Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about the Splunk Enterprise Certified Admin (SPLK-1003), the professional-level administrator certification from Splunk, a Cisco company, as of October 2026. This guide covers the 56-question exam, the 17 weighted sections of Splunk’s blueprint, the Power User prerequisite, the $130 fee, the October 2026 move to Cisco registration, the three-year lifecycle, the roles it fits, and how it compares with the Splunk Cloud Certified Admin and the Splunk Core Certified Power User.
The Splunk Enterprise Certified Admin is the certification for people who run Splunk Enterprise themselves. Splunk, now a Cisco company, issues it at the Professional level, and you earn it by passing exam SPLK-1003.
It covers the daily work of a Splunk Enterprise administrator: identifying the Splunk components, managing licenses and license violations, reading configuration layering and precedence with btool, building indexes and retention policies, setting up roles, LDAP and multifactor authentication, configuring distributed search, deploying forwarders through the deployment server, creating monitor, network, scripted and HTTP Event Collector inputs, and fixing line breaking, timestamps and raw data before it’s indexed. The exam is 56 multiple choice questions in 60 minutes, delivered by Pearson VUE.
Splunk requires the Splunk Core Certified Power User certification before you can register, and it suggests its System Administration and Data Administration courses as preparation. Like every Splunk certification, it runs on a three-year lifecycle. It’s issued and maintained by Splunk, which publishes the 17-section test blueprint with a weight on every section.
Sections 1.0 and 2.0. Splunk components, license types and license violations. 10% combined.
Sections 3.0 and 4.0. Directory structure, layering, precedence and btool, then buckets, indexes.conf, the fishbucket and retention. 15% combined.
Sections 5.0 and 6.0. Roles, custom roles and users, LDAP, other authentication options and multifactor authentication. 10% combined.
Sections 7.0 and 8.0. Input basics, forwarder types, search heads, search peers and search head scaling. 15% combined.
Sections 9.0 to 11.0. The three indexing phases, forwarder options, the deployment server, deployment apps and client groups. The largest group at 20%.
Sections 12.0 to 14.0. File and directory monitors, TCP and UDP, scripted inputs, WMI and the HTTP Event Collector. 15% combined.
Sections 15.0 to 17.0. Sourcetype and encoding settings, line breaking, timestamps, Data Preview, props.conf, transforms.conf and SEDCMD. 15% combined.
Four things that separate the Enterprise Admin from the search-side Splunk exams and from the Cloud Admin that sits next to it.
License management, indexers, search heads, configuration files, forwarders and data inputs are the daily work of keeping a Splunk Enterprise deployment healthy, and that’s what the blueprint tests. Splunk’s own exam page says it’s best if your deployment will not be migrating to Splunk Cloud. Settle that question before you book, because the Cloud Admin exam drops the license management and distributed search sections and adds a section on working with Splunk Cloud Support.
The exam costs $130 USD per attempt as of October 2026, the same fee Splunk lists for its other exams from Power User to Architect. Every retake costs the full $130 again, so the five registrations for $500 that Splunk sells are the cheaper buy for a team or for anyone planning more than one Splunk exam.
Splunk publishes all 17 sections with a percentage on each, and three of them (Indexes, Distributed Search and Forwarder Management) count double. Turn that into a lab plan. Our guide to exam objectives documents shows how.
Splunk doesn’t list a DoD 8140 qualification for the Enterprise Certified Admin on its exam page or in its candidate handbook, so don’t count on it alone for a cyber-coded position. The current matrix is published at the DoD Cyber Exchange.
Its weight comes from the platform instead. Splunk writes the exam for the product your SOC or IT operations team already runs, and since Splunk became a Cisco company the certification lives in Cisco’s system. Since October 20, 2026, you register through Cisco’s CertMetrics portal and the badge comes from Cisco’s Credly page. Some federal contractor listings for Splunk administrators ask for this certification and, separately, a DoD baseline credential such as Security+.
Everything you need to know about the certification, the exam, and how long it stays current, as of October 2026.
The Enterprise Admin proves you can run a self-managed Splunk deployment. From here most people go deeper on Splunk, follow their organization to Splunk Cloud, or add a credential for the security work done on top of the data. These are the three common next moves.
