Splunk Certifications

Splunk and Pearson VUE are proud of their ongoing commitment to uphold the integrity of Splunk certifications. Splunk policy prohibits individuals residing in the embargoed territories of Cuba, Iran, North Korea, Syria, the Crimea region, and Sudan, from taking a Splunk exam or from becoming certified. For further information on exam and test center policies, please visit the Splunk Certification Exam Policy web page.

All exams are computer scored immediately upon exam completion. Candidates may request a paper copy  "Exam Score Report" before they depart from the exam center. This report provides a "provisional score," not a final score. The final score is transmitted to the candidate’s CertTracker account only after a statistical analysis is conducted on the exam. This analysis identifies security issues including the use on non-approved materials to prepare for the exam. If a security issue is discovered the candidate will receive an email notification stating their exam results have been invalided.

Splunk Core Certified User

*Now offered in Japanese

The User designation certifies the candidate’s basic knowledge of the Splunk platform. By becoming a Splunk Certified User, you open the door to more advanced certifications and professional roles like Power User, Administrator, or Architect.

Splunk Core Certified Power User

A Splunk Core Certified Power User has a basic understanding of SPL searching and reporting commands in either the Splunk Enterprise or Splunk Cloud platforms. This certification demonstrates an individual's foundational competence of Splunk’s core software.

Splunk Core Certified Advanced Power User

A Splunk Core Certified Advanced Power User has greater depth of knowledge and skills in complex searching and reporting commands, advanced use cases of knowledge objects, and best practices for building dashboards and forms.

Splunk Cloud Certified Admin

A Splunk Cloud Certified Admin manages and configures details for Splunk Cloud, including data inputs and forwarder configuration, data management, user accounts, and basic monitoring and problem isolation. This certification demonstrates an individual's ability to support the day-to-day administration and health of a Splunk Cloud environment.

Splunk Enterprise Certified Admin

A Splunk Enterprise Certified Admin manages various components of Splunk Enterprise on a daily basis and is able to support the day-to-day administration and health of a Splunk Enterprise environment.

Splunk Enterprise Certified Architect

A Splunk Enterprise Certified Architect is the most technical certification Splunk offers. Candidates must demonstrate a thorough understanding of Splunk Deployment Methodology and best-practices and the ability to deploy, manage, and troubleshoot complex Splunk Enterprise environments.

Splunk Core Certified Consultant

A Splunk Core Certified Consultant has a thorough understanding of Splunk Deployment Methodology and implementation in large Splunk installations and has expert-level knowledge of multi-tier Splunk architectures, clustering, and scalability topics. A consultant can properly size, install, and implement Splunk environments and advise others on how to utilize the product and maximize its value for their needs.

Splunk Certified Enterprise Security Admin

A Splunk Certified Enterprise Security Admin installs, configures, and manages a Splunk Enterprise Security deployment.

Splunk IT Service Intelligence Certified Admin

A Splunk Certified IT Service Intelligence Admin installs, configures, and utilizes Splunk’s app for IT Service Intelligence to monitor mission-critical services.

Splunk SOAR Certified Automation Developer

A Splunk SOAR Certified Automation Developer* installs, configures, and uses SOAR (formerly Phantom) servers and plans, designs, creates, and debugs basic playbooks for SOAR. This exam was previously available as Splunk Phantom Certified Admin.

Splunk O11y Cloud Certified Metrics User

A Splunk O11y Cloud Certified Metrics User has foundational skill sets in monitoring and investigating issues using Splunk Observability Cloud. This certification demonstrates an individual’s ability to monitor using built-in content, deploy and configure the OpenTelemetry Collector to send in metrics, visualize metrics, find insights using analytics, and set up alerts to monitor development environments in real time.

Splunk Certified Cybersecurity Defense Analyst

A Splunk Certified Cybersecurity Defense Analyst has intermediate-level skill sets in detecting, analyzing and combating cyber threats using Splunk Enterprise and Enterprise Security. This certification demonstrates an individual’s ability to use cyber defense tools for continual monitoring as a security analyst as well as protect businesses and mitigate risk, while managing vulnerabilities and threats using common types of cyber defense systems.

If you already have a voucher code, please register for the exam you’d like, select “Checkout”, and submit the voucher code on the payment page.

Splunk Certification recommends all candidates thoroughly review course materials and notes prior to registering for or attempting the certification exam(s). For a complete list of topics covered by the exam(s) and sample questions, please refer to the Splunk Certification Exams Study Guide.

Regardless of who pays for the exam, you, the exam candidate, own the results. Your exam history is linked to your Certified Professional ID number granted the first time you create a Pearson VUE account. You should never create another one. If you change employers or need to update your contact information, you must send an email to certification@splunk.com and they will assist you in updating your records.

Candidates who do not pass a Splunk Certification Exam on their first attempt must wait 7 days to retake the exam.  Wait time begins on the following day.

Please refer to the table below for retake eligibility:

Candidates who do not pass a Splunk Certification exams on their second attempt must wait 14 days to retake the exam. Wait time begins on the following day.

Subsequent retakes are as follows:

• Third attempt 4 weeks or 28 days
• Fourth attempt 8 weeks or 56 days
• Fifth attempt 8 weeks or 56 days

Retakes beyond the 5th attempt will be considered on a case-by-case basis. Splunk reserves the right to deny a retake beyond the 5th attempt.

Retaking Previously Passed Exams

Candidates will not be permitted to retake any exam they have previously passed, unless directly related to a recertification requirement approved by Splunk.

Once candidates are seated for an exam in a Pearson VUE Testing Center, they will be given 3 minutes to read and sign Splunk’s Non-Disclosure Agreement. Signing the NDA is required for candidates to proceed with the exam. Candidates who decline or do not ‘agree’ within the 3 minutes, will be excused from the exam room, and will forfeit their entire examination fee.

For those candidates who wish to review the NDA prior to taking the exam, here is the full text of the NDA as shown on the program website.