Certification guide
Core Certified UserSplunk Core Certified User: the honest guide
Everything Splunk publishes about Core Certified User, in one place: what the exam asks, how the domains are weighted, and what it takes to be ready.
This guide page is built from the registry, not written yet.
Everything below comes from Core Certified User’s published exam data, and every figure links to the vendor page it came from. The researched version, with study plans and the parts nobody publishes, is still being written. This page is not submitted to search engines until it is.
Practise Core Certified User questions in the meantimeWhat the exam actually asks you to do
60 multiple choice questions and nothing else. Splunk sets no lab and no simulation on this exam, so the practice that matters is reading a scenario and choosing well under the clock.
Item formats
- Multiple choice
Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. Splunk, Splunk Core Certified User certification track ↗
Domain breakdown and official weightings
From the official Splunk certification tracks. Basic Searching is the heaviest domain at 22 percent, followed by Using Fields in Searches at 20 percent.
- Splunk Basics5%
- Basic Searching22%
- Using Fields in Searches20%
- Search Language Fundamentals15%
- Using Basic Transforming Commands15%
- Creating Reports and Dashboards12%
- Creating and Using Lookups6%
- Creating Scheduled Reports and Alerts5%
Where to focus: Basic Searching and Using Fields in Searches are 42% of the paper between them, so close to half the exam is running a search and reading what comes back. Splunk Basics is 5%, which is three questions on the parts most study time gets spent on.
What comes after passing
Core Certified User is valid for 3 years. All Splunk certifications run a three year life cycle from the date of the highest certification exam passed. Splunk stopped renewing certifications through coursework on 1 March 2026, so renewal now means either retaking the same exam in the final year of the window or earning a higher level certification in the same track. Splunk says a certification you let lapse is marked inactive, and that you then restart the programme at the Splunk Core Certified Power User level.
Where people go next
Costs across the full renewal cycle are on the Core Certified User cost page.
Frequently asked questions
How much does the Splunk Core Certified User exam cost?
Splunk lists the exam at $130 USD per exam attempt and delivers it through its testing partner Pearson VUE, at a test centre or with an online proctor. A retake costs the same $130 again.
How long is the exam and how many questions does it have?
Splunk publishes 60 multiple choice questions in 60 minutes. Splunk notes on the test blueprint that the 60 minutes include three minutes to review the exam agreement, so the working time is 57.
What is the passing score?
Splunk publishes no passing score for this exam, and no exam code either. It states the question count, the time limit and the section weightings on its test blueprint and stops there, so any percentage you see quoted elsewhere is somebody's estimate rather than Splunk's number.
What do I need before I can sit it?
Splunk lists no prerequisite for this exam. Anyone can register for it.
Keep reading
Core Certified User practice questions
Free sample questions with the full explanation on every answer.
Free Core Certified User practice test
Ten real questions, playable now. No account, no card.
Core Certified User exam objectives
The full official blueprint, with practice pages on covered objectives.
Core Certified User passing score
The exact cut score, what kind of number it is, and the retake terms.
How hard is Core Certified User?
An honest difficulty read from the format, the clock and the weights.
Practise Core Certified User for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free Core Certified User questions