Certification guide
Core Certified Power UserSplunk Core Certified Power User: the honest guide
The Splunk Core Certified Power User is 65 multiple choice questions in 60 minutes, closed book, delivered by Pearson VUE for $130 an attempt. The track page lists no prerequisite and calls it an entry level exam that establishes a baseline for users of Splunk Enterprise and Splunk Cloud Platform.
The blueprint is about knowledge objects. Correlating Events carries 15 percent, and Filtering and Formatting Results, Creating and Managing Fields, Creating Field Aliases and Calculated Fields, Creating Tags and Event Types, Creating and Using Macros, Creating and Using Workflow Actions, Creating Data Models and Using the Common Information Model Add-On carry 10 percent each, with Using Transforming Commands for Visualizations at 5 percent.
It is the certification the rest of the Splunk program hangs off. The Advanced Power User, the Enterprise Certified Admin and the Cloud Certified Admin all list it as their prerequisite, and passing any of those three later renews it.
Who Core Certified Power User is for
A good fit if
- You search Splunk daily and now need to make the data usable for other people: field extractions, aliases, calculated fields, tags, event types and macros.
- You are heading for a Splunk admin or architect role. This is the prerequisite for the Enterprise Certified Admin, the Cloud Certified Admin and the Advanced Power User, so there is no way round it.
- You work in a security team on Splunk Enterprise Security and keep hearing about CIM compliance. Using the Common Information Model Add-On is a full 10 percent of this blueprint.
- You want one Splunk credential that keeps working. Passing it renews a Core User you hold and it is renewed in turn by every exam above it.
Probably not, if
- You have never run a search with stats or eval. Splunk lists no prerequisite, but the exam assumes the searching, fields and transforming commands of the Core User, so start there or study that material first.
- You are after the deployment side, indexes, forwarders and clustering. That is the admin and architect track, and this exam is only the ticket to it.
- You want to pass by reading. Knowledge objects are created through the interface and configuration, and questions about what a field alias, tag or event type does to a search are much easier when you have built each one.
Is Core Certified Power User worth it?
It costs $130, has free preparation, and is required before three other Splunk exams. If you intend to hold any Splunk certification beyond the User, you will hold this one.
Splunk's own track page frames it as the gateway to administrator, architect and consultant, and the handbook's renewal tables back that up: this is the certification that everything above it renews.
Where it is not worth it is as a standalone credential for someone who does not use Splunk. The blueprint is product specific, and a three year cycle with renewal only by exam means it needs to be kept up.
What the exam actually asks you to do
65 multiple choice questions and nothing else. Splunk sets no lab and no simulation on this exam, so the practice that matters is reading a scenario and choosing well under the clock.
Item formats
- Multiple choice
Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. Splunk, Splunk Core Certified Power User certification track ↗
Domain breakdown and official weightings
From the official Splunk certification tracks. Correlating Events is the heaviest domain at 15 percent, followed by Filtering and Formatting Results at 10 percent.
- Using Transforming Commands for Visualizations5%
- Filtering and Formatting Results10%
- Correlating Events15%
- Creating and Managing Fields10%
- Creating Field Aliases and Calculated Fields10%
- Creating Tags and Event Types10%
- Creating and Using Macros10%
- Creating and Using Workflow Actions10%
- Creating Data Models10%
- Using the Common Information Model (CIM) Add-On10%
Where to focus: Eight of the ten sections carry 10% each, so this blueprint is unusually flat: no single topic can be traded away. Correlating Events is the one weighted section at 15%.
Study plans by experience level
Daily Splunk searcher, no knowledge objects yet
4 to 6 weeksat 5 to 7 hours
- 1Stand up the free Splunk Enterprise license at home and install the Common Information Model add-on on it, so every knowledge object you study is one you have created.
- 2Work through Intro to Knowledge Objects, Creating Knowledge Objects and Creating Field Extractions from the free training page, building each object type on your own data.
- 3Do Enriching Data with Lookups, Data Models, Comparing Values, Result Modification and Working with Time, then map one of your own sourcetypes to a CIM data model.
- 4Finish with timed practice sets and a written one page summary of what each object type does at search time, which is the form most questions take.
Coming straight from the Core User
3 to 4 weeksat 5 to 7 hours
- 1Reuse the home instance from the User exam and add the CIM add-on to it.
