Splunk updated their Core Certified User certification earlier this year and since Splunk keeps showing up in security operations and log management conversations, I figured it was worth a quick rundown of what the credential actually covers and who should consider it.
What Is the Splunk Core Certified User?
The Splunk Core Certified User is the entry-level credential in Splunk’s certification program. It validates that you can use the Splunk platform to search, analyze, and visualize data. Specific coverage includes creating and manipulating searches, using fields and lookups, creating reports and dashboards, and the basics of transforming commands. It is firmly in the foundational category, designed for people who work with Splunk data on a regular basis but are not building Splunk architectures or developing Splunk apps.
What Changed in the Updated Splunk Exam?
Splunk does not publish a change log for this exam, so the reliable reference is the current exam blueprint, which lists every topic and its weight. If you studied for an older version, it is worth checking whether your materials reflect the current exam objectives before you sit.
Microsoft Security Operations Analyst (SC-200) Boot Camp
Instructor-led, with the exam voucher included.
Who Should Take the Splunk Core Certified User?
Who should pursue this? Security operations analysts who use Splunk as their primary SIEM and want a formal credential to show they know the platform. IT operations professionals in environments where Splunk is the centralized logging and monitoring solution. Anyone in a role where Splunk competency shows up in job requirements who wants something beyond “I have used it” on their resume.
The broader Splunk certification path goes well beyond the Core Certified User into administration, architecture, and development credentials that are meaningful for people building and maintaining Splunk environments professionally. The full details are on the Splunk certification site and the Core Certified User is the natural starting point before moving up that stack.
It is a vendor-specific credential so its value is proportional to how much Splunk shows up in your target environments. In security operations, that answer is quite a lot.
Frequently Asked Questions
How many questions are on the Splunk Core Certified User exam?
The exam has 60 multiple-choice questions and a 60-minute time limit, which includes 3 minutes to review the exam agreement. It costs $130 USD per attempt.
What topics carry the most weight on the Splunk Core Certified User exam?
Basic Searching (22%) and Using Fields in Searches (20%) carry the most weight, followed by Search Language Fundamentals and Using Basic Transforming Commands at 15% each. Creating Reports and Dashboards is 12%, and Creating and Using Lookups is 6%.
Do you need the Core Certified User before the Power User exam?
No. Splunk lists no prerequisites for the Splunk Core Certified Power User exam, which has 65 questions in 60 minutes. The Core Certified User is still the natural starting point if you are new to Splunk search.
How long is a Splunk certification valid?
Splunk certifications are valid for three years from the date earned. As of 2026, you renew by retaking the same exam in the final year of the cycle or by earning a higher-level certification in the same track, because Splunk removed the coursework renewal option on March 1, 2026.
Is Splunk part of Cisco now?
Yes. Cisco completed its acquisition of Splunk on March 18, 2024, and Splunk certifications continue under the Splunk name.
Related reading
- The New SC-200 from Microsoft Is One of the Better Security Certs Out Right Now
- I Took the Datadog Fundamentals Cert So You Can Decide If It's Worth It
Cody Davis is the Program Director for the certification courses on this site, where he oversees curriculum design and the overall learning experience. He holds several IT certifications and brings a practitioner's mindset to everything he builds. When he's not helping IT pros level up their careers, he's wrangling three kids and adding to a GI Joe collection that his family pretends not to notice.
