FirstTry

Certification guide

Cloud Certified Admin

Splunk Cloud Certified Admin: the honest guide

The Splunk Cloud Certified Admin is 60 multiple choice questions in 75 minutes, closed book, at Pearson VUE for $130 an attempt, with the Core Certified Power User as the prerequisite. Splunk rates it professional and writes the track page for two people: the administrator whose organization is new to Splunk Cloud, and the on premises administrator migrating to it.

The blueprint is 13 areas. Getting Data in Cloud and Monitor Inputs carry 15 percent each; Network and Other Inputs, Parsing Phase and Data Preview and Manipulating Raw Data carry 10 percent each; and Splunk Cloud Overview, Index Management, User Authentication and Authorization, Splunk Configuration Files, Forwarder Management, Fine-tuning Inputs, Installing and Managing Apps and Working with Splunk Cloud Support carry 5 percent each.

Sixty percent of the marks are data ingestion, most of which happens on forwarders you still run yourself. The Cloud specific part is knowing what you can no longer touch and how to work with Splunk on the rest.

Who Cloud Certified Admin is for

A good fit if

  • You administer a Splunk Cloud Platform stack and own the forwarders, inputs and sourcetypes feeding it.
  • You are an on premises Splunk Enterprise admin whose organization is migrating to Splunk Cloud, which is the second person the track page names.
  • You are a Core Power User whose next role is platform administration in a Cloud environment, since the Power User is the only certification this exam requires.
  • You hold the Advanced Power User and want the certification the handbook lists as one of its two next level options, which renews it along with the Power User and User.

Probably not, if

  • Your deployment is and will stay on premises. The Enterprise Certified Admin covers the same ingestion with the indexer and cluster side you actually manage, and it leads to the Architect.
  • You do not hold the Core Certified Power User, which the track page lists as the prerequisite.
  • You have no way to touch a Splunk Cloud stack. The trial is 14 days and the Cloud specific areas are hard to answer from a description.

Is Cloud Certified Admin worth it?

For a Splunk Cloud administrator it is $130 with free preparation and it is the credential Splunk names for the role. It also renews the Advanced Power User, Power User and User beneath it.

Its limit is that the handbook lists no next level option above it, so renewal is only by retaking the exam in the final year, and the on premises Architect path does not run through it.

If your organization is mid migration, this is the exam that matches where you will be in three years, which is the renewal horizon.

What the exam actually asks you to do

60 multiple choice questions and nothing else. Splunk sets no lab and no simulation on this exam, so the practice that matters is reading a scenario and choosing well under the clock.

Item formats

  • Multiple choice

Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. Splunk, Splunk Cloud Certified Admin certification track ↗

Domain breakdown and official weightings

From the official Splunk certification tracks. Getting Data in Cloud is the heaviest domain at 15 percent, followed by Monitor Inputs at 15 percent.

  • Splunk Cloud Overview5%
  • Index Management5%
  • User Authentication and Authorization5%
  • Splunk Configuration Files5%
  • Getting Data in Cloud15%
  • Forwarder Management5%
  • Monitor Inputs15%
  • Network and Other Inputs10%
  • Fine-tuning Inputs5%
  • Parsing Phase and Data Preview10%
  • Manipulating Raw Data10%
  • Installing and Managing Apps5%
  • Working with Splunk Cloud Support5%

Where to focus: Getting Data in Cloud and Monitor Inputs are 15% each, and with Network and Other Inputs, Parsing Phase and Data Preview and Manipulating Raw Data at 10% each, data ingest is 60% of the exam. Study the inputs first.

Splunk: Splunk certification tracks ↗

Study plans by experience level

Working Splunk Cloud admin

4 to 5 weeksat 4 to 6 hours

  1. 1Read the blueprint and mark what you do not do, which is usually parsing and raw data manipulation if your sourcetypes were set up before you arrived.
  2. 2On a free Splunk Enterprise license, build props and transforms for a messy log by hand and check them with data preview, since Parsing Phase and Data Preview and Manipulating Raw Data are 20 percent together.
  3. 3Walk your own stack's index management, authentication, app installation and support workflow with the blueprint open, writing down what a Cloud admin can and cannot change.
  4. 4Take timed practice sets and book once the flagged sections stop repeating.

