Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.

Splunk Certification Exam Prep Training

Splunk Cloud Certified Admin

Run Splunk Cloud with confidence. Four half days of official Splunk training on forwarding, ingest and the Admin Config Service, built for admins who cannot lose a week.

Verified for 2026 SPLK-1005 Exam
Student
Student
Student
Join 250,000+ certified alumni.
CISSP Professional

Official Content

Splunk Education courseware

Valid 3 Years

Splunk, a Cisco company

Official Splunk Education course, delivered live online through our Splunk Authorized Learning Partner

Splunk Cloud Certified Admin. Certified in Four Days.

4 half days for administrators of Splunk Cloud Platform, Victoria or Classic, and for Splunk Enterprise admins whose data is moving to the cloud.

Program Abstract

REF: SPLK-1005 13
Curriculum aligned to the latest Exam Outline.
Format Live Online, Instructor-Led
Duration 4

The Splunk Cloud Certified Admin Boot Camp

SPLK-1005 requires the Splunk Core Certified Power User certification first, and it is the admin exam for Splunk Cloud Platform rather than self-managed Splunk Enterprise.

Fifteen Official Modules.

Splunk Cloud Administration, the official Splunk Education course, taught in module order from Splunk Cloud Overview through Supporting Splunk Cloud, mapped to the 13 published SPLK-1005 areas.

Official Splunk Courseware.

Official Splunk Education courseware and labs, delivered live online by Splunk-authorized instructors through our Splunk Authorized Learning Partner.

Labs on a Real Cloud Stack.

Hands-on labs in a provided Splunk environment with a Splunk Cloud search head and Universal Forwarders, so you configure inputs.conf, props.conf and ACS against a live stack rather than slides.

·
Training materials including official courseware and study guides
Practitioner Led
Instructors are working security professionals, not just trainers.

"I don't teach from a textbook. I teach what happens in the SOC when the alert fires."

Jeff Porch

VP Ed. Services • CISSP, CISM CISSP: Certified Information Systems Security Professional. CISM: Certified Information Security Manager.

Choose Your Delivery Mode.

Same Curriculum
Student attending live online training
A

Live Online

Delivered live online in a virtual classroom, with the official curriculum, hands-on labs and a Splunk-authorized instructor.

  • Live online, no travel required
  • Eastern Time schedule
Offer

Save on this course with a current special offer

Team pricing, military discounts and a limited-time offer of the week. See what applies before you book.

See special offers
Get Started Today

Explore Your Training Options

Tell us about your training needs and we'll create a personalized plan.

Official Splunk Education Content

The Official Splunk Cloud Administration Course

Fifteen official Splunk Education modules in Splunk’s own order, from Splunk Cloud Overview through Supporting Splunk Cloud, rather than a third-party summary of the exam.

Splunk-Authorized Instructors

Taught by Splunk-Authorized Instructors

Delivered live online through our Splunk Authorized Learning Partner by instructors Splunk has authorized to teach its Education content.

Hands-On Labs

A Provided Splunk Cloud Lab Stack, Ready

A Splunk Cloud search head, Universal Forwarders and a Deployment Server in a provided lab environment, so you work in inputs.conf, props.conf and the Admin Config Service on a live stack. Nothing to install.

Blueprint Alignment

Mapped to All 13 SPLK-1005 Areas

The 15 modules cover every published exam area, including the 15% weights on Getting Data in Cloud and Monitor Inputs, so you know where each lesson lands on the blueprint.

Cloud Admin or Enterprise Admin

The Admin Cert for Splunk Cloud Platform

Splunk offers two admin certifications and you choose by environment. This course is for Splunk Cloud Platform, Victoria or Classic. Both require Power User first, and both are valid for 3 years.

Enrollment and Purchasing

One Place for Enrollment, GSA and Vouchers

Training Camp handles enrollment, invoicing, GSA Schedule purchasing, training vouchers and scheduling for teams, so your procurement team deals with one vendor.

