You can see it againUnder pressure people bring back shapes and positions long after the wording has gone.
Picture superiority · Shepard 1967, Standing 1973
SPLUNKSplunk Core Certified Consultant
The Splunk Core Certified Consultant certification validates expert-level ability to deploy and implement large Splunk installations. It is designed for consultants and architects who size, install, and advise on multi-tier Splunk architectures, clustering, and scalability. Earning it demonstrates you can lead complex deployments and maximize the value of the Splunk platform for your organization.
Exam format86 multiple choice questions
Duration120 minutes
DeliveryPearson VUE
Free questions720
Content last reviewed 30 July 2026 · Up to date
The certification
What Splunk Core Certified Consultant proves, and what it asks of you
What this certification covers, who it is written for, and what the exam itself looks like on the day.
9domains
37objectives
195concepts
$130 USDexam fee
What it is
What this certification is
What it validates, who it is written for, and the experience it assumes.
About this certification
The Splunk Core Certified Consultant certification validates your ability to deploy and implement large Splunk installations with expert-level knowledge of multi-tier architectures, clustering, and scalability. As a consultant, you will be expected to properly size, install, and implement Splunk environments, and advise on how to make the most of the solutions.
This certification is the highest level of Splunk core training and certification available, designed for those who wish to join the uppermost ranks of Splunk expertise. It covers the full deployment methodology, from planning and data collection to managing distributed deployments with indexer and search head clustering. Earning this credential demonstrates that you can lead complex Splunk implementations and drive maximum value from the platform.
Who it’s for
This certification is for Splunk experts, Splunk PS partners, and independent platform consultants who want to deepen their expertise in deploying and implementing large Splunk environments. It is designed for those who wish to join the uppermost ranks of Splunk certification and gain unparalleled knowledge about the Splunk platform. Candidates typically have hands-on experience with Splunk Enterprise and are comfortable with advanced concepts such as clustering, multi-tier architectures, and scalability. The track includes a week-long bootcamp and practical labs to build both technical and soft skills needed to succeed as a Splunk consultant.
Recommended experience
Hands-on experience with Splunk Enterprise, including deployment, administration, and architecture, is strongly recommended. Completion of the Core Consultant Labs and Core Implementation coursework is required before taking the exam. Experience with Splunk Enterprise deployment and administration; Knowledge of multi-tier Splunk architectures, clustering, and scalability; Completion of Core Consultant Labs and Core Implementation coursework; Familiarity with Splunk deployment methodology and best practices
The syllabus
What you’ll learn
Every domain and objective Splunk measures, with the weight they carry on the exam.
The official Splunk exam outline · checked 30 July 2026 · See the source
Deploying Splunk
- Define Splunk Validated Architectures (SVA)
- Articulate how and why Splunk grows from standalone environment to distributed environment with indexer and search head clustering
- Explain the difference between high availability and disaster recovery and how both can be addressed in Splunk
Monitoring Console
- Describe which instances are suitable to configure as the Monitoring Console
- Articulate how to configure the MC for a single or distributed environment
- Examine how the MC uses the server roles and groups
- Describe how MC health checks are performed and can be extended
Access and Roles
- Identify authentication methods
- Describe LDAP concepts and configuration
- List SAML and SSO options
- Define roles and articulate how roles are used to secure data
Data Collection
- Articulate the different ways data can be ingested by an indexer
- Articulate how one Splunk instance communicates with another Splunk instance (S2S)
- Describe the types and configuration of data inputs
- Describe ways to troubleshoot data inputs
Indexing
- List indexing artifacts and locations
- Describe event processing and data pipelines
- Describe the underlying text parsing and indexing process
- List data retention controls
Search
- Describe how to use search job inspection; explain the inner-workings of a search
- List the different search types
- Describe how to maximize search efficiency
- Describe how sub-searches work
Configuration Management
- Describe a deployment app
- Articulate how a deployment server works
- Describe deployment system configuration
- Articulate how to manage deployment server
Indexer Clustering
- Describe deployment and component configuration
- Describe the life cycle of data using buckets
- Determine failure modes and recovery processes
- Articulate how multi-site clustering works
- List migration procedures
Search Head Clustering
- Articulate how to manage and deploy a search head cluster
- Determine when a search head cluster may be needed and when a search head cluster would not be recommended
- Describe content management using the deployer
- Describe the role of the cluster members and the Captain
- Articulate how captain election works (RAFT)
On the day
The exam itself
Everything Splunk publishes about sitting it, and nothing we inferred.