On premises admin migrating to Splunk Cloud

5 to 7 weeksat 5 to 7 hours

  1. 1Start with the Cloud specific areas, overview, index management, apps and working with Splunk Cloud Support, because the ingestion material is what you already know.
  2. 2Start the 14 day Splunk Cloud Platform trial once you reach those areas and spend it on the admin interfaces rather than on searching.
  3. 3Do Exploring Splunk Platform Ecosystems and Introduction to Edge Processor from the free training page to see how Cloud ingestion differs from your deployment.
  4. 4Finish with timed practice sets and a one page list of the settings you used to change in configuration files that are now managed differently.

Power User new to administration

8 to 10 weeksat 6 to 8 hours

  1. 1Install a free Splunk Enterprise license and a universal forwarder on a second machine, and spend the first month on inputs, forwarder management, parsing and raw data manipulation, which is the same software in Cloud.
  2. 2Work through Splunk Enterprise Installation and Configuration and Exploring Splunk Platform Ecosystems from the free training page.
  3. 3Start the 14 day Cloud trial in the final month and use it for index management, authentication, app installation and the support workflow.
  4. 4Take timed practice sets in the last two weeks and book more than 48 hours out.

Common mistakes

Starting the Cloud trial too early
The Splunk Cloud Platform trial is 14 days. If you start it on day one, it expires while you are still on forwarders and parsing, which you can practice on a free Enterprise license that lasts.
Assuming the Enterprise Admin material is enough
The ingestion areas overlap, but Splunk Cloud Overview, Index Management, Installing and Managing Apps and Working with Splunk Cloud Support are 20 percent that the Enterprise blueprint does not have.
Under studying monitor inputs
Monitor Inputs is 15 percent on its own, the joint largest area. Whitelists, blacklists, crcSalt and the difference between monitor and batch deserve more than a glance.
Skipping parsing because Splunk manages the indexers
Parsing Phase and Data Preview and Manipulating Raw Data are 20 percent together. Line breaking, timestamp extraction, masking and routing are still your configuration, wherever they run.
Opening the documentation
The exam is closed book and the handbook names Splunk Docs as prohibited material. A perceived violation is an automatic failure with the fee forfeited.

What comes after passing

Put the renewal date in your own calendar. The handbook lists no next level option for the Cloud Admin, so it renews only by a $130 retake in the final year of the three year window.

If you also hold the Advanced Power User, Power User or User, their dates now match this one, since the handbook's downstream table lists all three as renewed by the Cloud Admin.

Claim the Credly badge on a personal email address, which the handbook recommends.

Costs across the full renewal cycle are on the Cloud Certified Admin cost page.

Frequently asked questions

What is the prerequisite?

The Splunk Core Certified Power User, which the track page lists as required. No coursework is required for this exam.

How different is it from the Enterprise Admin?

The ingestion areas overlap heavily, and the Cloud exam adds index management, app installation and working with Splunk Cloud Support while dropping the indexer side clustering and license work. It is also 75 minutes for 60 questions rather than 60 minutes for 56.

Is there a passing score?

Splunk does not publish one. Pass or fail appears on submission, and a failing candidate sees section feedback in the Pearson VUE account.

How do I renew it?

By retaking the Cloud Admin exam in the final year of the three year window. The handbook lists no next level option for it. There is a 90 day grace period and no extensions.

Does it renew my other Splunk certifications?

Yes. The handbook's downstream table lists the Advanced Power User, Power User and User as renewed when you pass the Cloud Admin, with badges updated only where the certification is already held.

Keep reading

Every guide and cost breakdown, by vendor

Practice Cloud Certified Admin for free while you decide

Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.

Start free Cloud Certified Admin questions