Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about the Splunk Core Certified Power User (SPLK-1002), the Splunk credential for people who build knowledge objects, as of October 2026. This guide covers the 65-question exam, the ten blueprint topics and their weights, cost, the move to Cisco registration, the three-year lifecycle, DoD 8140 status, the roles it fits, and how it compares with the Core Certified User and the Enterprise Certified Admin.
The Splunk Core Certified Power User is the credential for people who build the searches, fields and knowledge objects the rest of a Splunk team relies on. Splunk, now a Cisco company, issues it, and you earn it by passing exam SPLK-1002.
It picks up where basic searching ends. The exam tests chart and timechart, filtering and formatting with eval, where and fillnull, correlating events with transaction and stats, and extracting fields with the Field Extractor. Then come the knowledge objects: field aliases, calculated fields, tags, event types, macros, workflow actions, data models and the Common Information Model (CIM) Add-On. You get 65 multiple choice questions in 60 minutes, closed book, delivered by Pearson VUE at a test center or online.
Splunk lists no prerequisite exam, so you don’t need the Splunk Core Certified User first. It’s rated entry level, and the credential is the prerequisite for the Advanced Power User and both Splunk admin certifications. Like every Splunk certification it runs on a three-year lifecycle. It’s issued and maintained by Splunk, which publishes a test blueprint with a weight for each of the ten topics.
The chart and timechart commands. The lightest topic at 5%.
The eval command, filtering with search and where, and fillnull. 10%.
Transactions, grouping events by fields and time, and transaction versus stats. The heaviest at 15%.
Regex and delimiter field extractions with the Field Extractor. 10%.
Describing, creating and using both. 10%.
Creating and using tags, and what event types are for and how to create one. 10%.
Basic macros, then arguments and variables. 10%.
GET, POST and Search workflow actions. 10%.
Data models and Pivot, attributes, and building a data model. 10%.
What the CIM is, the knowledge objects it ships with, and normalizing data. 10%.
Four things that set the Power User apart from a basic search credential or a general security exam.
Only three blueprint topics, worth 30% together, are about search commands: transforming commands, filtering and formatting, and correlating events. Everything else, 70% of the exam, is about building things inside Splunk, from field extractions and aliases to macros, workflow actions, data models and the CIM. That split is the difference between running a saved search and writing one, and it’s what this credential is built to show.
Each attempt costs $130 USD, retakes included, and Pearson VUE sells five registrations for $500. A failed first attempt means a 7-day wait, and a second failure means 14 days, so booking before you’re ready costs both money and time.
Splunk puts a weight on every topic. Correlating Events carries 15%, transforming commands only 5%, and the other eight sit at 10% each. Our guide to exam objectives documents shows how to turn weights like these into a study plan.
Splunk’s certification pages and candidate handbook make no DoD 8140 claim for the Power User, so don’t count on it to meet a cyber-coded position requirement on its own. If your role is coded, check the current matrix at the DoD Cyber Exchange.
Its weight comes from the Splunk track itself. The Power User is the prerequisite Splunk sets for the Advanced Power User, the Enterprise Certified Admin and the Cloud Certified Admin, so every Splunk admin credential is built on top of it. Badges are issued through Credly, and Splunk points employers to its Earner Directory there to check who holds what.
The certification, the exam, and how long it stays current, as of October 2026.
The Power User proves you can build what a Splunk team searches with. Splunk names three next-level certifications for it, and each one requires the Power User first. Our guides to the two admin exams are coming next.
The path for people who run self-managed Splunk Enterprise. It’s a professional-level exam of 56 multiple choice questions in 60 minutes for $130, with 17 blueprint topics running from license management and indexes to forwarder management and parsing. Passing it also renews a Power User you already hold.
The path if your organization runs Splunk Cloud Platform. It’s a professional-level exam of 60 multiple choice questions in 75 minutes for $130, covering data inputs and forwarder configuration, data management, user accounts, and basic monitoring and problem isolation in Splunk Cloud. Pick the admin exam that matches the platform your organization runs.
The move deeper into search. It’s an intermediate exam of 70 multiple choice questions in 60 minutes across 22 blueprint topics, including subsearches, multivalued fields, acceleration options, forms and drilldowns. Splunk lists the Power User as its prerequisite, and passing it renews your Power User too.
The Power User sits at the start of the Splunk track. Basic searching comes before it, and from here the path goes into running the platform or deeper into search and security analysis.
The search basics the exam assumes
Build the knowledge objects
Pick your path
Two questions to answer before you commit: can you sit it, and should you pursue the Splunk Power User specifically. Here’s a straight answer to both.
No prerequisite exam, no required course, no application to approve.
