The existing (soon-to-be "legacy") User, Power User, and Admin certification exams consist of a set number of multiple choice, true/false, multiple select, and fill-in-the-blank questions. The exams are online and must be completed within one hour. The exams cannot be paused.


Upon exam completion, candidates can opt to receive a score report via email that includes a subject-by-subject performance breakdown.  This is the most specific information that can be provided, as anything further would essentially be publishing an answer key.


Remember - these exams will only be available through August 31, 2018 and registration closes August 15, 2018.


For more information regarding the upcoming changes to our program, please visit our relaunch page.


Registration for the new exams, hosted by our testing partner Pearson VUE, will be available starting September 4. Please check back for more details in September.

Generally speaking, $125 (per certification).


To clarify, for candidates who hold V6.x certifications and wish to maintain their highest level certification, the only cost is the new exam fee: $125.


Candidates who hold V6.x certifications that wish to "level up" (for example: Power User to Admin) will need to complete (pay for) the prerequisite coursework, followed by the exam.  Even in this case, the NET cost is $125, as the courses have always had a registration fee.


The exception to the rule are candidates with out of date certifications (like Splunk Certified Knowledge Managers who never earned their Power User certification). These individuals have received targeted communications outlining their path to recertification and can find more information on our recertification page (linked below).


For all candidates looking for more information on recertification including downloadable sample scenarios, clearly outlined paths for existing cert-holders, and additional downloadable reference materials, please visit our recertification page.

As part of the program relaunch, we're also updating the way we version our certifications. Our goal is to minimize confusion and simplify the recertification process in the years to come.  We're still ironing out the details, but stay tuned for more information when we launch in October.

As of September 2018, the Architect Certification Lab is becoming the "Splunk Deployment Practical Lab" and will be a prerequisite of the Splunk Enterprise Certified Architect path. The format will remain the same. All candidates who have passed the lab (under either name) by the program relaunch will be eligible for the Splunk Enterprise Certified Architect multiple choice exam.


To clarify, this means that the time and money candidates have spent on the Architect Certification Lab was a worthwhile investment, as this lab is still required in the new certification path - just under a different name.


As noted on our recertification page, the path to Splunk Enterprise Certified Architect will also include the Cluster Administration and Troubleshooting Splunk Enterprise courses.  All candidates who have passed the lab (under either name) by the program relaunch will not be required to complete these courses in order to attempt the exam; however, the exam will cover content from these courses, so we do recommend them.


The new Splunk Enterprise Architect Certification Exam will be multiple choice and closed-book.

As of October 1, 2019, your (V6.x and older) certification(s) will be considered out-of-date.


You will not be granted a digital badge. Digital badges will only be granted to cert-holders under the new program.


This means that, moving forward, if a third party (potential employer, etc.) contacts us to verify your certifications, we would be able to verify that you hold an outdated certification.


Please note -  Splunk will never provide information regarding your certifications to a third party without your written consent. 

Exam Agreement

This Exam Agreement is made and entered into as of the date you click “I Agree” [when starting the exam] and is between you and Splunk Inc. (“Splunk”). The exam is made available to you only for the purpose of demonstrating your competency in the subject matter of the exam for which you seek certification.

This exam, including questions, answers, and graphics within the exam, is Splunk confidential information and is protected by intellectual property laws. All intellectual property rights are expressly reserved to Splunk.

By taking this exam, you agree that:

  1. It is you and only you taking this exam and that you are not accepting improper assistance.
  2. You will not disseminate the actual exam content or answers.
  3. You will not copy, reproduce, publish, disclose, transmit, sell, offer to sell, post, upload, download, display, distribute in any way, or otherwise transfer, modify, make derivative works of, reverse engineer, decompile, disassemble or translate the exam in whole or in part, in any form or by any means, verbal or written, electronic or mechanical, for any purpose.
  4. You will not use the exam content or answers in any manner that violates applicable law.
  5. You have not sought or obtained (i) unauthorized access to the exam content, (ii) access to exam answers, or (iii) others’ responses to exam questions, to prepare for this exam.

Any violation of this agreement may result in a revocation of your certification and ability to seek future Splunk certifications.

Last updated 05/2017

Splunk Online Exam Retake Policy


Candidates who do not pass the exam on their first attempt must wait at least five days before retaking the exam. The second attempt will be automatically available 120 hours after the first via the original exam link.

Candidates must wait 30 days after their second attempt to take the exam a third time. The link to retake the exam will only be available after the 30 days have passed.

Candidates must wait 60 days after their third attempt to take the exam a fourth time. The link to retake the exam will only be available after the 60 days have passed.

After four failed attempts, candidates must submit a waiver form to be considered for a fifth attempt. These will be granted at Splunk’s full discretion on a case-by-case basis.

The exam cannot be taken more than five times within a 12-month period, which begins the day of the fifth unsuccessful retake.

Upon passing an exam, no further exam access will be granted.

If you believe you have noted an error on an exam or believe that a specific question you saw on a Splunk Certification exam is invalid, you may ​submit the Certification Exam Challenge Form found here.