Splunk Cloud Certified Admin Boot Camp (SPLK-1005)

Accepting Inquiries
+1

    Eligible for Special Pricing?

    We respect your privacy. No spam.

    COURSE STRUCTURE

    Splunk Cloud Certified Admin Boot Camp (SPLK-1005) Course Outline
    Outline

    A structured path designed for working professionals.
    Each day builds on the last—momentum is everything.

    Request Info

    MODULE_ID: PREP

    Live Training QS: ~5
    BEFORE CLASS
    Critical Path

    Before Class

    The exam is not included; you book it separately through Pearson VUE after class.
    L.prep.1

    MODULE_ID: SPLK-1005-01

    Live Training QS: ~5
    DAY 1
    Critical Path

    Splunk Cloud Overview, Users, Indexes and Configuration Files

    Splunk Cloud Platform Topology and What Splunk Manages
    L.01.1
    Victoria Experience Versus Classic Experience Differences
    L.01.2
    Self-Service Versus Managed Splunk Cloud Subscriptions
    L.01.3
    Cloud Admin Tasks Compared With Splunk Enterprise Admin
    L.01.4
    Users, Roles, Capabilities and Index Access in authorize.conf
    L.01.5
    Configuring SAML, LDAP and Active Directory Authentication
    L.01.6
    Lab: Create Roles and Map SAML Groups to Roles
    L.01.7
    Lab: Tour the Cloud Monitoring Console and Admin Menus
    L.01.8
    Creating Indexes and Setting Retention and Searchable Storage
    L.01.9
    Dynamic Data Active Archive and Self Storage Options
    L.01.10
    Index Buckets, Data Integrity and indexes.conf Settings
    L.01.11
    Configuration File Directory Structure, Layering and Precedence
    L.01.12
    Reading Effective Settings With btool on a Forwarder
    L.01.13
    Which Configuration Files You Control in Splunk Cloud
    L.01.14
    Lab: Create Indexes and Verify Retention Settings
    L.01.15
    Lab: Compare Layered Settings With btool and Debug Refresh
    L.01.16

    MODULE_ID: SPLK-1005-02

    Live Training QS: ~6
    DAY 2
    Critical Path

    Apps, Forwarders and Forwarder Inputs

    Installing Splunkbase Apps and Add-Ons in Splunk Cloud
    L.02.1
    Private App Packaging, AppInspect and the Vetting Process
    L.02.2
    Universal Forwarder Versus Heavy Forwarder Use Cases
    L.02.3
    Installing the Universal Forwarder Credentials Package
    L.02.4
    Configuring outputs.conf Load Balancing to Cloud Indexers
    L.02.5
    Testing Connectivity With splunk list forward-server and splunkd.log
    L.02.6
    Lab: Package and Upload a Private App for Vetting
    L.02.7
    Lab: Install a Universal Forwarder and Connect to Splunk Cloud
    L.02.8
    Deployment Server Architecture and Deployment Apps
    L.02.9
    Defining Server Classes and Client Groups in serverclass.conf
    L.02.10
    Configuring deploymentclient.conf and Phone Home Intervals
    L.02.11
    Monitor Inputs for Files and Directories in inputs.conf
    L.02.12
    Whitelist, Blacklist, crcSalt and the Fishbucket
    L.02.13
    Setting index, sourcetype and host on Inputs
    L.02.14
    Lab: Build a Deployment App and Push It to a Client Group
    L.02.15
    Lab: Configure Monitor Inputs for Linux Log Directories
    L.02.16

