You can see it againUnder pressure people bring back shapes and positions long after the wording has gone.
Picture superiority · Shepard 1967, Standing 1973
SPLUNKSplunk Core Certified User
The Splunk Core Certified User certification validates your ability to search, use fields and lookups, and create alerts, basic statistical reports, and dashboards in Splunk Enterprise and Splunk Cloud. Designed for those with little to no Splunk experience, it is the entry point to the Splunk certification program and demonstrates you can turn data into action.
Exam format60 multiple choice questions
Duration60 minutes
DeliveryPearson VUE
Free questions743
Content last reviewed 30 July 2026 · Up to date
The certification
What SPLK-1001 proves, and what it asks of you
What this certification covers, who it is written for, and what the exam itself looks like on the day.
8domains
40objectives
211concepts
$130 USDexam fee
What it is
What this certification is
What it validates, who it is written for, and the experience it assumes.
About this certification
The Splunk Core Certified User certification is the entry-level credential in the Splunk certification program. It validates that you have a strong understanding of Splunk Enterprise and Splunk Cloud fundamentals, including performing searches, using fields and lookups, and creating alerts, basic statistical reports, and dashboards.
This certification is ideal for career changers, new Splunk customers, and data analysts who want to demonstrate foundational proficiency with the Splunk platform. By earning it, you show that you can navigate Splunk software and use it to turn raw data into actionable insights, setting the stage for more advanced certifications like Splunk Core Certified Power User.
Who it’s for
This certification is for individuals who are new to Splunk or have limited experience with the platform. It is an optional entry point to the Splunk certification program, designed for career changers, new customers, and data analysts who want to build a foundation in Splunk Enterprise and Splunk Cloud. You are someone who wants to demonstrate basic proficiency in searching, using fields and lookups, and creating alerts and reports. No prior Splunk experience is required, making it an accessible starting point for anyone looking to validate their skills and grow in the Splunk ecosystem.
Recommended experience
No prior Splunk experience is required, but familiarity with basic data concepts and using software applications is helpful. Basic computer literacy and comfort navigating software applications; Understanding of fundamental data concepts such as fields and events; Interest in learning how to search and analyze data with Splunk
The syllabus
What you’ll learn
Every domain and objective Splunk measures, with the weight they carry on the exam.
The official Splunk exam outline · checked 30 July 2026 · See the source
Splunk Basics
- Splunk components
- Understand the uses of Splunk
- Define Splunk apps
- Customizing user settings
- Basic navigation in Splunk
Basic Searching
- Run basic searches
- Set the time range of a search
- Identify the contents of search results
- Refine searches
- Use the timeline
- Work with events
- Control a search job
- Save search results
Using Fields in Searches
- Understand fields
- Use fields in searches
- Use the fields sidebar
Search Language Fundamentals
- Review basic search commands and general search practices
- Examine the search pipeline
- Specify indexes in searches
- Use the following commands to perform searches: tables, rename, fields, dedup, and sort
Using Basic Transforming Commands
- The top command
- The rare command
- The stats command
Creating Reports and Dashboards
- Save a search as a report
- Edit reports
- Create reports that display statistics (tables)
- Create reports that display visualizations (charts)
- Create a dashboard
- Add a report to a dashboard
- Edit a dashboard
Creating and Using Lookups
- Describe lookups
- Examine a lookup file example
- Create a lookup file and create a lookup definition
- Configure an automatic lookup
- Use the lookup in searches
Creating Scheduled Reports and Alerts
- Describe scheduled reports
- Configure scheduled reports
- Describe alerts
- Create alerts
- View fired alerts
On the day
The exam itself
Everything Splunk publishes about sitting it, and nothing we inferred.
Prerequisites
No mandatory prerequisites — this certification has no required predecessor exam or credential.
Exam codeSPLK-1001
CertificationSplunk Core Certified User
Exam format60 multiple choice questions
Duration60 minutes
DeliveryPearson VUE
Pricing$130 USD
After you pass
Where this credential goes next
The path Splunk lays out, how the credential is kept, and where to book.
