: $130.
- Resit: Splunk does not publish a discounted resit alongside the headline fee, so budget a second full fee unless the official page says otherwise when you book.
- Renewal: the credential lasts 3 years, so the honest cost is the fee divided across that period, plus whatever renewal Splunk requires at the end of it.
- Your time: 60 minutes in the chair, and realistically several weeks of preparation before it. That is the largest cost on this list and the only one you cannot pay to avoid.
There is no published pass mark. Splunk does not publish one for this exam, so you cannot calculate how many mistakes you can afford. Prepare for a comfortable margin rather than aiming at a threshold nobody has stated.
Who should sit it: there are no formal prerequisites. Going in well under that bar is usually how people end up paying the fee twice.
How to prepare
A workable sequence for this exam, assuming you already work near the material:
- Read the official guide first. Everything on this page is secondary to what Splunk publishes at the link in the sidebar, and guides get revised.
- Work the heaviest domain until you can teach it. Use the table above to decide which one that is.
- Practise under the clock. 60 minutes for 60 questions is roughly 60 seconds each. Knowing the material and being able to apply it at that pace are different skills.
- Review every wrong answer to the level of the distractor. Being able to say why the other three options fail is what turns a 60% into a pass.
Frequently asked questions
How many questions are on the Splunk Core Certified User exam?
Sixty multiple-choice questions with a 60-minute limit, which works out at exactly one minute per question.
What is the passing score for SPLK-1001?
Splunk does not publish a passing score for this exam. It is scored on a scaled basis and reported as pass or fail.
How much does the Splunk Core Certified User exam cost?
$130 USD per attempt, delivered through Pearson VUE.
Do I need Splunk experience before taking this exam?
No. Splunk positions it as entry level for candidates with little or no Splunk experience, including career changers and analysts new to the platform.
Sources
Every figure on this page comes from the certifying body rather than a third-party summary:
Checked September 2, 2026. Formats and fees change – confirm against Splunk before you pay for anything.