Splunk certifications
Fourteen Splunk certifications across search, platform administration, security and observability, prepared exam by exam with practice tests that follow each test blueprint and an AI tutor that explains every answer in your style.
200 free credits · No credit card required
Last updated
Certification paths
Splunk certifications start with searching: Core Certified User and Power User need no prerequisites, and Power User opens the admin path to Architect and Consultant. Security analysts and engineers follow the Cybersecurity Defense path. Select any certification to see its exam.
Search and reporting
SPL, reports and dashboards
Platform
Run Splunk Enterprise and Cloud
Security
Detect, investigate and respond
Observability
Metrics and IT service health
All Splunk certifications
Filter by track or level. Every card shows the exam you’ll sit, from Splunk’s own certification page: how many questions, how long it runs and what you need first.
14 certifications
EntrySearch and reporting
Splunk User
Splunk basics: searching, using fields, transforming commands, reports and dashboards, lookups, and scheduled reports and alerts.
Prerequisites: None
EntrySearch and reporting
Splunk Power User
Searching beyond the basics: transforming commands, correlating events, and knowledge objects such as field extractions, aliases, tags, event types, macros and data models.
Prerequisites: None
IntermediateSearch and reporting
Advanced Splunk User
Advanced searching and reporting: statistical commands, eval functions, advanced field extraction, self-describing data, macros, drilldowns and advanced visualizations.
Prerequisites: Power User
ProfessionalPlatform
Splunk Administrator
Manage a Splunk Enterprise environment: licenses, indexes, users and roles, forwarders, and getting data in.
Prerequisites: Power User
ProfessionalPlatform
Splunk Cloud Administrator
Manage Splunk Cloud Platform: getting data in with forwarders and inputs, indexes, users and authentication, and apps.
Prerequisites: Power User
ExpertPlatform
Splunk Architect
Plan, deploy and troubleshoot large Splunk Enterprise deployments: capacity planning, distributed search, and indexer and search head clustering.
Prerequisites: Power User and Enterprise Admin
ExpertPlatform
Splunk Consultant
Deploy Splunk for customers at scale: indexer and search head clustering, data collection, indexing, search, and access and roles.
Prerequisites: Enterprise Architect (and the certifications before it), plus two Splunk courses
IntermediateSecurity
SOC Analyst
Detect, investigate and respond to threats with Splunk: the threat landscape, frameworks, data sources and SIEM practice, investigation, SPL and threat hunting.
Prerequisites: None
ProfessionalSecurity
Security Engineer
Build and run detections and automation with Splunk Enterprise Security and SOAR.
Prerequisites: None
ExpertSecurity
Security Architect
Design a security operation on Splunk end to end: the data, detection and response it needs and how they fit together.
Prerequisites: None
ProfessionalSecurity
Enterprise Security Administrator
Install, configure and manage Splunk Enterprise Security.
Prerequisites: None
Legacy: no longer updated
ProfessionalSecurity
Security Automation Developer
Set up Splunk SOAR and build automation playbooks.
Prerequisites: None
Legacy: no longer updated
EntryObservability
Observability Engineer
Metrics in Splunk Observability Cloud: getting data in with OpenTelemetry, metrics concepts, built-in content, dashboards, and alerting with detectors.
Prerequisites: None
ProfessionalObservability
ITSI Administrator
Install, configure and manage Splunk IT Service Intelligence to monitor the health of IT services.
Prerequisites: None
Legacy: no longer updated
Exam details from Splunk’s certification pages and test blueprints, checked by hand (splunk.com doesn’t allow automated checks); last updated November 7, 2026. The list of exams is checked weekly on Pearson VUE. Every exam costs $130, and the time includes three minutes to accept the exam agreement. Splunk and the names of its certifications are trademarks of Splunk LLC, a Cisco company.
Built for Splunk exams
Splunk exams follow their test blueprints and expect you to know SPL by heart. Every tool works toward the exam you’ll actually sit.
Practice exams weighted like each test blueprint and timed like the real thing, from 60 minutes for Core User to 120 for Core Consultant.
Learn more: Timed practice examsPractice searches, knowledge objects and admin tasks in guided labs, until the commands come without thinking.
Learn more: Hands-on labsWork through investigations and incidents from a SOC, and see where each decision leads.
Learn more: Real-world scenariosGot one wrong? The tutor explains why, in the way you learn best, and points to the blueprint topic behind it.
Learn more: An AI tutor on every answerA readiness score across every topic in the blueprint, so you book the exam when the numbers say you’ll pass.
Learn more: Know when you’re readyFAQs
Find quick answers or contact our support team.
Splunk Core Certified User if you’re new to Splunk, or Power User if you already search with it. Neither has prerequisites, and Power User is the one the admin certifications require. Security analysts can start with Cybersecurity Defense Analyst, which has no prerequisites either.
Most run 60 minutes, three of which are for accepting the exam agreement. Cloud Admin and the Cybersecurity Defense exams run 75 minutes, Enterprise Architect 90, and Core Consultant 120. They have 45 to 86 multiple-choice questions.
$130 per attempt. Exams are delivered by Pearson VUE, at a test center or online.
Since October 20, 2026, you register for Splunk exams with a Cisco.com account, through Cisco’s certification tracking system, and certification support comes from the Learn with Cisco Help Center.
Three years. Since March 1, 2026 you can’t recertify through coursework: retake the exam, or earn a higher-level Splunk certification.
Since January 1, 2026, Enterprise Security Certified Admin, SOAR Certified Automation Developer and IT Service Intelligence Certified Admin are Legacy: still valid and still offered, but their exams won’t be updated. Splunk points security candidates to the Cybersecurity Defense certifications.
Yes. The free plan includes 200 credits you can spend across the platform, with no credit card required. Upgrade to Pro whenever you want unlimited practice.
OpenpassAI
Hi 👋 I’m OpenpassAI. Ready to prepare for your exam the smarter way?
Ready to explore OpenpassAI? I can show you how the platform helps you prepare, practice, and pass.