The next level on Splunk’s Enterprise track, and the higher exam that renews the Admin when you pass it. It’s an expert-level exam of 85 questions in 90 minutes at the same $130, and it requires Power User, the Enterprise Admin and four Splunk courses, including Splunk Cluster Administration. Managing indexer and search head clustering is Architect material. SPLK-1003 only asks you to list search head scaling options.
The move when your organization goes to Splunk Cloud. It has the same Power User prerequisite and $130 fee, with 60 questions in 75 minutes across 13 sections. It adds installing and managing apps and working with Splunk Cloud Support, and it drops the license management and distributed search material an Enterprise admin owns.
The security move. If your Splunk deployment feeds a SOC, CySA+ (CS0-004) covers the analyst work done on top of it in up to 85 questions over 165 minutes, with a passing score of 750 on a 100 to 900 scale. Unlike SPLK-1003, it’s approved under DoD 8140 for ten DCWF work roles, which matters on federal contracts.
The Enterprise Admin sits in the middle of Splunk’s administrator path. Power User comes before it and is required, and from here the path goes up to the Architect or across to the security side.
What to have in place first
Run the platform
Pick your path
Two questions to answer before you commit: can you sit it, and should you pursue the Splunk Enterprise Admin specifically. Here’s a straight answer to both.
One certification prerequisite. Courses are suggested, not enforced.
Splunk lists one prerequisite for the Enterprise Certified Admin, and it’s the Splunk Core Certified Power User certification. There’s no required course. Splunk Enterprise System Administration and Splunk Enterprise Data Administration appear on the blueprint as suggested training, not as a gate. With Power User on your record, you register through Cisco’s CertMetrics portal, pay $130 and book a Pearson VUE test center or an online proctored session. You must be 18 or older (13 to 17 with a signed parental form), and the name you register under has to match the full name on your photo ID.
57 minutes for 56 questions, no Splunk Docs, and a result that only says pass or fail.
Splunk exams are not open-note. Notes, course materials, Splunk Docs and Splunk Answers are all off limits, and Splunk treats a perceived violation as an automatic fail with the fee forfeited. Splunk doesn’t publish a passing score, and a passing candidate gets no breakdown at all. If you’ve only ever searched in Splunk, expect the configuration questions to be more specific than Power User prepared you for: which file wins under precedence, what a bucket type means for retention, how a client group gets its deployment apps. Work through all 17 sections on a real instance, check your settings with btool, and book once you can explain each one. A failed first attempt means a 7-day wait and another $130.
The Splunk Enterprise Admin fits the roles that keep a Splunk Enterprise deployment running and the data flowing into it. It’s the credential that answers a listing asking for someone who can own the license, the indexes and the forwarders rather than only search the results.
Owns the Splunk Enterprise deployment day to day: license usage, index retention, user roles, forwarder health and the inputs that feed it. This is the role the certification was written for, and all 17 blueprint sections show up somewhere in the job.
Builds and maintains the data pipeline a security team searches. Getting logs in with the right sourcetype, timestamps and line breaking is the parsing material in sections 15.0 to 17.0, and masking sensitive fields with SEDCMD or transforms is part of the same work.
Supports the analysts rather than working the alerts. Adds new log sources through the deployment server, keeps searches running across the search peers and fixes inputs when a source goes quiet, which is Forwarder Management and Distributed Search, two of the three 10 percent sections.
Uses Splunk for infrastructure and application monitoring. Monitor inputs, scripted inputs and the HTTP Event Collector are how server, application and custom data arrives, and the network and agentless input sections cover the sources that can’t run a forwarder.
Runs the servers Splunk lives on. Index structure, bucket types and retention policy decide how much storage the platform needs and for how long, and configuration layering with btool explains why a setting on one server isn’t taking effect.
Builds Splunk Enterprise environments for clients. The Enterprise Admin is the base credential for the work and a required step toward the Splunk Enterprise Certified Architect, the next exam on Splunk’s track for people who design distributed deployments.