Prerequisites
One of: Splunk Core Certified Power User, Splunk Core Certified Advanced Power User, Splunk Enterprise Certified Admin, or Splunk Enterprise Certified Architect
CertificationSplunk Core Certified Consultant
Exam format86 multiple choice questions
Duration120 minutes
DeliveryPearson VUE
LanguagesEnglish
Pricing$130 USD
After you pass
Where this credential goes next
The path Splunk lays out, how the credential is kept, and where to book.
Step-by-step path to Splunk Core Certified Consultant
PrerequisiteOne of: Splunk Core Certified Power User, Splunk Core Certified Advanced Power User, Splunk Enterprise Certified Admin, or Splunk Enterprise Certified Architect
Credential earnedSplunk Core Certified Consultant Certification Renewal and maintenance
Splunk certifications must be renewed every three years. You can renew by pursuing additional certifications, completing continuing education courses, or re-taking the certification exam. Stay current with the latest technologies and maintain your certification.
Learn more about renewal requirements Lifecycle status
This certification is currently active and available. Splunk maintains this certification to validate current skills and industry relevance.
Exam status: ActiveMaintained by Splunk
Exam registration
Register for the exam through Pearson VUE, Splunk’s authorized testing partner.
Schedule your examVisit the official Splunk certification page for exam policies and requirements.
View the official pageYour coach
And when you are serious, your coach Pip takes over
Your coach in the app reads what you have answered with the book closed and tells you one thing to do tonight. It will not count an answer you gave with the page open, and it will tell you when you are not ready.
See how the coach worksBefore you book
Questions people ask
How does the Splunk Core Certified Consultant exam relate to the Splunk Enterprise Certified Architect certification?
The Splunk Enterprise Certified Architect certification is one of the accepted prerequisite certifications for the Splunk Core Certified Consultant exam. It covers best practices for planning, data collection, and sizing of distributed deployments, which are foundational for the consultant-level expertise.
Do I need to hold a lower-level Splunk certification before taking the Splunk Core Certified Consultant exam?
Yes, you must hold one of the following certifications: Splunk Core Certified Power User, Splunk Core Certified Advanced Power User, Splunk Enterprise Certified Admin, or Splunk Enterprise Certified Architect. These are mandatory prerequisites.
Is there a hands-on lab component in the Splunk Core Certified Consultant exam?
The exam format is 86 multiple choice questions. However, the certification track includes a week-long bootcamp with practical labs to build the technical and soft skills needed to be a Splunk consultant.
What is the retake policy for the Splunk Core Certified Consultant exam?
Splunk's retake policy is not explicitly published on the exam page. Candidates should refer to the Splunk Certification Candidate Handbook for detailed retake policies.
What job roles does the Splunk Core Certified Consultant credential map to?
This credential is designed for Splunk experts, Splunk PS partners, and independent platform consultants who lead large-scale Splunk deployments and advise on architecture and scalability.
Can I recertify by passing a different Splunk exam?
Yes, Splunk certifications can be renewed by pursuing additional certifications, completing continuing education courses, or re-taking the certification exam every three years.
Information freshness · Content last reviewed on 2026-07-30 Up to date
Practice free questions 720 questions, free, no account needed.
The curriculum
The whole exam, mapped and written
Every domain, every objective, and every concept Splunk measures — each one written out.
9domains
37objectives
195concepts
159free pages
The domains, and what sits inside them
Every objective below is a page you can open and practise now, without an account.
The official Splunk exam outline · checked 30 July 2026 · See the source
1Deploying Splunk64 questions
Define Splunk Validated Architectures (SVA)4 concepts · 4 pagesOpen →Articulate how and why Splunk grows from standalone environment to distributed environment with indexer and search head clustering4 concepts · 5 pagesOpen →Explain the difference between high availability and disaster recovery and how both can be addressed in Splunk6 concepts · 5 pagesOpen →
2Monitoring Console57 questions
Describe which instances are suitable to configure as the Monitoring Console1 concepts · 2 pagesOpen →Articulate how to configure the MC for a single or distributed environment6 concepts · 4 pagesOpen →Examine how the MC uses the server roles and groups5 concepts · 5 pagesOpen →Describe how MC health checks are performed and can be extended4 concepts · 2 pagesOpen →
3Access and Roles70 questions
4Data Collection92 questions
Articulate the different ways data can be ingested by an indexer6 concepts · 5 pagesOpen →Articulate how one Splunk instance communicates with another Splunk instance (S2S)6 concepts · 6 pagesOpen →Describe the types and configuration of data inputs2 concepts · 4 pagesOpen →Describe ways to troubleshoot data inputs6 concepts · 5 pagesOpen →
5Indexing89 questions
6Search86 questions
7Configuration Management63 questions
8Indexer Clustering98 questions
Describe deployment and component configuration6 concepts · 4 pagesOpen →Describe the life cycle of data using buckets6 concepts · 5 pagesOpen →Determine failure modes and recovery processes7 concepts · 5 pagesOpen →Articulate how multi-site clustering works7 concepts · 5 pagesOpen →List migration procedures4 concepts · 3 pagesOpen →
9Search Head Clustering101 questions
Articulate how to manage and deploy a search head cluster5 concepts · 5 pagesOpen →Determine when a search head cluster may be needed and when a search head cluster would not be recommended2 concepts · 2 pagesOpen →Describe content management using the deployer6 concepts · 4 pagesOpen →Describe the role of the cluster members and the Captain4 concepts · 5 pagesOpen →Articulate how captain election works (RAFT)7 concepts · 6 pagesOpen →
Not a table of contents
Every line on this map already opens
In front of every objective the practice pages are already there, free and without an account. This is one objective, opened.
