Splunk Cloud Certified Admin Boot Camp (SPLK-1005)

Splunk Cloud Certified Admin is the professional-level certification for administrators of Splunk Cloud Platform, issued by Splunk, a Cisco company, and earned by passing exam SPLK-1005. It covers the work a Splunk Cloud admin owns: users and roles, indexes, forwarders, inputs, parsing, Ingest Actions and working with Splunk Cloud Support, while Splunk runs the indexers and search heads.

The SPLK-1005 exam has 60 multiple-choice questions and you get 75 minutes. It is delivered by Pearson VUE at a test center or online with a proctor. The questions are spread across 13 published areas, with Getting Data in Cloud and Monitor Inputs each weighted at 15%, so forwarding and input configuration carry the most marks for Splunk Cloud Certified Admin.

The SPLK-1005 exam costs $130 per attempt through Pearson VUE, and the exam fee is not included in the course. You purchase the exam yourself after class, once your Splunk Core Certified Power User certification is on record. Our course is the official Splunk Education training only, so there is no exam voucher, no exam booking in class and no retake promise.

You must hold the Splunk Core Certified Power User certification before Splunk will let you register for SPLK-1005. No other exam is required, and you do not need Splunk Enterprise Certified Admin first. For the course itself, Splunk Education expects the fundamentals, meaning Intro to Splunk, Using Fields, Knowledge Objects and Creating Field Extractions or equivalent experience, and basic Linux helps.

The Splunk Cloud Certified Admin course runs for 4 half days, live online, from 10:00 AM to 2:30 PM Eastern, about 18 hours in total. It is the official Splunk Education course Splunk Cloud Administration, taught by Splunk-authorized instructors through our Splunk Authorized Learning Partner. Labs run in a provided Splunk environment, so you need only a laptop and a browser.

Splunk Cloud Administration, the official Splunk Education course behind SPLK-1005, has 15 modules in order: Splunk Cloud Overview, Managing Users, Managing Indexes, Using Configuration Files, Managing Apps, Configuring Forwarders, Managing Forwarders, Forwarder Inputs, Common Inputs, Additional Inputs, Fine-tuning Inputs, Parsing Phase and Data Preview, Manipulating Input Data, Managing Splunk Cloud and Supporting Splunk Cloud. Together they map to all 13 Splunk Cloud Certified Admin exam areas.

Splunk Cloud Certified Admin is for Splunk administrators, SOC and security engineers, platform engineers and observability engineers who run Splunk Cloud Platform on the Victoria or Classic experience, Self-Service or Managed. It also suits Splunk Enterprise administrators whose organization is migrating to Splunk Cloud, though existing Enterprise admins should not pair SPLK-1005 training with Transitioning to Splunk Cloud, which covers the same ground.

Take one or the other, decided by your environment. If Splunk runs on servers you manage, on-premises or in your own cloud accounts, take Splunk Enterprise Certified Admin (SPLK-1003). If Splunk hosts the indexers and search heads for you in Splunk Cloud Platform, take Splunk Cloud Certified Admin (SPLK-1005). Both require the Power User certification first, and you do not need both admin certifications.

Splunk Cloud Certified Admin is valid for 3 years from the date you pass SPLK-1005. To renew, you pass the current version of the exam again before the 3 years run out, at $130 per attempt through Pearson VUE. The Splunk Core Certified Power User certification that underpins it is also valid for 3 years, so plan both renewal dates together.

After Splunk Cloud Certified Admin, most people deepen search skills with Splunk Advanced Power User Fast Start or move into security with Using Splunk Enterprise Security. If your organization also runs self-managed Splunk Enterprise, Splunk Enterprise Administration Fast Start prepares for SPLK-1003 with the same Power User prerequisite. All three official follow-on courses are available through us on request.

SPLK-1005 is a professional-level exam that assumes you already search Splunk at Power User level, so the difficulty is in configuration detail rather than search syntax. Splunk reports the result as pass or fail and does not publish a numeric pass mark. Expect questions on inputs.conf, props.conf, forwarder connectivity and Splunk Cloud specifics such as app vetting, Ingest Actions and the Admin Config Service.

No. Splunk has no training prerequisite for SPLK-1005; the only requirement is holding the Splunk Core Certified Power User certification. The official Splunk Cloud Administration course is how most candidates prepare, because its 15 modules follow the published exam areas and include hands-on labs, but you register for the exam directly with Pearson VUE whether or not you attend.

Splunk Cloud Certified Admin is used by Splunk administrators, SOC analysts and security engineers who own the data pipeline into Splunk Cloud, platform and observability engineers, and Splunk Enterprise administrators moving to a hosted stack. Splunk does not publish salary data tied to SPLK-1005 and we do not quote figures, but the role titles above are where the credential appears in job postings.

Splunk Cloud Certified Admin is worth it if you administer Splunk Cloud Platform, because SPLK-1005 is the one Splunk credential that tests cloud-specific admin work: forwarding into Splunk Cloud, private app vetting, Ingest Actions, the Admin Config Service and working with Splunk Cloud Support. If your Splunk runs on your own servers, the Enterprise Admin certification is the better fit.

Yes. Training Camp handles GSA Schedule purchasing, training vouchers, enrollment and single-vendor invoicing for the Splunk Cloud Certified Admin course, and we arrange private live online cohorts for teams. Many of our courses are approved for VA education benefits; check eligibility for the SPLK-1005 course before enrolling.