Three Splunk certifications people weigh together: the search-side prerequisite, and the two administrator exams that split by where Splunk runs. Here’s how they line up.
| Splunk Enterprise Certified Admin | Splunk Cloud Certified Admin | Splunk Core Certified Power User | |
|---|---|---|---|
| Exam Code | SPLK-1003 | SPLK-1005 | SPLK-1002 |
| Level | Professional | Professional | Entry |
| Focus | Running self-managed Splunk Enterprise: licenses, indexes, distributed search, forwarders, inputs and parsing | Managing Splunk Cloud: indexes, inputs, parsing, apps and working with Splunk Cloud Support | Searching and knowledge objects: SPL, fields, tags, event types, macros, data models and the CIM |
| Prerequisite | Power User | Power User | None |
| Blueprint | 17 sections, 5% or 10% each | 13 sections, 5% to 15% each | 10 sections, 5% to 15% each |
| Exam | 56 multiple choice questions, 60 minutes | 60 multiple choice questions, 75 minutes | 65 multiple choice questions, 60 minutes |
| Passing Score | Not published by Splunk | Not published by Splunk | Not published by Splunk |
| Exam Cost | $130 per attempt | $130 per attempt | $130 per attempt |
| Validity | 3-year lifecycle | 3-year lifecycle | 3-year lifecycle |
| Higher Exam That Renews It | Enterprise Certified Architect | None, renew by retake | Advanced Power User, Enterprise Admin or Cloud Admin |
| Good Fit For | Administrators of self-hosted Splunk Enterprise | Administrators of Splunk Cloud deployments | Analysts and anyone who builds searches, reports and knowledge objects |
All three are Splunk exams at the same $130 per attempt, registered through Cisco and delivered by Pearson VUE. The two administrator exams both require Power User, so the real choice is between Enterprise and Cloud, and Splunk’s exam page says the Enterprise Admin is best if your deployment won’t be migrating to Splunk Cloud. Splunk makes no DoD 8140 claim for any of the three. If you need an 8140 credential next to your Splunk skills, the CySA+ guide and the Security+ guide cover the common picks.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our Splunk Enterprise Certified Admin Boot Camp is five days of live online training, 10:00 AM to 5:00 PM ET, built on Splunk Education’s official Splunk Enterprise Administration Fast Start: 12 hours of Splunk Enterprise System Administration followed by 18 hours of Splunk Enterprise Data Administration. Splunk-authorized instructors teach it through our Splunk Authorized Learning Partner, the labs run in a provided environment with indexers, a search head, a deployment server and universal forwarders, and you keep the official courseware and lab guides. The program is $3,750. The SPLK-1003 exam is not included, so you register and pay the $130 fee separately.
What the SOC does with the data you keep flowing, how to read the logs you index, how to study from a weighted blueprint, what Pearson VUE exam day looks like, and what happens when a certification lapses.
SIEM platforms like Splunk are the hub of a SOC analyst’s day. What the analysts on the other side of your deployment do with the data, from alert triage and investigation to the alert fatigue that comes with a noisy feed.
Line breaking and timestamps are admin settings, and analysts live with the results. A practical look at reading security logs, from SIEM basics and false positives to a home lab built on the free tier of Splunk.
Splunk publishes 17 sections with a weight on each. How to read a blueprint like that, what its verbs tell you about depth, and how to turn the three 10 percent sections into a study plan.
SPLK-1003 runs at Pearson VUE test centers and through online proctoring. ID name matching, check-in, what ends an online session early and how retake waits compare across vendors.
Splunk doesn’t publish a passing score for SPLK-1003, which makes a practice result easy to misread. What the number tells you, why the domain breakdown matters more than the total, and when to book.
Splunk gives a 90-day grace period, then sets a lapsed certification to inactive. How expiration works at ISC2 and CompTIA, and what an expired credential can cost you with an employer.
A company that already runs Splunk has a reason to pay for the people who keep it healthy. How to build the request, what to say in the meeting and the tax rules that make training cheaper for your employer.
Splunk organizes the exam into 17 sections and publishes a weight for each one. Splunk Indexes, Distributed Search and Forwarder Management count for 10 percent apiece and the other 14 sections for 5 percent each, which makes the first eight sections exactly half the exam and the last nine the other half. Click any section for what it covers.
A single sub-topic: identifying the Splunk components. You need to know what forwarders, indexers and search heads each do and where the supporting roles fit, because every later section assumes you know which component a setting belongs on.
Identifying the Splunk license types and understanding license violations. Expect questions on what each license allows and disables, and on what happens to a deployment when daily indexing goes over the licensed volume.
The configuration directory structure, how configuration layering works and how precedence decides which setting wins when the same attribute appears in more than one app or directory. It also covers using btool to examine the settings Splunk is actually running with.