Splunk lists no prerequisites for the Power User, and that includes the Splunk Core Certified User, which is easy to assume you need first. Since October 20, 2026 you register through Cisco’s certification tracking system with a Cisco.com account, pay $130 per attempt, and sit the exam with Pearson VUE at a test center or online. You need to be at least 18 (candidates aged 13 to 17 need a signed parental acknowledgement form), and the name on your registration has to match your photo ID. Nobody reviews your Splunk experience first, but the questions assume you have plenty of it.
About 57 minutes of question time, no Splunk Docs, and no published passing score.
Three of the 60 minutes go to accepting the exam agreement, which leaves about 57 minutes for 65 questions. The exam is closed book, so Splunk Docs, Splunk Answers and course notes are all off limits, and Splunk treats a suspected violation as an automatic fail. There’s no published passing score either, so there’s no margin to calculate. Correlating Events is the heaviest topic at 15%, and one of its subtopics asks you to decide when to use transaction and when stats does the job, a judgment that reading alone won’t give you. Build every knowledge object on the blueprint in a real Splunk instance before you book.
The Power User fits roles where Splunk is a daily tool. It separates someone who runs searches from someone who builds the extractions, macros and data models other people’s searches depend on, and it’s the required step before any Splunk admin credential.
Works the alert queue in a security operations center, and in a Splunk shop that means SPL for most of the shift. Correlating events with transaction and stats, and tagging hosts or building event types for known patterns, are the Correlating Events and Tags and Event Types topics applied to triage.
Writes and tunes the searches that fire alerts. Macros keep shared detection logic in one place, field aliases and calculated fields let one rule work across sourcetypes, and the CIM topic is how a detection written once runs against data from many vendors.
Watches servers, applications and networks through Splunk dashboards and reports. Chart, timechart, and data models feeding Pivot are the daily tools here, which maps to the transforming commands and data model topics.
Uses Splunk logs to find out why a service slowed down or failed. Extracting fields from custom application logs and lining up events in time during an incident come straight from the Creating and Managing Fields and Correlating Events topics.
Owns the Splunk deployment and the knowledge objects that live on it, and usually holds or is working toward an admin certification. Both admin exams require the Power User first, and this is often the person who builds and maintains the shared macros, event types and data models.
Reconstructs what happened once an alert becomes an incident. Workflow actions that jump from an event to a lookup page or a new search, and transactions that stitch a user session together, are the Workflow Actions and Correlating Events topics at work.
Three Splunk credentials people often weigh together: the basic search exam below the Power User, the Power User itself, and the Splunk Enterprise admin exam that comes after it. Here’s how they line up.
| Splunk Power User | Splunk Core Certified User | Splunk Enterprise Certified Admin | |
|---|---|---|---|
| Issuer | Splunk, a Cisco company | Splunk, a Cisco company | Splunk, a Cisco company |
| Level | Entry | Entry | Professional |
| Focus | Correlating events, field extractions and knowledge objects, from aliases and macros to data models and the CIM | Basic searches, fields, lookups, alerts, and basic reports and dashboards | Licensing, indexes, users and authentication, forwarders, data inputs and parsing in Splunk Enterprise |
| Prerequisites | None | None | Splunk Core Certified Power User |
| Blueprint Topics | 10, weighted 5% to 15% | 8, weighted 5% to 22% | 17, weighted 5% to 10% |
| Exam | 65 multiple choice questions, 60 minutes | 60 multiple choice questions, 60 minutes | 56 multiple choice questions, 60 minutes |
| Passing Score | Not published by Splunk | Not published by Splunk | Not published by Splunk |
| Exam Cost | $130 per attempt | $130 per attempt | $130 per attempt |
| Delivery | Pearson VUE, test center or online | Pearson VUE, test center or online | Pearson VUE, test center or online |
| Validity | 3-year lifecycle | 3-year lifecycle | 3-year lifecycle |
| Good Fit For | SOC, operations and engineering staff who build what others search with | New Splunk users and people who search it occasionally | Administrators who run self-managed Splunk Enterprise |
All three exams cost the same $130 per attempt, use the same Cisco registration and Pearson VUE delivery, and sit on the same three-year lifecycle, so the choice comes down to which step you’re on. The Power User is the only one of the three that opens the admin track, and passing the Enterprise Certified Admin later also renews it. Our guides to the Splunk Enterprise Certified Admin (SPLK-1003) and the Splunk Cloud Certified Admin (SPLK-1005) are coming next.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our Splunk Core Certified Power User Boot Camp is the official Splunk Education Power User Fast Start course, four days of live online, instructor-led training from 10:00 AM to 6:00 PM Eastern (32 hours in total), taught by Splunk-authorized instructors through our Splunk Authorized Learning Partner. Its nine course topics run in Splunk’s order from Working with Time through Data Models, labs run in a provided Splunk environment with nothing to install, and you keep the official courseware after class. The program fee is $4,000. The SPLK-1002 exam is not included, so you register for it yourself and pay the $130 exam fee separately.