Step-by-step path to Splunk Core Certified User
Credential earnedSplunk Core Certified User Certification Renewal and maintenance
Splunk certifications must be renewed every three years. You can renew by pursuing additional certifications, completing continuing education courses, or retaking the certification exam. Stay current with the latest technologies and maintain your certification.
Learn more about renewal requirements Lifecycle status
This certification is currently active and available. Splunk maintains this certification to validate current skills and industry relevance.
Exam status: ActiveMaintained by Splunk
Exam registration
Register for the exam through Pearson VUE, Splunk’s authorized testing partner.
Schedule your examVisit the official Splunk certification page for exam policies and requirements.
View the official pageYour coach
And when you are serious, your coach Pip takes over
Your coach in the app reads what you have answered with the book closed and tells you one thing to do tonight. It will not count an answer you gave with the page open, and it will tell you when you are not ready.
See how the coach worksBefore you book
Questions people ask
Is the Splunk Core Certified User certification a prerequisite for higher-level Splunk certifications?
No. It is an optional entry point to the Splunk certification program. You can pursue higher-level certifications like Splunk Core Certified Power User without first earning this credential.
How does the Splunk Core Certified User exam relate to the Splunk Core Certified Power User exam?
The Core Certified User exam covers foundational skills like searching, using fields and lookups, and creating alerts and reports. The Power User exam builds on this with SPL commands, knowledge objects, and data normalization, and is a natural next step after earning the User certification.
What is the retake policy for the SPLK-1001 exam?
Splunk's retake policy is detailed in the Splunk Certification Candidate Handbook. Generally, you must wait a specified period between attempts, and there may be limits on the number of attempts per year. Check the handbook for the most current policy.
Are there any hands-on or lab components in the SPLK-1001 exam?
No. The exam consists of 60 multiple choice questions only. There is no hands-on or lab section.
What job roles does the Splunk Core Certified User credential map to?
This credential is designed for career changers, new Splunk customers, and data analysts who want to demonstrate foundational proficiency with Splunk Enterprise and Splunk Cloud. It is a starting point for roles that involve searching and analyzing data.
Can I recertify by passing a different Splunk exam?
Yes. Splunk's recertification policy allows you to renew your certification by earning a higher-level certification, completing continuing education courses, or retaking the certification exam. Passing a higher-level exam may renew your current certification.
Information freshness · Content last reviewed on 2026-07-30 Up to date
Practice free questions 743 questions, free, no account needed.
The curriculum
The whole exam, mapped and written
Every domain, every objective, and every concept Splunk measures — each one written out.
8domains
40objectives
211concepts
164free pages
The domains, and what sits inside them
Every objective below is a page you can open and practise now, without an account.
The official Splunk exam outline · checked 30 July 2026 · See the source
1Splunk Basics123 questions
2Basic Searching161 questions
Run basic searches5 concepts · 4 pagesOpen →Set the time range of a search7 concepts · 5 pagesOpen →Identify the contents of search results8 concepts · 4 pagesOpen →Refine searches5 concepts · 3 pagesOpen →Use the timeline5 concepts · 5 pagesOpen →Work with events5 concepts · 5 pagesOpen →Control a search job7 concepts · 6 pagesOpen →Save search results5 concepts · 5 pagesOpen →
3Using Fields in Searches54 questions
4Search Language Fundamentals40 questions
Review basic search commands and general search practices2 concepts · 2 pagesOpen →Examine the search pipeline4 concepts · 3 pagesOpen →Specify indexes in searches5 concepts · 2 pagesOpen →Use the following commands to perform searches: tables, rename, fields, dedup, and sort5 concepts · 2 pagesOpen →
5Using Basic Transforming Commands47 questions
6Creating Reports and Dashboards147 questions
Save a search as a report5 concepts · 4 pagesOpen →Edit reports7 concepts · 5 pagesOpen →Create reports that display statistics (tables)5 concepts · 3 pagesOpen →Create reports that display visualizations (charts)6 concepts · 5 pagesOpen →Create a dashboard5 concepts · 5 pagesOpen →Add a report to a dashboard5 concepts · 5 pagesOpen →Edit a dashboard6 concepts · 5 pagesOpen →
7Creating and Using Lookups77 questions
Not a table of contents
Every line on this map already opens
In front of every objective the practice pages are already there, free and without an account. This is one objective, opened.