One of the three 10 percent sections. It covers index structure, the types of index buckets, checking index data integrity, the options in indexes.conf, what the fishbucket is for and how to apply a data retention policy.
How user roles work in Splunk, creating a custom role and adding Splunk users. The practical skill is building a role that gives a team the indexes and capabilities it needs and nothing more.
Integrating Splunk with LDAP, the other user authentication options Splunk supports, and the steps to enable multifactor authentication in Splunk.
The basic settings every input has, the Splunk forwarder types, configuring a forwarder and adding an input to a universal forwarder from the command line.
The second 10 percent section. It covers how distributed search works, the roles of the search head and the search peers, configuring a distributed search group and the options for scaling search heads.
The three phases of the Splunk indexing process and the input options Splunk offers. This is the map the remaining sections fill in, so learn which phase each setting acts in before you move on.
Configuring forwarders to send data and identifying the additional forwarder options beyond a basic setup.
The third 10 percent section and the one with the most sub-topics. It covers deployment management, the Splunk Deployment Server, managing forwarders with deployment apps, configuring deployment clients and client groups, and monitoring forwarder management activity.
Creating file and directory monitor inputs, using the optional settings on a monitor input and deploying a remote monitor input to a forwarder.
Creating TCP and UDP network inputs, the optional settings for network inputs and creating a basic scripted input.
Creating Windows Management Instrumentation (WMI) inputs and describing the HTTP Event Collector, the two ways data reaches Splunk without a forwarder on the source.
The default processing that happens during the input phase, and configuring input phase options such as sourcetype fine-tuning and character set encoding.
The default processing during parsing, optimizing and configuring event line breaking, how timestamps and time zones are extracted or assigned to events, and using Data Preview to check event creation before data is indexed.
How data transformations are defined and invoked, then using props.conf and transforms.conf to mask or delete raw data as it is indexed, override sourcetype or host from event values, route events to specific indexes and keep unwanted events out. It closes with SEDCMD for modifying raw data.
Sections and weights reflect the Splunk Enterprise Certified Admin test blueprint that Splunk links from its exam page, verified on October 21, 2026. Splunk notes that related topics outside the list may also appear and that the guidelines may change without notice, so confirm the current blueprint on the Splunk certification page before scheduling.
The questions candidates ask most often when researching the Splunk Enterprise Certified Admin.
The Splunk Enterprise Certified Admin is Splunk’s professional-level certification for people who run self-managed Splunk Enterprise, issued by Splunk, a Cisco company, when you pass exam SPLK-1003. It shows that you can identify the Splunk components, manage licenses, work through configuration file precedence, build indexes and retention policies, set up roles and authentication, configure distributed search, manage forwarders with the deployment server, create data inputs and control how data is parsed and transformed before it’s indexed.
It’s 56 multiple choice questions with 60 minutes of seat time, and 3 of those minutes go to accepting the Splunk Certification Agreement, which leaves 57 minutes for the questions. Splunk’s own sample questions include select-all-that-apply items. You take it at a Pearson VUE test center or at home with an online proctor, and it’s closed book. You can flag questions for review and go back before you submit, and the result shows as pass or fail as soon as you finish.
Splunk certification moved onto Cisco’s systems. Beginning October 20, 2026, you register for SPLK-1003 through Cisco’s CertMetrics portal, and certification support runs through the Learn with Cisco Help Center. Pearson VUE still delivers the exam at test centers and online. Appointments booked through Splunk before the change are honored through March 1, 2027, existing active Splunk exam vouchers still work, and digital badges still come from Credly, now on Cisco’s Credly page.
Yes, one. Splunk requires the Splunk Core Certified Power User certification before you can take the Enterprise Admin exam, and the Power User exam itself has no prerequisite. There’s no required course. Splunk suggests Splunk Enterprise System Administration and Splunk Enterprise Data Administration as preparation but doesn’t enforce them. You also need to be at least 18 (13 to 17 with a signed parental form), register under the full name on your photo ID, and bring a second form of identification to the exam.
