Splunk Core Certified Power User Boot Camp (SPLK-1002)

Splunk Core Certified Power User is the entry-level Splunk certification, issued by Splunk, a Cisco company, and earned by passing exam SPLK-1002. It confirms you can use the Splunk search language, build knowledge objects such as field extractions, macros and event types, and work with data models. It is the required first step in every Splunk certification track.

The SPLK-1002 exam has 65 multiple-choice questions and a 60-minute time limit, which includes 3 minutes to review the exam agreement. It is delivered by Pearson VUE, either online with a remote proctor or at a Pearson VUE test center. Splunk Core Certified Power User is an entry-level exam with no prerequisite exam required.

The SPLK-1002 exam costs $130 per attempt through Pearson VUE, and the exam fee is not included in the course. You purchase the exam yourself after class and schedule it directly with Pearson VUE. The course price covers live online instruction, official Splunk Education courseware and hands-on labs for Splunk Core Certified Power User.

There is no prerequisite exam or certification for Splunk Core Certified Power User. Splunk does assume you know how Splunk works and can perform basic searching and visualizations, roughly the level of its Intro to Splunk and Using Fields courses. If you have never used Splunk, work through Splunk’s free Intro to Splunk and Using Fields eLearning before the SPLK-1002 course.

The Splunk Core Certified Power User course runs 4 days, live online, from 10:00 AM to 6:00 PM Eastern, for 32 hours in total. It is the official Splunk Education Power User Fast Start course, taught by Splunk-authorized instructors through our Splunk Authorized Learning Partner, with hands-on labs in a provided Splunk environment and nothing to install.

The course is Splunk Education’s official Power User Fast Start, nine topics in order: Working with Time, Statistical Processing, Comparing Values, Result Modification, Correlation Analysis, Intro to Knowledge Objects, Creating Knowledge Objects, Creating Field Extractions and Data Models. Together they cover more than 60 commands, functions and knowledge objects and map to all ten SPLK-1002 exam areas.

Splunk Core Certified Power User is for SOC analysts, security engineers, IT operations staff, site reliability engineers and anyone who searches Splunk daily and needs to build knowledge objects, dashboards and data models that other people rely on. It is also the required first step for anyone planning to earn a Splunk Enterprise or Splunk Cloud admin certification after SPLK-1002.

Yes. Splunk requires the Splunk Core Certified Power User certification before you can earn Splunk Enterprise Certified Admin (SPLK-1003) or Splunk Cloud Certified Admin (SPLK-1005). After SPLK-1002 you choose one admin track, Enterprise Admin for self-managed Splunk Enterprise or Cloud Admin for Splunk Cloud Platform. You do not need both admin certifications.

Splunk Core Certified Power User is valid for three years from the date you pass SPLK-1002, the same as every Splunk certification. To stay current you either retake the SPLK-1002 exam before it expires or earn a higher certification in the track, such as Splunk Enterprise Certified Admin or Splunk Cloud Certified Admin, which extends your standing.

After Splunk Core Certified Power User, most people take one admin certification: our Splunk Enterprise Certified Admin Boot Camp (SPLK-1003) for self-managed Splunk Enterprise, or our Splunk Cloud Certified Admin Boot Camp (SPLK-1005) for Splunk Cloud Platform. Advanced Power User Fast Start, Enterprise Administration Fast Start and Using Splunk Enterprise Security are also available through us on request.

Splunk Core Certified Power User is an entry-level exam, but it covers ten areas and 65 questions in 60 minutes, so pace matters. Splunk does not publish a numeric passing score for SPLK-1002; it reports a pass or fail result. Correlating Events carries the highest weight at 15 percent, so transaction versus stats deserves extra study.

No. Splunk has no training prerequisite for SPLK-1002, so you can register with Pearson VUE without attending a course. What matters for the track is the certification prerequisite: Splunk Core Certified Power User itself is required before either admin exam. The official Power User Fast Start course exists to teach the ten exam areas with labs, not to gate the exam.

Splunk Core Certified Power User is used by SOC analysts, security engineers, IT operations and site reliability staff, and anyone who builds Splunk dashboards, alerts and reports for others. It is also the standard stepping stone for Splunk administrators. Pay varies widely by role, region and experience, so check current job postings in your area rather than a single figure for SPLK-1002.

Splunk Core Certified Power User is worth it if you plan to earn any other Splunk certification, because SPLK-1002 is the required gateway to both admin tracks. It also covers the knowledge objects, field extractions and data models that separate someone who runs searches from someone who builds what the rest of the team searches with.

Yes. Training Camp handles GSA Schedule purchasing and accepts training vouchers for the Splunk Core Certified Power User course, and arranges private live online cohorts for teams to your own schedule. Our government sales team walks you through the paperwork, and many of our courses are approved for VA education benefits; check eligibility for SPLK-1002 before enrolling.