Splunk Core Certified User — Information & Free Practice
US · Examination information
200 free questions · Answer explanations · No signup required
Splunk Core Certified User
- Provider
- Pearson VUE
- Format
- English multiple-choice, proctored, closed-book knowledge examination; test center or online proctoring.
- Exam questions
- Total questions: 60.
- Time limit
- 60 minutes total, including 3 minutes to review the exam agreement.
- Exam fee
- USD 130 per attempt
Examination outline
Splunk Basics (5%)
- Splunk components
- Understand the uses of Splunk
- Define Splunk apps
- Customizing user settings
- Basic navigation in Splunk
Basic Searching (22%)
- Run basic searches
- Set the time range of a search
- Identify the contents of search results
- Refine searches
- Use the timeline
- Work with events
- Control a search job
- Save search results
Using Fields in Searches (20%)
- Understand fields
- Use fields in searches
- Use the fields sidebar
Search Language Fundamentals (15%)
- Review basic search commands and general search practices
- Examine the search pipeline
- Specify indexes in searches
- Use the following commands to perform searches: tables, rename, fields, dedup, and sort
Using Basic Transforming Commands (15%)
- The top command
- The rare command
- The stats command
Creating Reports and Dashboards (12%)
- Save a search as a report
- Edit reports
- Create reports that display statistics (tables)
- Create reports that display visualizations (charts)
- Create a dashboard
- Add a report to a dashboard
- Edit a dashboard
Creating and Using Lookups (6%)
- Describe lookups
- Examine a lookup file example
- Create a lookup file and create a lookup definition
- Configure an automatic lookup
- Use the lookup in searches
Creating Scheduled Reports and Alerts (5%)
- Describe scheduled reports
- Configure scheduled reports
- Describe alerts
- Create alerts
- View fired alerts
Examination sources
- Splunk Core Certified User current track page
Preparation, test blueprint link
- Splunk Core Certified User test blueprint
PDF page 1, Exam Content scope statement and sections 1.0-2.8
- Splunk Core Certified User test blueprint
PDF page 2, section 4.0 topic 4.4; all section headers 3.0-7.0 visually checked
- Splunk Core Certified User test blueprint
PDF page 3, continuation 7.5, section 8.0-8.5 and Exam Preparation
- Splunk Core Certified User current track page
Exam Details, format
- Splunk Certification Candidate Handbook
PDF page 7, printed page 6, Taking the Exam, answer submission
- Splunk Certification Candidate Handbook
PDF page 8, printed page 7, Exam Results/Score Reporting
- Splunk Core Certified User current track page
Exam Details, level through delivery
- Upcoming Splunk Certification Changes FAQ
PDF page 1, registration transition
- Upcoming Splunk Certification Changes FAQ
PDF page 2, final question, existing appointments and future registration
- Splunk Certification Candidate Handbook
PDF page 5, printed page 4, Certification Candidate Requirements
- Splunk Certification Candidate Handbook
PDF page 7, printed page 6, Taking the Exam and online proctor footnote
Related license preparation
This examination may be required or accepted as an alternative, depending on the license and application pathway.