Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A reference guide to the Splunk Cloud Certified Admin (exam SPLK-1005), the professional-level admin credential from Splunk, a Cisco company, as of October 2026. It covers the 60-question exam, the 13 weighted domains in Splunk’s blueprint, the Power User prerequisite, cost and the three-year recertification cycle, DoD 8140 status, the roles it fits, and how it compares with the Splunk Enterprise Certified Admin and the Splunk Core Certified Power User.
The Splunk Cloud Certified Admin is the credential for people who run Splunk Cloud Platform day to day. Splunk, now a Cisco company, issues it, and you earn it by passing exam SPLK-1005.
It tests the admin work that stays with the customer after Splunk takes over hosting: creating indexes, managing roles and LDAP, Active Directory or SAML authentication, reading configuration file precedence, connecting forwarders to Splunk Cloud, running a deployment server, building monitor, network, scripted, Windows and HTTP Event Collector inputs, fixing line breaking and timestamps in the parsing phase, transforming raw data with props.conf, transforms.conf and SEDCMD, installing apps and working with Splunk Cloud Support. The exam is 60 multiple choice questions in 75 minutes, and three of those minutes go to accepting the exam agreement.
Splunk requires the Splunk Core Certified Power User certification before you can sit it. The exam costs $130 USD per attempt, Pearson VUE delivers it at a test center or through online proctoring, and the credential runs on Splunk’s three-year certification lifecycle. Splunk publishes the 13 weighted domains in the test blueprint linked from its Splunk Cloud Certified Admin page.
Cloud topology, the admin’s tasks, and how Splunk Cloud differs from Splunk Enterprise. 5%.
Creating indexes, deleting data and monitoring indexing activity. 5%.
User roles and LDAP, Active Directory or SAML integration. 5%.
Files and directories, precedence, and index time versus search time. 5%.
Forwarder types, connecting a forwarder to Splunk Cloud and testing it. Tied for largest at 15%.
Deployment Server, deployment clients and deployment apps. 5%.
File and directory monitor inputs and their optional settings. Tied for largest at 15%.
TCP and UDP, scripted inputs, Windows inputs and the HTTP Event Collector. 10%.
Input phase processing, sourcetype fine-tuning and character set encoding. 5%.
Line breaking, timestamps and time zones, and Data Preview. 10%.
Transformations with props.conf and transforms.conf, and SEDCMD. 10%.
Installing apps, private apps and app management. 5%.
Isolating problems first, then the process for working with Support. 5%.
Four things that set this exam apart from the Splunk Enterprise admin exam and from vendor-neutral security analyst certifications.
On Splunk Cloud Platform, Splunk runs the infrastructure and the customer’s admin owns the work around the data: inputs, forwarders, parsing, users and apps. The blueprint is built around that split. Its first domain asks you to list how Splunk Cloud differs from Splunk Enterprise and how Self-Service Cloud differs from Managed Cloud, its last domain covers working with Splunk Cloud Support, and it has no license management or distributed search domains, both of which appear on the Splunk Enterprise admin blueprint.
Seven of the 13 domains deal with forwarders, inputs, parsing and raw data, and together they make up 70 percent of the blueprint. If you already connect forwarders, build inputs and fix broken timestamps at work, you are studying the domains that carry most of the points.
Splunk publishes all 13 domains, their sub-objectives and a weight for each, so you know where the questions are. Turn the weights into study hours with our guide to exam objectives documents.
The Splunk Cloud Certified Admin is not a DoD 8140 credential. Splunk certifications do not appear in the Qualification Matrix V2.1, so on its own it will not satisfy a cyber-coded position requirement. The current matrix is published at the DoD Cyber Exchange.
Its weight comes from the platform. Security operations and IT teams that move to Splunk Cloud still need someone in house who can get data in cleanly, and this is Splunk’s own exam for that person. Badges are issued through Credly, so an employer can check the credential and its expiration date directly.
The certification, the exam, and how long it stays current, as of October 2026.