Splunk’s blueprint lists Splunk Admin Basics, License Management, Splunk Configuration Files, Splunk Indexes, Splunk User Management, Splunk Authentication Management, Getting Data In, Distributed Search, Getting Data In (Staging), Configuring Forwarders, Forwarder Management, Monitor Inputs, Network and Scripted Inputs, Agentless Inputs, Fine Tuning Inputs, Parsing Phase and Data, and Manipulating Raw Data. The first eight cover running the platform. The last nine cover getting data into it and shaping that data on the way in.
Three sections count for 10 percent each (Splunk Indexes, Distributed Search and Forwarder Management) and the other 14 count for 5 percent each, so sections 1.0 to 8.0 make up half the exam and sections 9.0 to 17.0 the other half. If the weights track question counts, a 5 percent section is roughly three of the 56 questions, so no single small section decides your result, but skipping several of them will. Splunk doesn’t publish a passing score. You see pass or fail, and only an unsuccessful candidate gets section feedback.
The exam costs $130 USD per attempt as of October 2026, and every retake costs the same. Splunk also offers five registrations for $500, and organizations holding Splunk Education training units can convert 13 units into one exam voucher or 50 units into five. The exam is not included in Training Camp’s Splunk Enterprise Certified Admin Boot Camp. The boot camp’s $3,750 fee covers five days of live online official Splunk Education training, the provided lab environment and the courseware you keep, and you register for SPLK-1003 separately.
Splunk doesn’t claim it is. Neither the Enterprise Certified Admin exam page nor the Splunk Certification Candidate Handbook lists a DoD 8140 qualification, so treat it as a platform credential and check the current matrix on the DoD Cyber Exchange before counting on it for a cyber-coded position. Some federal contractor listings for Splunk administrators ask for this certification and, separately, a DoD baseline credential such as Security+ or CySA+. See the full DoD 8140 work role paths.
Splunk runs every certification on a three-year lifecycle that starts from the date you earned your highest-level Splunk certification. You can renew in two ways: pass the Splunk Enterprise Certified Architect exam, or retake and pass the Enterprise Admin exam during the final year of your cycle. A pass outside that final year doesn’t count. Either route also renews your Power User certification. Splunk gives a 90-day grace period after the end date and no extensions, a certification that isn’t renewed by then goes inactive, and the policy has no continuing education option.
The Splunk Enterprise Admin maps to the roles that keep Splunk Enterprise running: Splunk Administrator, SIEM Engineer, SOC Engineer, IT Operations Engineer, Infrastructure Engineer and Splunk Consultant. Employers hiring for those roles want someone who can onboard a new data source, keep the license and the indexes healthy and work out why a forwarder stopped sending, and the certification is Splunk’s own proof that you can. It’s also the required step before the Splunk Enterprise Certified Architect for anyone heading toward deployment design.
Power User comes first for anyone heading to an admin exam, because both admin exams require it. It’s 65 multiple choice questions in 60 minutes on searching and knowledge objects. After that, the choice follows where your Splunk runs. If your organization runs Splunk Enterprise on its own infrastructure, take the Enterprise Certified Admin (SPLK-1003), 56 questions in 60 minutes across 17 sections. If it runs Splunk Cloud, take the Cloud Certified Admin (SPLK-1005), 60 questions in 75 minutes with a section on working with Splunk Cloud Support. All three cost $130 per attempt and share the same three-year lifecycle.
Multiple choice makes it look easier than it is. You get 57 minutes for 56 questions, about a minute each, with no notes or Splunk Docs. Splunk’s sample questions show the style: which component receives, indexes and stores data from forwarders, which license type allows 500MB a day of indexing but disables alerts and distributed search, and a select-all-that-apply question on the host field for a network input. The configuration questions are where search-only experience runs out. Practice on a real instance, read the 17 sections line by line, and remember that a failed first attempt means a 7-day wait and another $130.
If you administer self-managed Splunk Enterprise, yes. The 17 sections are the job itself: license violations, configuration precedence and btool, bucket types and retention, the deployment server and client groups, and props.conf and transforms.conf. At $130 per attempt with a three-year lifecycle, the cost is mostly study time. It’s a weaker pick if your organization is moving to Splunk Cloud, since Splunk says the Enterprise Admin is best for deployments that won’t migrate, or if you need a DoD 8140 credential, since Splunk makes no 8140 claim for it.
If you’re weighing the certification, planning a path from Power User to Architect, or arranging Splunk training for a team, tell us where you are and we’ll help you map out the right next step.