FirstTry

Certification guide

Core Certified User

Splunk Core Certified User: the honest guide

The Splunk Core Certified User is 60 multiple choice questions in 60 minutes, closed book, at a Pearson VUE test center or through the OnVue online proctor, for $130 an attempt. Splunk lists no prerequisite and describes it on the track page as an optional entry point to the certification program for candidates with little to no Splunk experience.

The blueprint weights Basic Searching at 22 percent, Using Fields in Searches at 20 percent, Search Language Fundamentals at 15 percent, Using Basic Transforming Commands at 15 percent and Creating Reports and Dashboards at 12 percent, with Splunk Basics, Creating and Using Lookups and Creating Scheduled Reports and Alerts making up the remaining 16 percent between them. Three quarters of the marks are about writing and reading searches.

You see pass or fail as soon as you submit. Splunk does not publish a passing score for this exam, and a passing candidate gets no further feedback, so the honest target is to be comfortable on every domain rather than to aim at a number.

Who Core Certified User is for

A good fit if

  • You use Splunk at work to look things up and want the searching, fields and basic statistics to stop feeling like guesswork.
  • You are a career changer or new hire whose employer runs Splunk and you want a low cost, low risk first credential in the platform. Splunk built this exam for exactly that person.
  • You are a data or security analyst whose day involves reading dashboards other people built, and you want to build your own reports, lookups and alerts.
  • You want to know whether Splunk certification is for you before committing to the Power User. This is the cheapest way to find out and a pass renews when you go on to Power User.

Probably not, if

  • You already write searches with stats, eval and lookups every day. Splunk lists no prerequisite for the Core Power User, and passing that exam is a step further for the same $130, so skip the User exam unless an employer specifically asks for it.
  • You are looking for the administration side of Splunk. Indexes, forwarders and inputs are on the Enterprise Certified Admin and Cloud Certified Admin blueprints, not this one.
  • You want an open book exam. Splunk exams are strictly closed book, and the handbook treats Splunk Docs open in another window as an automatic failure.

Is Core Certified User worth it?

At $130 with free preparation, it is one of the least expensive vendor certifications you can hold, and Splunk's free courses cover the whole blueprint. The cost of finding out is small.

It is optional, and Splunk says so. If you are confident with searching, fields and transforming commands, the Power User is the better first exam because it carries the same price, needs no prerequisite and renews a User certification you skip anyway.

It runs on a three year cycle, and the renewal that costs least effort is the Power User exam. Treat the User as the first step of a two step plan rather than a destination.

What the exam actually asks you to do

60 multiple choice questions and nothing else. Splunk sets no lab and no simulation on this exam, so the practice that matters is reading a scenario and choosing well under the clock.

Item formats

  • Multiple choice

Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. Splunk, Splunk Core Certified User certification track ↗

Domain breakdown and official weightings

From the official Splunk certification tracks. Basic Searching is the heaviest domain at 22 percent, followed by Using Fields in Searches at 20 percent.

  • Splunk Basics5%
  • Basic Searching22%
  • Using Fields in Searches20%
  • Search Language Fundamentals15%
  • Using Basic Transforming Commands15%
  • Creating Reports and Dashboards12%
  • Creating and Using Lookups6%
  • Creating Scheduled Reports and Alerts5%

Where to focus: Basic Searching and Using Fields in Searches are 42% of the paper between them, so close to half the exam is running a search and reading what comes back. Splunk Basics is 5%, which is three questions on the parts most study time gets spent on.

Splunk: Splunk certification tracks ↗

Study plans by experience level

New to Splunk, free courses and a home instance

4 to 6 weeksat 5 to 7 hours

  1. 1Install the 60 day Splunk Enterprise trial on your own machine and upload any log files you have, so every course exercise runs against data you understand.
  2. 2Work through Intro to Splunk, Using Fields and Search Under the Hood from the free training page, reproducing each search yourself rather than watching.
  3. 3Do Statistical Processing, Visualizations, Scheduling Reports and Alerts and Enriching Data with Lookups, then build one dashboard, one scheduled report, one alert and one lookup without the course open.
  4. 4Spend the final week on timed practice sets and re-read the blueprint's transforming command list, since stats, chart, timechart and top are where the marks are.