Splunk’s recertification policy lists no next-level certification above the Cloud Admin, so the next move depends on what else your team runs. These three are the common directions.
The move for hybrid shops. If your organization also runs self-managed Splunk Enterprise, this admin exam adds license management, distributed search and agentless inputs across 17 domains. It is 56 multiple choice questions in 60 minutes for $130, with the same Power User prerequisite.
Worth it when you end up writing the searches as well as onboarding the data. Splunk rates it Intermediate, with 70 multiple choice questions in 60 minutes for $130 and the same Power User prerequisite, and it covers complex searches, advanced knowledge object use cases and dashboard and form best practices.
The security operations move. If the data you onboard feeds a SOC, CySA+ (CS0-004) covers the analyst side, with up to 85 questions in 165 minutes for $439. It also appears on the DoD 8140 Matrix V2.1, which the Splunk credential does not.
The Cloud Admin sits in the middle of the Splunk path. The Power User comes first because Splunk requires it, and from here the path either widens into self-managed Splunk or turns toward the security operations team that uses the data.
What Splunk requires first
Run the hosted platform
Pick your path
Two questions to answer before you commit: can you sit it, and should you pursue the Splunk Cloud Certified Admin specifically. Here’s a straight answer to both.
One required certification, no required course, no experience check.
Splunk lists the Splunk Core Certified Power User certification as the prerequisite for this exam, and that is the only gate. There are no required courses and nobody reviews your work history. You sign in to Cisco’s certification tracking system, pay $130 USD, and book a Pearson VUE test center seat or an online proctored session. Splunk suggests the Splunk Cloud Administration course for new admins and Transitioning to Splunk Cloud for Splunk Enterprise admins moving over, but neither is a requirement.
No notes, no Splunk Docs, and a pass or fail result with no number attached.
Splunk exams are closed book. Notes, course materials and Splunk Docs are all off limits, and a perceived violation is an automatic fail with the fee forfeited. Splunk also doesn’t publish the passing score, so there is no margin to calculate. The questions lean on configuration detail: which file a setting lives in, which setting wins when two apps disagree, what happens at input time versus parse time. Admins who have only clicked through Splunk Web tend to find that harder than they expect. Every attempt costs $130, and a failed first attempt means a seven-day wait before the next one.
The Splunk Cloud Certified Admin fits the roles that own the data pipeline into Splunk Cloud. Security, IT operations and observability teams all depend on that pipeline, and the six roles below are where the credential does its work.
The direct match. Creates indexes, manages roles and authentication, installs apps and keeps forwarders reporting in. Every one of the 13 domains describes part of this job, and the credential is Splunk’s own test of whether you can do it on the hosted platform.
Onboards new log sources for the security team and makes sure they land parsed correctly. Line breaking, timestamp extraction, sourcetype assignment and the props.conf and transforms.conf work in domains 9 through 11 decide whether a detection search finds anything at all.
Sits between the analysts and the platform. When an analyst reports that a firewall’s logs stopped arriving, this is the person who works out whether the forwarder, the network, the input or the parsing broke, which is domain 13 applied to a live queue.
Gets application and infrastructure telemetry into Splunk Cloud. The HTTP Event Collector, scripted inputs and network inputs in domain 8 are the daily tools, along with index design that keeps each team’s data where the right people can search it.
The admin who inherits Splunk along with the servers. Already at home with Linux, Windows and configuration files, they use the credential to show they can run a forwarder fleet from a deployment server and collect Windows event logs the right way.
Works for a partner or an internal platform team, onboarding data for many groups at once. The job is judged on clean onboarding: the right index, the right sourcetype, events broken correctly, and private apps that make it through installation on Splunk Cloud.