Splunk components6 pagesOpen →
Free in front of it
26 questions on this objective, five to a page. Every range above is a real page, open now, with no account.
Reading the map is not the same as knowing the ground
The curriculum tells you what is on the exam. Proving you know it is a different job — and it is the one the closed-book run does.
Free questions
743 questions. No account, no card.
The whole bank is open. 5 questions to a page, every answer explained, and a discussion thread on each one.
743questions
164pages
40objectives
Freealways
Browse by domain
Every objective, and every page range, is a link — so you can pick up exactly where you left off.
1Splunk Basics123 questions
2Basic Searching161 questions
3Using Fields in Searches54 questions
4Search Language Fundamentals40 questions
5Using Basic Transforming Commands47 questions
6Creating Reports and Dashboards147 questions
7Creating and Using Lookups77 questions
8Creating Scheduled Reports and Alerts94 questions
What a practice page gives you
1Five to a page
Short enough to finish, long enough to matter.
2Every answer explained
Not only which one is right — why the others are wrong.
3A discussion on each
Ask, answer, and vote. Every question has its own thread.
A question, and the idea behind it
Every question comes from a concept
These are not trivia. Each one is written against a concept in the book, so when you get one wrong there is somewhere to go and find out why.
The visual book
See it once. Carry it into the exam.
The pages shown here come from our AI-900 book — an example of how each concept is written in plain language and, where the idea needs one, drawn as a full page you can take in at a glance.
211concepts
743free questions
Why a picture, and not another paragraph
Three reasons, and each one is a real finding rather than a slogan.
You can see it againThe whole idea at onceWhere it starts, what happens in the middle, what comes out, and the mistake to avoid.
Multimedia principle · MayerThe look-alikes sit togetherThe pairs the exam tests are drawn side by side, so the difference is seen, not told.
Dual coding · PaivioWhat one page is made of
You are never asked to read a poster here — only to see how one is built. After that, every other page is legible at a glance.
1A numbered strip on top
The idea as a sequence, followed with a finger before a word is read.
2Panels for the parts
What it is, how the machine learns it, when it is the right tool.
3The trap, framed
The distinction the exam tests, given its own box instead of buried in prose.
4One line at the bottom
The sentence to carry into the exam room.
Open book, on purpose
Answer it with the picture beside you
This is the part that teaches. The illustration and the written explanation stay where they are while you work, so a scenario stops being a memory test and becomes something you can simply look at.
It teaches · it does not count
A smartphone uses AI to unlock when the owner looks at the camera. Which AI capability is being used?
AImage classification
BFacial recognition
COptical character recognition
DObject detection
Look at the five steps. Detect finds a face, align straightens it, encode turns it into numbers, search compares it with a stored face, and decide answers one question: is this the same person? Classification would only say “a face”. Detection would only draw a box. Neither decides whose.
Then the page shuts, and it starts counting
The same questions come back with the book closed — that run is the one that counts. After it, your coach picks one thing for tonight, sized to the time you have, and brings pages back before you lose them.
Testing effect · Roediger & Karpicke 2006 · spacing effect · Cepeda et al. 2006
Official resources
Straight from Splunk
Where the exam is defined, scheduled and scored.
3official links
211concepts mapped
The source
Splunk’s own pages
We link to them rather than repeat them, so nothing here goes stale behind them.
Checked against the source
Every objective on the official Splunk outline already has questions here
We build from the official skills outline, not from a summary of it — 40 objectives, 211 concepts written under them, and free questions against every one. When Splunk changes the outline, this page changes with it.
40objectives on the outline→211concepts written→743free questions
An official page tells you what will be asked. It cannot tell you what you will get right.
That is the only question worth answering the night before, and no link answers it. You answer it by taking the questions with the book closed, and seeing what comes back.