Am I Ready for Splunk Core Certified User? Checklist (2026)
Tick what you can do today, without notes. The board scores you against the Splunk outline and says GO, HOLD or NO-GO before you spend US$130 on a booking.
- 60Questions
- 60 minTime
- Not publishedPass mark
- US$130Fee
- Pearson VUEDelivery
Table of Contents
Splunk Core Certified User is the entry point to Splunk's certification track, which Cisco now runs. It is aimed at people with little or no Splunk background: analysts, SOC and IT operations staff, career changers and new customers who need to show they can search data, work with fields and lookups, and build basic reports, dashboards and alerts in Splunk Enterprise or Splunk Cloud. There are no prerequisite exams or required courses.
Ready for this exam means fluency at the search bar, not memorised definitions. Basic Searching and Using Fields carry 42% of the blueprint between them, and 60 questions in just under an hour leave no time to puzzle over SPL syntax. If you can do the items below in a live Splunk instance without checking the docs, and predict what a search returns before you run it, book it. If you still learn SPL by reading rather than typing, spend another week in a trial instance first.
How to use this checklist
Tick only what you can do today, without notes. Each tick is weighted by its domain's share of the official outline, so the score follows the exam, not the number of boxes. A heavy domain (15%+ of the weight) at NO-GO holds the verdict even when the total looks fine. Your ticks are saved in this browser only.
The Splunk Core Certified User readiness checklist
26 items across 8 domains, each one a thing the exam expects you to do rather than recognise.
Your go / no-go board
One lamp per domain, one verdict overall. Amber and red rows are your study plan for the next week or two.
Check your ticks under exam conditions
A tick is a claim; a timed set of questions is the evidence. ExamCert AI has exam-style Splunk Core Certified User questions with an explanation for every option. Do a mixed set and see whether the domains you ticked hold up.
Practise on ExamCert AISplunk Core Certified User practice questionsRed flags: don't book yet if...
Any one of these on the Splunk Core Certified User is a better predictor of a fail than a low tick count.
You have never typed SPL into a real instance
The blueprint is about doing things: running searches, using the fields sidebar, saving reports, building lookups. The exam is closed-book, and recognising a command on a slide is not the same as knowing what it returns.
Fix:Install a free Splunk Enterprise trial or start a Splunk Cloud trial, load Splunk's tutorial data and work through every item on this page by hand.
You skipped the free learning-path courses
Splunk's blueprint lists the Core Certified User learning path as its suggested training, and several of those courses are free eLearning: Intro to Splunk, Using Fields, Visualizations, Working with Time, Statistical Processing, Scheduling Reports and Alerts, and Enriching Data with Lookups.
Fix:Finish the free courses that map to your weakest blueprint topics before booking, and repeat their labs in your own instance.
stats, top and rare outputs blur together
Transforming commands are 15% of the exam, and typical items show a search and ask what the result table looks like. Mixing up count, percent and the by-clause loses easy marks.
Fix:Run top, rare and stats count by against the same field in one session and compare the columns until you can predict each output.
You need more than a minute per question
The 60 minutes include the 3 minutes for the certification agreement, which leaves under a minute for each of the 60 questions.
Fix:Do timed sets of 20 questions in 18 minutes. If you keep running over, the gap is usually syntax recall, so go back to typing searches.
Your Cisco account is not ready
From 20 October 2026 registration runs through Cisco's Certmetrics portal. Splunk says accounts were migrated, but if your Splunk and Cisco records did not merge you may not see your exam history or vouchers.
Fix:Sign in to Certmetrics with the email tied to your Splunk records well before booking, and open a Learn with Cisco Help Center case if anything is missing.
The numbers that say you're ready
Rules of thumb, not official thresholds: Splunk does not publish a readiness score. Hit all four before you pay for a booking.
Rule of thumb, not a Splunk figure: Splunk publishes no pass mark, so aim for a margin on 60 fresh questions inside the real time limit.
Rule of thumb. Write ten searches covering time ranges, field filters, stats, top and rare, lookups and table without opening Splunk Docs; each should run correctly first time.
Rule of thumb. Before running a search, sketch the columns and rough row count it will return. Exam items test exactly this kind of prediction.
Rule of thumb. Basic Searching (22%) and Using Fields (20%) are 42% of the blueprint, so weakness there cannot be offset by the 5-6% topics.
Booking and ID checklist
The logistics that trip people up are specific to the Splunk Core Certified User and its delivery provider. Work through them in order.
Sort out your account
From 20 October 2026, register through Cisco's Certmetrics portal using the email tied to your Splunk certifications; you may be asked to create a Cisco.com account. Your registration name must match your photo ID.
Pay or apply a voucher
Each attempt costs US$130, or US$500 for five registrations. Existing Splunk vouchers stay valid under Cisco, and Splunk Education training units can be converted (13 units for one voucher).
Request accommodations first
Accommodations such as extra time or a separate room must be approved before you schedule your first attempt; they cannot be added to an existing appointment. Open a case with the Learn with Cisco Help Center.
Choose centre or online
Pearson VUE delivers the exam at a test centre or online with a live proctor. Pick the test centre if your computer, network or room may not meet online requirements.
Pass the online system test
Online candidates must pass Pearson's system test on the same computer and in the same location they will use, with admin rights to install the software. A failed setup after the 48-hour deadline is unlikely to be refunded.