Three Splunk exams on the same path: the Power User you need first, and two admin credentials that split by where Splunk runs. Here’s how they line up.
| Splunk Cloud Certified Admin | Splunk Enterprise Certified Admin | Splunk Core Certified Power User | |
|---|---|---|---|
| Exam Code | SPLK-1005 | SPLK-1003 | SPLK-1002 |
| Issuer | Splunk, a Cisco company | Splunk, a Cisco company | Splunk, a Cisco company |
| Level | Professional | Professional | Entry |
| Focus | Inputs, forwarders, parsing, apps and Support on Splunk Cloud Platform | Licenses, indexes, distributed search, forwarders and inputs on self-managed Splunk Enterprise | SPL searching, knowledge objects, data models and CIM normalization |
| Prerequisites | Splunk Core Certified Power User | Splunk Core Certified Power User | None |
| Domains | 13, weighted 5% to 15% | 17, weighted 5% to 10% | 10, weighted 5% to 15% |
| Exam | 60 multiple choice, 75 minutes | 56 multiple choice, 60 minutes | 65 multiple choice, 60 minutes |
| Passing Score | Not published (pass or fail) | Not published (pass or fail) | Not published (pass or fail) |
| Exam Cost | $130 per attempt | $130 per attempt | $130 per attempt |
| Retake | Full fee, 7-day wait after a first fail | Full fee, 7-day wait after a first fail | Full fee, 7-day wait after a first fail |
| Validity | 3 years | 3 years | 3 years |
| Good Fit For | Admins of Splunk Cloud Platform and Enterprise admins moving to it | Admins who run Splunk Enterprise on their own servers or cloud accounts | Analysts and engineers who search Splunk daily, and every future Splunk admin |
All three exams are booked through Cisco’s certification tracking system and delivered by Pearson VUE, and exam times include the 3 minutes Splunk gives you to accept the exam agreement. Neither admin credential requires the other, so the choice comes down to whether Splunk hosts your deployment or you do. None of the three appears on the DoD 8140 Matrix V2.1. Facts for the Enterprise Admin and Power User come from Splunk’s certification pages and test blueprints as of October 2026.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our Splunk Cloud Certified Admin Boot Camp is the official Splunk Education course, Splunk Cloud Administration, taught live online over four half days (10:00 AM to 2:30 PM Eastern, about 18 hours in total) by Splunk-authorized instructors through our Splunk Authorized Learning Partner. Its 15 modules run in Splunk’s own order and map to all 13 SPLK-1005 domains, with hands-on labs in a provided environment that includes a Splunk Cloud search head, Universal Forwarders and a Deployment Server. You keep the official courseware after class, and the course is $2,000. The SPLK-1005 exam is not included. You book it yourself for $130 once your Power User certification is on record.
What the analysts searching your Splunk data do all day, how to read the logs you onboard, how to study from a weighted blueprint, and what to plan before a three-year renewal comes due.
What alert triage and investigation look like across a real shift, the SIEM tools on the desk with Splunk among them, and the downsides nobody puts in the job posting. Useful context for the admin whose data those analysts search.
SIEM basics, the three types of log data, log levels, common attack patterns and how to cut false positives, with a home lab suggestion that includes the free tier of Splunk.
Splunk publishes all 13 SPLK-1005 domains with weights. How to read the verbs in an objective and turn domain percentages into a study plan, so the two 15 percent domains get the hours they deserve.
Splunk reports pass or fail and no number. How to read a practice result by domain instead of by total, why small samples mislead, and when a score says you are ready to book.
What happens when a certification lapses, using ISC2 and CompTIA as the worked examples, and how to keep one from expiring. Splunk runs a three year cycle with a 90 day grace period, so the same calendar habits apply.
How to build the business case for certification training, the benefits many employers already offer, and what to do when the first answer is no. Worth reading before you ask for a course plus a $130 exam.
For admins whose Splunk data feeds a security team, the case for CySA+ as the next CompTIA step after Security+ and what that analyst exam expects you to do with SIEM output.
Splunk organizes SPLK-1005 into 13 domains and publishes a weight for each. Getting Data in Cloud and Monitor Inputs carry the most at 15 percent each, three domains sit at 10 percent, and the other eight are 5 percent apiece. Click any domain for what it covers.