What a SOC analyst does with a SIEM all day, how to read the logs you’ll be searching, how to study from a weighted blueprint, what to expect on exam day, and what happens when a certification lapses.
Splunk is one of the SIEM platforms named as the hub of a SOC analyst’s shift. What the job looks like from alert triage to investigation, and where the searches and knowledge objects you build for SPLK-1002 fit into it.
Field extractions and event types only help if you can read the raw events behind them. A practical guide to security logs, including a home lab built on the free tier of Splunk.
Splunk calls it a test blueprint and gives every topic a weight. How to turn a list like the ten SPLK-1002 topics into a study plan that spends your time where the points are.
How ID checks, online proctoring and retake waits differ from one certification program to the next. Worth reading before any Pearson VUE appointment, including a closed-book exam like SPLK-1002.
Most IT certifications expire after two to four years, and each certification body handles a lapse differently. Useful context for Splunk’s three-year lifecycle and its 90-day grace period.
If your employer runs Splunk, a better-trained power user pays off for the whole team. How to pitch training and the exam fee in terms of what the business needs.
For security analysts weighing a vendor-neutral credential next to a Splunk one. Why CySA+ is the usual next step toward security operations work, and when a different exam fits better.
Splunk groups the SPLK-1002 exam into ten topics and publishes a weight for each. Correlating Events is the heaviest at 15%, Using Transforming Commands for Visualizations is the lightest at 5%, and the other eight carry 10% each. Click any topic for what it covers.
The lightest topic on the blueprint covers two commands: chart and timechart. You should know how each one turns raw events into a table that a visualization can draw, how chart splits results with over and by, and why timechart is the command built only for time series.
The eval command for creating and changing fields, the search and where commands for filtering results after the first pipe, and fillnull for replacing empty values before you report on them. Know how the two filters differ: where evaluates an expression and can compare one field with another, while search matches field values.
The heaviest topic and the one with the most subtopics, six in all. You identify transactions, group events by fields and by fields plus time, search and report on transactions, and decide when transaction is the right tool and when stats gets the same answer with less work.
Field extractions built with the Field Extractor (FX), using both of its methods: regular expression extractions for unstructured events and delimiter extractions for data separated by commas, pipes or spaces.
Describing, creating and using field aliases, which give a field an alternate name so data from different sourcetypes can share one field name, and calculated fields, which save an eval expression so it runs automatically at search time instead of being typed into every search.
Creating and using tags on field and value pairs, describing what event types are for, and creating an event type from a search so a recurring pattern such as a failed login can be found by name.
What a search macro is, how to create and use a basic one, and how to define arguments and variables so one macro can serve many searches. Four subtopics, ending with adding and using arguments in a macro.
The three workflow action types, GET, POST and Search, what each one does, and how to create each of them so a user can click a field value in an event and open a web page, send data to another system or launch a new search.
How data models relate to Pivot, how to identify data model attributes, and how to create a data model. This is the structure that lets people build reports in Pivot without writing SPL themselves.
Describing the Splunk CIM, listing the knowledge objects the CIM Add-On includes, and using the add-on to normalize data so searches and dashboards work the same way across data from different sources and vendors.
Topics and weights reflect the Splunk Core Certified Power User test blueprint published on splunk.com and downloaded on October 21, 2026. Splunk notes that the guidelines may change at any time without notice, so confirm the current blueprint on the Splunk certification page before scheduling.
The questions candidates ask most often when researching the Splunk Core Certified Power User.
The Splunk Core Certified Power User is an entry-level Splunk certification, issued by Splunk, a Cisco company, and earned by passing exam SPLK-1002. It shows you can go past basic searching. You correlate events with transaction and stats, extract fields with the Field Extractor, build the knowledge objects a team shares (field aliases, calculated fields, tags, event types, macros, workflow actions and data models), and normalize data with the Common Information Model (CIM) Add-On. It applies to both Splunk Enterprise and Splunk Cloud Platform.
It’s 65 multiple choice questions in 60 minutes, and three of those minutes go to reading and accepting the Splunk Certification Agreement, which leaves about 57 minutes for the questions. Pearson VUE delivers it at a test center or online with a remote proctor. The exam is closed book, so Splunk Docs, Splunk Answers and your own notes are all off limits. You can flag questions and come back to them before you submit, and the pass or fail result appears as soon as you finish.
