Looking for a downloadable resource for all things Splunk Certification? Look no further.
- Free Courses
-
Learning Paths
- Courses for Users
- Courses for Splunk Administrators
- Courses for Splunk Cloud Customers
-
Courses for Splunk Architects
- Overview
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Creating Dashboards with Splunk
- Splunk Fundamentals 3
- Advanced Searching and Reporting
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Architecting Splunk Enterprise Deployments
- Administering Splunk Enterprise Security
- Courses for App Developers
-
Courses for Enterprise Security Administrators
- Overview
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Creating Dashboards with Splunk
- Splunk Fundamentals 3
- Advanced Searching and Reporting
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Architecting Splunk Enterprise Deployments
- Administering Splunk Enterprise Security
- Courses for Enterprise Security End-Users
- Courses for IT Service Intelligence Administrators
- Courses for IT Service Intelligence End-Users
- Courses for Phantom Customers
-
Certification Tracks
- Splunk Core Certified User
- Splunk Core Certified Power User
- Splunk Enterprise Certified Admin
- Splunk Enterprise Certified Architect
- Splunk Certified Developer
- Splunk Enterprise Security Certified Admin
- Splunk IT Service Intelligence Certified Admin
-
Splunk Core Certified Consultant
- Overview
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Architecting Splunk Enterprise Deployments
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Splunk Enterprise Practical Lab
- Splunk Fundamentals 3
- Creating Dashboards with Splunk
- Advanced Searching and Reporting
-
Courses
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Splunk Fundamentals 3
- Advanced Searching and Reporting
- Creating Dashboards with Splunk
- Advanced Dashboards and Visualizations
- Building Splunk Apps
- Splunk for Analytics and Data Science
- Splunk Infrastructure Overview
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Splunk Cloud Administration
- Architecting Splunk Enterprise Deployments
- Splunk Enterprise Practical Lab
- Developing with Splunk's REST API
- Administering Splunk Enterprise Security
- Using Splunk Enterprise Security
- Implementing Splunk IT Service Intelligence
- Using Splunk IT Service Intelligence
- Splunk User Behavior Analytics
- Administering Phantom
- Developing Phantom Playbooks
- Working with Metrics in Splunk
- Implementing Splunk SmartStore
- Splunk Workload Management
-
Videos
- All Videos
- Splunk Cloud Tutorial
- Installing Splunk Enterprise on Linux
- Installing Splunk Enterprise on Windows
- Getting Data In to Splunk Enterprise (Linux)
- Getting Data In (Windows)
- Getting Data In with Forwarders
- Basic Search in Splunk Enterprise
- Create a Dashboard in Splunk Enterprise
- Splunk Certification Candidate Journey
- Creating Alerts in Splunk Enterprise
-
- Certification Exams
- Program Guide + FAQ
- Download Fact Sheet
You Ask, We Answer
We've compiled our frequently asked questions regarding Training, Certification, and Recertification. Please see below for more information.
Training FAQ
With course offerings ranging from novice to expert and instructors teaching online (and live!) classes all over the world, Splunk Education is here for you, wherever you are. For course completion certificates, please fill out this form. Please review the questions below prior to contacting Education_AMER@splunk.com for one-on-one assistance.
It all starts with Splunk.com/Education.
You'll notice that our curriculum is organized under different Learning Paths (courses only) and Certification Tracks (courses + exams) based on different Splunk roles or personas. Use the sidebar navigation to select the path or track that best corresponds to the Splunk role in which you are interested.
Many of the foundational classes repeat across different pathways. You do not need to repeat classes – once you complete a course, you have met that prerequisite for all the paths to which it applies.
Found the perfect course? Simply click View Topics & Register to view the course description (which you can download), then click View Schedule.
Splunk Education accepts two forms of payment: credit card payment or existing Education credits. If you need to identify your existing credits, please contact your Splunk account manager. If you do not know your account manager, please contact us directly at Education_AMER@splunk.com.
Complete the check-out steps. You will then receive a confirmation email with instructions to access the course. That's it! You're now registered.
Please note: our introductory courses are offered via self-paced eLearning/Instructor-on-demand (IOD) and instructor-led (Virtual) delivery. For these courses, select whichever format you prefer. Note that Virtual courses are offered across different time zones. Pick the best time zone offering for you, click Add to Cart, and proceed to checkout.
As a reminder, there are mandatory prerequisites courses for advanced training. These prerequisites are critical for your success in learning Splunk – the shortcuts and tricks we show you in earlier courses are necessary to understand our advanced concepts. Without these shortcuts, you will not get full value from the advanced training.