    MODULE_ID: SPLK-1005-03

    Live Training QS: ~6
    DAY 3
    Critical Path

    Common and Additional Inputs, Fine-Tuning and Parsing

    TCP and UDP Network Inputs and Their Limitations in Cloud
    L.03.1
    Splunk Connect for Syslog as the Syslog Collection Tier
    L.03.2
    Scripted Inputs and Interval Settings in inputs.conf
    L.03.3
    Windows Event Log, Performance Monitor and WMI Inputs
    L.03.4
    HTTP Event Collector Tokens, Endpoints and Indexer Acknowledgment
    L.03.5
    Inputs Data Manager for Scripted and Modular Inputs
    L.03.6
    Lab: Create an HEC Token and Send Events With curl
    L.03.7
    Lab: Configure Windows Event Log Inputs Through the Deployment Server
    L.03.8
    Edge Processor Pipelines for Filtering and Routing at the Edge
    L.03.9
    The Three Phases of Indexing: Input, Parsing, Indexing
    L.03.10
    Setting sourcetype, host and index Overrides at Input Time
    L.03.11
    Line Breaking With LINE_BREAKER and SHOULD_LINEMERGE
    L.03.12
    Timestamp Extraction With TIME_PREFIX, TIME_FORMAT and MAX_TIMESTAMP_LOOKAHEAD
    L.03.13
    Using Data Preview to Test props.conf Before Indexing
    L.03.14
    Lab: Fix Multiline Events and Timestamps in Data Preview
    L.03.15
    Lab: Deploy a Corrected props.conf and Validate With btool
    L.03.16

    MODULE_ID: SPLK-1005-04

    Live Training QS: ~7
    DAY 4
    Critical Path

    Manipulating Input Data, Managing and Supporting Splunk Cloud

    Ingest Actions Rulesets for Filtering, Masking and Routing
    L.04.1
    Masking Sensitive Data With SEDCMD in props.conf
    L.04.2
    Routing and Filtering Events With props.conf and transforms.conf
    L.04.3
    Sourcetype Override and Per-Event Index Routing
    L.04.4
    Admin Config Service API for Indexes, HEC Tokens and IP Allow Lists
    L.04.5
    Federated Search Across Splunk Cloud and Enterprise Deployments
    L.04.6
    Lab: Build an Ingest Actions Ruleset to Mask Card Numbers
    L.04.7
    Lab: Create an Index and HEC Token Through the ACS API
    L.04.8
    Private Connectivity to Splunk Cloud With AWS PrivateLink
    L.04.9
    Isolation Troubleshooting: Forwarder, Network, Input or Parsing
    L.04.10
    Opening a Splunk Cloud Support Case and Diagnostic Files
    L.04.11
    Lab: Diagnose a Forwarder That Is Not Sending Data
    L.04.12
    Lab: Trace a Missing Sourcetype From Input to Index
    L.04.13
    Mapping the 15 Modules to the 13 SPLK-1005 Exam Areas
    L.04.14
    Course Review and Key Takeaways
    L.04.15
    Next Step: Schedule SPLK-1005 With Pearson VUE
    L.04.16

    MODULE_ID: POST

    Live Training QS: ~7
    AFTER CLASS
    Critical Path

    After Class

    When the course ends you keep your official Splunk Education courseware for revision.
    L.post.1
    Splunk Cloud Certified Admin is valid for 3 years.
    L.post.2
    COURSE PROGRESS Day 0 of 4
    Splunk Certification Track

    Master the SPLK-1005 Exam 4 Days to Certified

    13 exam areas covered by 15 official Splunk Education modules, live online over 4 half days with hands-on labs.

    Splunk Cloud Administration course Splunk Cloud certification Splunk Cloud Certified Admin Splunk admin certification Splunk Cloud Administration course Splunk Cloud certification Splunk Cloud Certified Admin Splunk admin certification
    official Splunk Education training Splunk Cloud Admin training SPLK-1005 official Splunk Education training Splunk Cloud Admin training SPLK-1005
    Frequently Asked Questions

    SPLK-1005 Boot Camp Questions, Answered
    SPLK-1005

    Real questions from real professionals who passed.
    Here's how we answer them.

    Splunk Cloud Certified Admin, earned by passing SPLK-1005. It is the professional-level Splunk certification for people who administer Splunk Cloud Platform. Splunk is a Cisco company and the exam is delivered through Pearson VUE.