Using Splunk at work already

2 to 3 weeksat 3 to 5 hours

  1. 1Read the test blueprint and list the domains you never touch at work, which for most people are lookups and scheduled reports and alerts.
  2. 2Take a timed practice set cold to find out which of the search language fundamentals you have been doing by habit rather than understanding, such as boolean precedence and wildcard behavior.
  3. 3Fill the gaps with the matching free course rather than a full syllabus, then take a second timed set.
  4. 4Book the exam more than 48 hours out and keep the appointment, since the fee is forfeited inside that window.

Studying User and Power User together

8 to 10 weeksat 5 to 7 hours

  1. 1Decide up front whether you will sit both exams. If the Power User is the goal, Splunk lists no prerequisite for it, and you can treat the User material as the first half of the syllabus without booking the User exam.
  2. 2Cover the User blueprint in the first four weeks on the free courses and a home instance.
  3. 3Move straight into the knowledge object courses, Intro to Knowledge Objects, Creating Field Extractions, Data Models and the rest, which build directly on fields and searching.
  4. 4If you do sit both, book them inside the year that a five registration voucher pack stays valid, and remember the Power User pass renews the User.

Common mistakes

Studying the interface instead of the search language
Basic Searching, Using Fields and Search Language Fundamentals together carry 57 percent of the marks. Knowing where the menu items are does not answer questions about what a search returns.
Skipping transforming commands because they feel like the next exam
Using Basic Transforming Commands is 15 percent of this blueprint. Being able to say what stats, chart, timechart and top produce from a given set of events is a User skill, not a Power User one.
Never building a lookup or an alert
Lookups and scheduled reports and alerts are 11 percent between them and are easy to pass over when you only search interactively. Build one of each on a home instance so the configuration questions are recall rather than reasoning.
Forgetting the exam is closed book
The handbook prohibits any reference material, including Splunk Docs and Splunk Answers, and a proctor who perceives a violation ends the exam as a failure with the fee forfeited. Practice without the documentation open.
Not reading the certification agreement beforehand
The 60 minutes includes three minutes to accept the Splunk Certification Agreement inside the testing platform, and the session is terminated if you do not accept in time. Read it from the track page the day before.

What comes after passing

Claim the Credly badge from the email Splunk sends and attach it to a personal address, since the handbook recommends one that outlives your current employer.

Go on to the Core Certified Power User within the three year window. It needs no separate prerequisite, it is the next level option the handbook lists for renewing the User, and the free knowledge object courses follow directly from what you have just learned.

Note the expiry date in your own calendar. Splunk emails reminders at 180, 90 and 30 days but makes the date your responsibility, and a lapse past the 90 day grace period means starting again.

Where people go next

Splunk Core Certified Power User

Costs across the full renewal cycle are on the Core Certified User cost page.

Frequently asked questions

Do I have to pass the Core User before the Power User?

No. The Core Power User track page lists no prerequisite, and Splunk describes the Core User as an optional entry point. If you are already comfortable searching, start at Power User and save the $130.

What score do I need to pass?

Splunk does not publish a passing score for this exam. The screen shows pass or fail immediately, and a passing candidate receives no further feedback, so prepare across all eight domains rather than aiming at a percentage.

Can I use the documentation during the exam?

No. Splunk exams are closed book and the handbook names Splunk Docs and Splunk Answers as prohibited material. Any perceived violation is an automatic failure and the registration fee is forfeited.

How long does the certification last?

Three years from the date of your highest Splunk certification exam. You renew by passing the Core Power User exam, which renews the User with it, or by retaking the User exam in the final year of the window. There is a 90 day grace period and no extensions.

What happens if I fail?

You can rebook after a seven day wait for the same $130, and your Pearson VUE account shows section level feedback so you know which domains to restudy. A second failure means a 14 day wait, and later attempts wait longer.

Keep reading

Every guide and cost breakdown, by vendor

Practice Core Certified User for free while you decide

Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.

Start free Core Certified User questions