Cloud topology, the tasks that belong to the Splunk Cloud administrator, the primary differences between Splunk Cloud and Splunk Enterprise, and the differences between Self-Service Cloud and Managed Cloud. It draws the line between what Splunk operates for you and what you own.
What a Splunk index is, how to create indexes in Splunk Cloud, how to delete data from an index, and how to monitor indexing activity so you notice when a source goes quiet or its volume jumps.
Administering Splunk user roles and integrating Splunk with LDAP, Active Directory or SAML. Expect questions on how roles shape what a user can see and do, and how external authentication sits alongside native Splunk accounts.
The configuration file and directory structure, the precedence rules that decide which setting wins when the same attribute appears in more than one place, and which processes run at index time versus search time.
Tied for the largest weight on the exam. The Splunk forwarder types and the role forwarders play, configuring a forwarder to send to Splunk Cloud, testing the forwarder connection, and the optional forwarder settings you can tune once data is flowing.
The Splunk Deployment Server and forwarder management, configuring forwarders as deployment clients, and managing them with deployment apps, so one change reaches every forwarder in a server class without logging in to each machine.
The other 15 percent domain. How Splunk processes incoming data, creating file and directory monitor inputs, and using the optional monitor input settings that control what gets read and how each event is labeled on the way in.
TCP and UDP network inputs and their optional settings, a basic scripted input, the Windows input types and what each one is for, and getting data in through the HTTP Event Collector (HEC).
The default processing that happens during the input phase and the input phase options you can configure, such as sourcetype fine-tuning and character set encoding.
Default processing during parsing, optimizing event line breaking, how timestamps and time zones are extracted or assigned to events, and using Data Preview to confirm events break correctly before anything is indexed.
How data transformations are defined and invoked, using props.conf and transforms.conf together to modify raw data, and using SEDCMD to rewrite raw data, for example to mask a value before it reaches the index.
The process for installing apps in Splunk Cloud, what private apps are, and how apps are managed once they are in place.
Isolating a problem before you contact Splunk Cloud Support and the process for working with Support once you do. On a hosted platform this is part of the admin job, because Splunk, not you, runs the infrastructure underneath.
Domains and weights reflect the Splunk Cloud Certified Admin test blueprint as published on splunk.com and verified on October 21, 2026. Splunk notes that related topics outside the list may also appear and that the blueprint can change without notice, so confirm the current version on the Splunk certification page before scheduling.
The questions candidates ask most often when researching the Splunk Cloud Certified Admin and exam SPLK-1005.
The Splunk Cloud Certified Admin is the professional-level credential for administrators of Splunk Cloud Platform. Splunk, a Cisco company, issues it, and you earn it by passing exam SPLK-1005. It shows that you can manage indexes, users and roles, read configuration file precedence, connect and manage forwarders, build monitor, network, scripted, Windows and HTTP Event Collector inputs, fix parsing problems, transform raw data, install apps and work with Splunk Cloud Support.
It’s 60 multiple choice questions with 75 minutes on the clock, and that time includes three minutes to read and accept the Splunk Certification Agreement, which leaves 72 minutes for the questions. Pearson VUE delivers it at a test center or through online proctoring. The exam is closed book. You can flag questions and come back to them, and you see a pass or fail result as soon as you submit.
Yes, one. Splunk lists the Splunk Core Certified Power User certification as the prerequisite, so you pass the Power User exam first. There are no prerequisite courses and no experience requirement. Splunk suggests the Splunk Cloud Administration course for new admins and Transitioning to Splunk Cloud for experienced Splunk Enterprise admins, but neither is required to register.
Splunk Cloud Overview, Index Management, User Authentication and Authorization, Splunk Configuration Files, Getting Data in Cloud, Forwarder Management, Monitor Inputs, Network and Other Inputs, Fine-tuning Inputs, Parsing Phase and Data Preview, Manipulating Raw Data, Installing and Managing Apps, and Working with Splunk Cloud Support. Getting Data in Cloud and Monitor Inputs weigh 15 percent each. Network and Other Inputs, Parsing Phase and Data Preview, and Manipulating Raw Data weigh 10 percent each, and the other eight weigh 5 percent each.