Define Splunk Validated Architectures (SVA)4 pagesOpen →
Free in front of it
17 questions on this objective, five to a page. Every range above is a real page, open now, with no account.
Reading the map is not the same as knowing the ground
The curriculum tells you what is on the exam. Proving you know it is a different job — and it is the one the closed-book run does.
Free questions
720 questions. No account, no card.
The whole bank is open. 5 questions to a page, every answer explained, and a discussion thread on each one.
720questions
159pages
37objectives
Freealways
Browse by domain
Every objective, and every page range, is a link — so you can pick up exactly where you left off.
1Deploying Splunk64 questions
2Monitoring Console57 questions
3Access and Roles70 questions
4Data Collection92 questions
5Indexing89 questions
6Search86 questions
7Configuration Management63 questions
8Indexer Clustering98 questions
9Search Head Clustering101 questions
What a practice page gives you
1Five to a page
Short enough to finish, long enough to matter.
2Every answer explained
Not only which one is right — why the others are wrong.
3A discussion on each
Ask, answer, and vote. Every question has its own thread.
A question, and the idea behind it
Every question comes from a concept
These are not trivia. Each one is written against a concept in the book, so when you get one wrong there is somewhere to go and find out why.
The visual book
See it once. Carry it into the exam.
The pages shown here come from our AI-900 book — an example of how each concept is written in plain language and, where the idea needs one, drawn as a full page you can take in at a glance.
195concepts
720free questions
Why a picture, and not another paragraph
Three reasons, and each one is a real finding rather than a slogan.
You can see it againThe whole idea at onceWhere it starts, what happens in the middle, what comes out, and the mistake to avoid.
Multimedia principle · MayerThe look-alikes sit togetherThe pairs the exam tests are drawn side by side, so the difference is seen, not told.
Dual coding · PaivioWhat one page is made of
You are never asked to read a poster here — only to see how one is built. After that, every other page is legible at a glance.
1A numbered strip on top
The idea as a sequence, followed with a finger before a word is read.
2Panels for the parts
What it is, how the machine learns it, when it is the right tool.
3The trap, framed
The distinction the exam tests, given its own box instead of buried in prose.
4One line at the bottom
The sentence to carry into the exam room.
Open book, on purpose
Answer it with the picture beside you
This is the part that teaches. The illustration and the written explanation stay where they are while you work, so a scenario stops being a memory test and becomes something you can simply look at.
It teaches · it does not count
A smartphone uses AI to unlock when the owner looks at the camera. Which AI capability is being used?
AImage classification
BFacial recognition
COptical character recognition
DObject detection
Look at the five steps. Detect finds a face, align straightens it, encode turns it into numbers, search compares it with a stored face, and decide answers one question: is this the same person? Classification would only say “a face”. Detection would only draw a box. Neither decides whose.
Then the page shuts, and it starts counting
The same questions come back with the book closed — that run is the one that counts. After it, your coach picks one thing for tonight, sized to the time you have, and brings pages back before you lose them.
Testing effect · Roediger & Karpicke 2006 · spacing effect · Cepeda et al. 2006
Official resources
Straight from Splunk
Where the exam is defined, scheduled and scored.
3official links
195concepts mapped
The source
Splunk’s own pages
We link to them rather than repeat them, so nothing here goes stale behind them.
Checked against the source
Every objective on the official Splunk outline already has questions here
We build from the official skills outline, not from a summary of it — 37 objectives, 195 concepts written under them, and free questions against every one. When Splunk changes the outline, this page changes with it.
37objectives on the outline→195concepts written→720free questions
An official page tells you what will be asked. It cannot tell you what you will get right.
That is the only question worth answering the night before, and no link answers it. You answer it by taking the questions with the book closed, and seeing what comes back.