    The course assumes the Splunk Education fundamentals (Intro to Splunk, Using Fields, Knowledge Objects, Creating Field Extractions) or equivalent, and basic Linux helps. To register for the SPLK-1005 exam itself, Splunk requires you to hold the Splunk Core Certified Power User certification. You do not need Splunk Enterprise Certified Admin first.

    4 half days, live online, 10:00 AM to 2:30 PM Eastern, about 18 hours in total. It is the official Splunk Education course Splunk Cloud Administration (SP-SCA), and labs run in a provided Splunk environment so you need only a laptop.

    No. The SPLK-1005 exam is purchased separately by you after class through Pearson VUE, at $130 per attempt. You can sit it at a test center or online once your Power User certification is on record.

    SPLK-1005 has 60 questions and you get 75 minutes. It is a multiple-choice exam delivered by Pearson VUE.

    Thirteen areas, weighted as published by Splunk: Splunk Cloud Overview 5%, Index Management 5%, User Authentication and Authorization 5%, Configuration Files 5%, Getting Data in Cloud 15%, Forwarder Management 5%, Monitor Inputs 15%, Network and Other Inputs 10%, Fine-tuning Inputs 5%, Parsing Phase and Data Preview 10%, Manipulating Raw Data 10%, Installing and Managing Apps 5%, and Working with Splunk Cloud Support 5%.

    Administrators of Splunk Cloud Platform on either the Victoria or Classic experience, Self-Service or Managed. It also suits Splunk Enterprise admins whose organization is migrating to Splunk Cloud, though existing Enterprise admins should not take it together with Transitioning to Splunk Cloud, which covers the same ground.

    One or the other, decided by your environment. If Splunk runs on servers you manage, on-premises or in your own cloud accounts, take Splunk Enterprise Certified Admin (SPLK-1003). If Splunk hosts the indexers and search heads for you in Splunk Cloud Platform, take Splunk Cloud Certified Admin (SPLK-1005). Both require Power User first, and you do not need both.

    Splunk Cloud Certified Admin is valid for 3 years from the date you pass. To stay current you retake the current version of the exam before it expires.

    If your organization also runs self-managed Splunk Enterprise, the Splunk Enterprise Administration Fast Start covers that environment. Advanced Power User Fast Start and Using Splunk Enterprise Security are the other official follow-on courses, all available through us on request.

    You can retake SPLK-1005 at Pearson VUE, at $130 per attempt, subject to Splunk’s retake policy. You keep your official courseware and lab notes to prepare for the second sitting.

    Yes. We arrange private live online cohorts for teams, and Training Camp handles enrollment, scheduling and a single invoice for the whole group.

    Yes. Training Camp handles GSA Schedule purchasing, training vouchers and invoicing, so government and enterprise procurement teams deal with one vendor. Many of our courses are also approved for VA education benefits; check eligibility before enrolling.

    It is the one Splunk credential that tests the cloud-specific admin work: forwarding into Splunk Cloud, private app vetting, Ingest Actions and the Admin Config Service. If you administer Splunk Cloud Platform, it maps directly to your day job.

    Splunk administrators, SOC and security engineers who own the data pipeline into Splunk Cloud, platform and observability engineers, and Splunk Enterprise admins moving to a hosted stack.

    Get the Free
    SPLK-1005 Exam Guide

    • Expert strategies to spot trick questions
    • Question patterns examiners actually use
    • Proven pacing + pressure management tactics
    Articles and Certification Resources

    SPLK-1005 Articles and Exam News
    Articles and Exam News

    Exam changes, study guidance and career context for SPLK-1005, from our instructors.

    Student Success Stories

    What Our Students Say

    Join thousands of certified professionals who trained with Training Camp

    ★★★★★

    Instructor Jarrett Heintz went above and beyond to give us everything we could possibly need to take the exam. There were tons of resources he provided and on to...

    SC
    Sav**** Coo*** L** County Commission – Systems Administrator
    ★★★★★

    A must stop-by resort before any certification test. Teachers teach you something for life, rather than only for certification.

    Continue Your Journey

    Splunk Cloud Certified Admin Related Courses

    Advance your career with these recommended certifications

    Featured on