Splunk Core Certified Power User

Splunk Core Certified Power User, earned by passing exam SPLK-1002. It is the entry-level certification from Splunk, a Cisco company, and confirms you can use the search language, build knowledge objects and work with data models.

No prerequisite exam is required. Splunk does assume you know how Splunk works and can perform basic searching and visualizations, roughly the level of its Intro to Splunk and Using Fields courses. If you have never used Splunk, work through Splunk’s free Intro to Splunk and Using Fields eLearning first.

4 days, live online, 10:00 AM to 6:00 PM Eastern, for 32 hours in total. It is the official Splunk Education Power User Fast Start course, delivered through our Splunk Authorized Learning Partner.

No. The SPLK-1002 exam is purchased separately by the student after class, directly from Pearson VUE, at $130 per attempt. The course price covers instruction, official courseware and labs only.

65 multiple-choice questions in 60 minutes, which includes 3 minutes to review the exam agreement. The exam is delivered by Pearson VUE, online or at a test center.

Ten areas, weighted as published by Splunk: Transforming Commands for Visualizations (5%), Filtering and Formatting Results (10%), Correlating Events (15%), Creating and Managing Fields (10%), Field Aliases and Calculated Fields (10%), Tags and Event Types (10%), Macros (10%), Workflow Actions (10%), Data Models (10%) and Common Information Model Add-On (10%).

SOC analysts, IT operations staff and anyone who searches Splunk every day and wants to build the knowledge objects, dashboards and data models that other people use. It is also the required first step for anyone heading toward a Splunk admin certification.

Yes. Splunk requires the Power User certification before you can earn Splunk Enterprise Certified Admin or Splunk Cloud Certified Admin. You then choose one admin track, Enterprise for self-managed Splunk Enterprise or Cloud for Splunk Cloud Platform, and do not need both.

Splunk certifications are valid for three years. To stay current you retake the exam or earn a higher certification in the track before it expires.

One of the two admin certifications: our Splunk Enterprise Certified Admin Boot Camp for self-managed Splunk Enterprise, or our Splunk Cloud Certified Admin Boot Camp for Splunk Cloud Platform. Advanced Power User Fast Start, Enterprise Administration Fast Start and Using Splunk Enterprise Security are also available through us on request.

You can schedule another attempt with Pearson VUE, at $130 per attempt, subject to Splunk’s retake policy. You keep your official courseware and lab notes to review the areas that gave you trouble.

Yes. We arrange private live online cohorts for your team to your own schedule, with Training Camp handling enrollment and invoicing. Contact us with your head count and preferred dates.

Yes. Training Camp handles GSA Schedule purchasing and accepts training vouchers for this course. Our government sales team can walk you through the paperwork. Many of our courses are also approved for VA education benefits; check eligibility before enrolling.

It is the gateway to every other Splunk certification, so if you plan to administer Splunk at all it is not optional. It also covers the knowledge objects and data models that separate someone who runs searches from someone who builds what the rest of the team searches with.

SOC analysts, security engineers, IT operations and site reliability staff, and anyone building Splunk dashboards, alerts and reports for others. It is also the standard stepping stone for Splunk administrators.