Last chance to change
Reschedule or cancel at least 48 hours before the appointment. Later changes, or not showing up, forfeit the registration fee.
Bring two forms of ID
Splunk requires a valid photo ID plus a second form showing your legal name, such as a credit card. Candidates must be 18 or over; 13-17 year olds need a signed parental form.
Exam-week countdown: T-7 to T-0
Sit a timed 60-question practice set, sort every miss by blueprint topic and rerun the matching searches in your instance until you get the expected output first time.
Rebuild the small things end to end: a CSV lookup with an automatic lookup, a scheduled report, an alert with throttling and a dashboard panel. Then drill stats, top and rare side by side.
Read the Splunk Certification Agreement now, because you only get 3 minutes for it in the exam. Rerun the online system test or check the centre route, and put both IDs out.
Accept the agreement promptly, then keep to under a minute per question. Flag anything that needs thought, use the final review screen, and remember the score is final once you submit.
Test-day rules
✓ Allowed / expected
- A valid photo ID plus a second ID showing your legal name, matching your exam registration
- Flagging questions for review and changing answers on the final review screen before submitting
- A running on-screen clock to manage your time
- Testing accommodations that were approved before your first appointment was booked
✕ Not allowed
- Splunk Docs, Splunk Answers, course notes or any other reference material: the exam is closed-book
- Phones, notes or another person in the room during an online exam
- Retaking an exam you have already passed, unless it is for an approved recertification
- Copying, recording or sharing exam content, which breaches the Splunk Certification Agreement
After you pass
Result straight away
Pass or fail appears as soon as you submit. Test-centre candidates get a printout; online candidates can print a score report from their account. Passing candidates get no further detail, while failing candidates can see section-level feedback, though never question by question.
Credly badge via Cisco
Passing earns a Splunk digital badge issued through Credly, now listed on Cisco's Credly page. You can view your certifications in Certmetrics or Credly; use a personal email so the badge stays with you if you change jobs.
Three-year lifecycle
The certification lasts three years. Renew it by passing Splunk Core Certified Power User, which also renews Core User, or by retaking this exam in the final year of the cycle. Splunk allows a 90-day grace period before certifications go inactive.
The Splunk Core Certified User at a glance
| Item | Detail |
|---|---|
| Questions | 60 multiple-choice questions |
| Time | 60 minutes, including 3 minutes to review and accept the Splunk Certification Agreement |
| Passing score | Not published by Splunk; you see only pass or fail |
| Fee | US$130 per attempt, or 5 exam registrations for US$500 |
| Delivery | Pearson VUE test centre or online proctored; registration through Cisco's portal from 20 October 2026 |
| Retakes | Wait 7 days after a first fail, 14 days after a second, then 28, 56 and 56 days; beyond 6 attempts only at Splunk's discretion; full fee each time |
| Results | Pass/fail on screen as soon as you submit; failing candidates get section feedback in their Pearson account |
| Validity and renewal | 3 years; renew by passing Core Certified Power User or by retaking this exam in the final year, with a 90-day grace period |
Turn the amber rows green
Work Splunk Core Certified User questions by domain, starting with whatever the board marked HOLD or NO-GO, then tick again.
Practise on ExamCert AISplunk Core Certified User practice questionsFAQ
Do I need training or experience before the Splunk Core Certified User exam?
No. Splunk lists no prerequisites and describes the exam as an optional entry point for candidates with little to no Splunk experience. Its blueprint suggests the Core Certified User learning path, and several of those courses are free eLearning, including Intro to Splunk, Using Fields and Visualizations. Hands-on time in a trial instance matters more than any course.
How many questions are on SPLK-1001 and how long do I get?
The exam has 60 multiple-choice questions and a 60-minute limit. That time includes 3 minutes to review and accept the Splunk Certification Agreement, so you really have about 57 minutes for the questions, or just under a minute each. You can flag questions and change answers on the review screen before submitting.
What is the passing score for Splunk Core Certified User?
Splunk does not publish a passing score for its certification exams. You see pass or fail on screen as soon as you submit, and failing candidates can view section-level feedback in their account. Ignore percentages quoted on third-party sites, and aim instead for consistent scores well above 80% on fresh, timed practice questions.
Where do I register now that Splunk is part of Cisco?
From 20 October 2026, new registrations for Splunk exams go through Cisco's certification portal, Certmetrics, and you no longer need a Splunk ID. Sign in with the email linked to your Splunk certifications. Appointments booked before the switch are honoured until 1 March 2027, active vouchers still work, and support moves to the Learn with Cisco Help Center.
What happens if I fail SPLK-1001?
You can retake it 7 days after a first fail and 14 days after a second. Further attempts need waits of 28, 56 and 56 days, and attempts beyond the sixth are at Splunk's discretion. Every attempt costs the full US$130. Use the section feedback in your account to decide what to practise before you rebook.
Sources
Figures on this page come from Splunk and the other primary sources below:
- Splunk Core Certified User certification track
- Splunk Core Certified User test blueprint (PDF)
- Splunk Certification Candidate Handbook (PDF)
- Upcoming Splunk Certification Changes FAQ (PDF)
- Splunk Training and Certification FAQ
- Splunk free training courses
Checked October 14, 2026. Fees, outlines and eligibility rules change — confirm with Splunk before you book.