- 2Cover the knowledge object courses in blueprint order, giving Correlating Events the extra week its 15 percent deserves, which the blueprint spells out as identifying transactions, grouping events using fields and time, and searching with transactions.
- 3Build a field alias, a calculated field, a tag, an event type, a macro, a workflow action and a data model in one sitting, without notes, then explain each one aloud.
- 4Book inside the year that a five registration voucher pack stays valid if you bought one for both exams.
Security analyst on Enterprise Security
4 to 5 weeksat 4 to 6 hours
- 1Start with Using the Common Information Model Add-On and Creating Data Models, since CIM normalization is what your ES correlation searches depend on and it is 20 percent of the exam between them.
- 2Work back through fields, aliases and calculated fields with your own security sourcetypes as the examples.
- 3Cover tags, event types, macros and workflow actions, noting how each appears in the ES apps you already use.
- 4Take timed practice sets and fix the sections they flag before booking.
Common mistakes
- Treating knowledge objects as vocabulary
- Eight of the ten domains ask what an object does to a search or to the data, not what it is called. Build each type and run a search before and after so the behavior is something you saw.
- Under studying Correlating Events
- At 15 percent it is the largest domain and covers identifying transactions, grouping events by fields and by time, and searching with transactions. It is also the material the Core User never touched.
- Leaving the CIM to the end
- Using the Common Information Model Add-On is 10 percent on its own and Creating Data Models another 10. Install the add-on early and map real data to it, because the questions assume you know what a CIM compliant field looks like.
- Relying on documentation you cannot open
- The exam is closed book and the handbook treats Splunk Docs as a violation with automatic failure. The command and object syntax has to be in your head.
- Ignoring the clock at the start
- The 60 minutes includes three minutes to accept the certification agreement, and 65 questions leaves under a minute each. Read the agreement in advance and plan a review pass.
What comes after passing
Choose the next exam by the job you want rather than the sequence on the page. The Advanced Power User deepens searching and dashboards, the Enterprise Certified Admin and Cloud Certified Admin move to deployment, and all three list only this certification as their prerequisite.
Whatever you choose, sit it within three years. Each of those three exams is a next level option in the handbook that renews the Power User automatically, so the upgrade doubles as the renewal.
Claim the Credly badge on a personal email address and note the expiry date. Reminders arrive at 180, 90 and 30 days, but tracking the date is your responsibility under the handbook.
Where people go next
Costs across the full renewal cycle are on the Core Certified Power User cost page.
Frequently asked questions
Is the Core User required first?
No. The Core Power User track page lists no prerequisite. Splunk describes the Core User as an optional entry point, and a Power User pass renews a User certification you already hold, so most people who can already search start here.
What is on the exam?
Knowledge objects. Correlating Events is 15 percent, and fields, field aliases and calculated fields, tags and event types, macros, workflow actions, data models, the CIM add-on and filtering and formatting results are 10 percent each, with transforming commands for visualizations at 5 percent.
Is there a published passing score?
No. Splunk shows pass or fail immediately on submission and gives passing candidates no further feedback. Failing candidates see section level feedback in their Pearson VUE account.
How do I renew it?
Pass the Advanced Power User, Enterprise Certified Admin or Cloud Certified Admin exam within the three year window, which renews the Power User automatically, or retake the Power User exam in the final year of the window. There is a 90 day grace period and no extensions.
Can I retake if I fail?
Yes, for the same $130 after a seven day wait, then 14 days after a second failure and longer waits afterwards. The exam cannot be retaken once you have passed it except as part of an approved recertification.
Keep reading
- Core Certified Power User practice questions
Free sample questions with the full explanation on every answer.
- Free Core Certified Power User practice test
10 original questions, playable now. No account, no card.
- Core Certified Power User exam objectives
The full official blueprint, with practice pages on covered objectives.
- Core Certified Power User exam format
How many questions, how long, what the items look like, and how long it stays valid.
- Core Certified Power User passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is Core Certified Power User?
An honest difficulty read from the format, the clock and the weights.
- What Core Certified Power User costs
The voucher price, the retake, and what renewal costs across the cycle.
Practice Core Certified Power User for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free Core Certified Power User questions