No. Splunk lists no prerequisite exam and no prerequisite course for the Power User, and the test blueprint says there are no prerequisite exams for this certification. The Splunk Core Certified User is a separate entry-level exam of 60 questions on basic searching, fields, lookups, alerts and simple reports and dashboards. It’s a sensible warm-up if you’re new to Splunk, but you can go straight to SPLK-1002. If you do, Splunk won’t issue the Core Certified User badge automatically.
Splunk’s test blueprint lists ten topics: Using Transforming Commands for Visualizations (5%), Filtering and Formatting Results (10%), Correlating Events (15%), Creating and Managing Fields (10%), Creating Field Aliases and Calculated Fields (10%), Creating Tags and Event Types (10%), Creating and Using Macros (10%), Creating and Using Workflow Actions (10%), Creating Data Models (10%), and Using the Common Information Model (CIM) Add-On (10%). Three of them cover search commands. The remaining 70% of the exam goes to creating and using knowledge objects.
Yes, every topic carries a published weight. Correlating Events is the heaviest at 15%, Using Transforming Commands for Visualizations is the lightest at 5%, and the other eight are 10% each. Splunk doesn’t publish a passing score, and the result you see at the end is simply pass or fail. If you fail, your Pearson VUE account shows section feedback, though not a question-by-question breakdown. Splunk also calls the blueprint a general guideline and warns that related topics outside it can appear.
The exam costs $130 USD per attempt, and a retake costs the same. Pearson VUE also sells a bundle of five registrations for $500 USD. The exam is not included in Training Camp’s Splunk Core Certified Power User Boot Camp. You register and pay for it separately, and the $4,000 course price covers four days of live online instruction from Splunk-authorized instructors, the official Splunk Education Power User Fast Start courseware, which you keep, and hands-on labs in a provided Splunk environment.
Since October 20, 2026, Splunk certification exams are scheduled through Cisco’s certification tracking system, which you sign in to with a Cisco.com account. You no longer need a Splunk ID, and Splunk says it has migrated existing certification accounts to the Cisco system. Pearson VUE still delivers the exam, badges still come from Credly, and support now runs through the Learn with Cisco Help Center. Appointments booked through Splunk before the change are honored through March 1, 2027.
Splunk makes no DoD 8140 claim for the Power User on its certification pages or in its candidate handbook, so don’t rely on it alone to meet a cyber-coded position requirement. Splunk skills still show up in federal and defense job listings because agencies and contractors run Splunk in their security operations, but that demand comes from the tool itself. Check the current DoD 8140 matrix for your work role before you count on any credential. See the full DoD 8140 work role paths.
Splunk certifications run on a three-year lifecycle that starts on the date you earned your highest-level Splunk certification. You can renew the Power User by passing a next-level exam (the Advanced Power User, Enterprise Certified Admin or Cloud Certified Admin), which gives it a new three-year date, or by retaking and passing SPLK-1002 during the final year of your cycle. Splunk allows a 90-day grace period after the end date. Miss that and the certification goes inactive, and you start again at the Power User level.
The Power User fits roles where Splunk is a daily tool, such as SOC Analyst, Detection Engineer, IT Operations Analyst, Site Reliability Engineer, Splunk Engineer and Incident Responder. In those jobs the gap between running a search and building one matters, because field extractions, macros, event types and data models are what the whole team’s searches rest on. It’s also the required step before either Splunk admin certification, so anyone headed toward running Splunk needs it.
For most people, the Power User. The Splunk Core Certified User is a 60-question entry exam on basic searching and reporting, and nothing above it requires it. The Power User is the 65-question exam on knowledge objects, and it’s the prerequisite for the Splunk Enterprise Certified Admin, a 56-question professional-level exam on licensing, indexes, users, forwarders and data inputs. All three cost $130 per attempt and run 60 minutes. Take the Core Certified User first only if you’re new to Splunk and want a first exam on the basics.
Splunk rates it entry level, but the clock is tight and the questions get specific. You have about 57 minutes for 65 questions with no reference material. Splunk’s own sample questions ask how field aliases relate to lookups and which action type a POST workflow action uses, and the blueprint asks you to decide when transaction is the right tool instead of stats. Practice in a real Splunk instance and build every knowledge object on the blueprint at least once. If you fail, you wait 7 days for a second attempt and 14 days after a second failure, and every attempt costs $130.
If your team runs Splunk, yes. It’s a $130 exam with no prerequisites, it proves you can build the knowledge objects that make a Splunk deployment useful to everyone else, and it’s the gate to the Advanced Power User and both admin certifications. Moving on to one of those exams later also renews the Power User automatically. If your organization doesn’t use Splunk, a vendor-neutral analyst credential such as CompTIA CySA+ will travel further.
If you’re weighing the certification, planning a Splunk path from Power User to admin, or arranging Splunk training for a SOC or operations team, tell us where you are and we’ll help you map out the right next step.