Splunk doesn’t publish one. Your result shows as pass or fail on screen right after you submit. If you pass, you get no further breakdown. If you don’t, you can see section-level feedback in your exam account, though Splunk doesn’t provide a question-by-question review. The practical target is to be solid on every domain, starting with the forwarder and input domains that carry the most weight.
The exam costs $130 USD per attempt, and every retake costs the same. Splunk also points candidates to a bundle of five registrations for $500 USD in the Pearson VUE voucher store. The exam is not included in Training Camp’s Splunk Cloud Certified Admin Boot Camp. The $2,000 course fee covers the official Splunk Cloud Administration course over four half days of live online training, with hands-on labs in a provided Splunk environment and the official courseware to keep, and you book SPLK-1005 yourself after class.
Since October 20, 2026, Splunk exams are scheduled through Cisco’s certification tracking system at cp.certmetrics.com instead of through a Splunk account. You sign in there, with a Cisco.com account if you’re asked to create one, and schedule the exam. Pearson VUE still delivers it. Appointments made through the old Splunk process are honored through March 1, 2027, existing exam vouchers still work, and badges still come from Credly.
No. Splunk certifications don’t appear on the DoD 8140 Qualification Matrix V2.1, so the Splunk Cloud Certified Admin on its own won’t satisfy a cyber-coded position requirement. Splunk still shows up in federal and defense job listings because agencies and contractors run it, but that demand comes from the platform, not the matrix. See the full DoD 8140 work role paths.
Splunk certifications run on a three-year lifecycle that starts on the date you earned your highest-level Splunk certification. Splunk lists no higher-level exam that renews the Cloud Admin, so you renew it by retaking and passing the current exam during the final year of the cycle, at the normal $130 fee. Passing it also renews your Power User certification. Miss the date and a 90-day grace period applies. After that the certification goes inactive and you start again at the Power User level.
It maps to the roles that own the data going into Splunk Cloud: Splunk Administrator, SIEM Engineer, Security Engineer, Observability Engineer, Systems Administrator and Splunk Consultant. Teams hiring for those roles need someone who can onboard a new source with the right index, sourcetype and timestamps, keep a forwarder fleet healthy and isolate a problem before it turns into a support case. Splunk doesn’t publish salary data tied to the credential, and this guide doesn’t quote figures.
Pick the one that matches where your Splunk runs. If Splunk hosts your deployment in Splunk Cloud Platform, take the Splunk Cloud Certified Admin (SPLK-1005), a 60-question, 75-minute exam across 13 domains. If you run Splunk Enterprise on your own servers or cloud accounts, take the Splunk Enterprise Certified Admin (SPLK-1003), a 56-question, 60-minute exam across 17 domains that adds license management and distributed search. Both cost $130, both require the Splunk Core Certified Power User, and neither requires the other.
Search syntax isn’t the hard part, since the Power User exam already covered it. The difficulty is configuration detail. You’ll be asked which file a setting belongs in, which copy of a setting wins under precedence rules, what happens in the input phase versus the parsing phase, and how a forwarder gets pointed at Splunk Cloud. Candidates who have only worked in Splunk Web tend to miss those. Spend lab time writing inputs.conf, props.conf and transforms.conf by hand, break line breaking and timestamps on purpose and fix them in Data Preview, and read all 13 domains line by line before you book.
For anyone who administers Splunk Cloud Platform, yes. It’s the only Splunk admin certification built for Splunk Cloud Platform, the exam costs $130, and 70 percent of the blueprint is the forwarder, input and parsing work that decides whether data in Splunk is usable at all. If your Splunk runs on your own servers, the Enterprise admin credential fits better. If you need a DoD 8140 listed credential, pair it with one from the matrix, such as CySA+.
If you’re weighing the certification, planning a move from Splunk Enterprise to Splunk Cloud, or arranging Splunk training for a team, tell us where you are and we’ll help you map out the right next step.