First and foremost, look for the confirmation email sent to the email address you used to create your Education account.
When you're ready:
1. Log in to Splunk.com/Education.
2. Scroll down and click View My Training Profile (Hint: it's at the bottom of the sidebar).
3. Log in with the username you used to create your account. You may need to create a new account. Forgot your password? Reset it here. Any other login-related issues are best directed to Splunk Support.
Reminder: Virtual (instructor-led) courses may have extensive connectivity requirements – see your confirmation email for full details. We strongly recommend verifying compatibility prior to the start date of your course.
You can launch an eLearning / IOD course from the confirmation email or directly from your Splunk Education account.
1. Start by logging in to Splunk.com/Education.
2. Click View My Training Profile (Hint: at the bottom of the left sidebar).
Courses you have registered for will be displayed at the bottom of the page. If you are having problems finding your courses, click the “My Learning” link, and use the “Filter Results” drop-down to filter courses by status.
3. Once you have found the course, click the “Resume Course/Pathway” button to launch it.
REMEMBER: eLearning / IOD classes have a 30-day time limit. This clock starts as soon as you start the course.
Before launching a course, we suggest you use the test link at https://splk.it/2TKvg6K to verify that it will work with your system / network.
You must let Splunk Education know at least 5 business days before the scheduled start time of your class in order to avoid any penalties for late cancellation.
We close registration for many of our courses before the start date, so a late cancellation means we will not be able to fill that seat. This means that any cancellation (or no-show) within the 5-day window will not be reimbursed (via credits or other form of payment).
To reschedule or cancel a registration, simply contact Education_AMER@splunk.com with your request.
Splunk Certification is excited to be working with industry leader Pearson VUE on exam delivery and Acclaim on digital badging.
Please review the FAQ below for all the details. Many of these questions are also covered in our Splunk Certification Candidate Handbook.
Ready to take your exam? Check out our Exam Registration Tutorial for step-by-step instructions.
Looking for an overview of the process? Our candidate journey video is the perfect place to start (popcorn not included).
- For all candidates attempting their first exam under the new program, please start by filling out this form to connect your Splunk account to your new Pearson VUE account. Candidates must use Latin characters for all form fields. Candidates with foreign scripts on their photo ID will be granted exam access based on standard transliteration guidelines. Please note: this form only needs to be submitted once for account creation.
- Once your accounts are connected (which may take up to 3 business days), you will receive your exam authorizations via email. If you have not received any communication from Pearson VUE after 3 business days, please send an email to certification@splunk.com for assistance.
- These authorization emails will contain your "Splunk ID" (hint: not your Splunk.com username), which you'll use to create an account with Pearson VUE. Your Splunk ID will look like PV-12345678.
- You can register for the exam at a Pearson VUE testing facility near you, or in your home or office via online proctor. We strongly encourage all candidates considering the online proctored option to read this overview prior to scheduling their exam appointment.
- For any questions regarding exam delivery, please contact Pearson VUE directly.
Please note: exam registration costs $125 USD (or five registrations for $500 USD). This cost applies to each exam attempt.
First and foremost, we recommend working with your supervisor, HR department, and/or other internal training departments to see if there are already policies in place where you work.
Generally speaking, there are three ways to purchase a Pearson VUE registration voucher:
1) Directly from PearsonVUE. This is the most streamlined approach. Follow the steps for account creation and exam registration provided at www.pearsonvue.com/splunk. Payment will be collected at the time of registration. You can also visit the Pearson VUE voucher store for direct purchase. This is a great option for individuals looking to buy bulk registrations (5 vouchers for $500) or for candidates who need to submit expense reports for reimbursement within a specific time frame, but are not ready to schedule an exam appointment.
2) Convert existing EDU credits to registration vouchers. If you (or your company) hold existing EDU credits and you’d like to use these for exam registration, please email certification@splunk.com for assistance. Our team can convert EDU credit ($500 each) into voucher codes in groups of five (1 credit = 5 vouchers).
3) From Splunk (as an account). Your Splunk Sales Rep can add certification exams to any deal. Once the number of vouchers has been requested, Splunk will email your unique registration codes, which can be used for registration at www.pearsonvue.com/splunk.
The certification exams include standard multiple choice and multiselect ("select all that apply") questions.
We've put together a handy study guide (including links to the test blueprints and a few sample questions!) to help you prepare for the exam(s).
Remember, your best study materials are the downloadable PDFs you received when you completed the prerequisite courses through Splunk Education.
Great question! We have put together a comprehensive FAQ resource for this all-new certification track, its requirements, and next-steps for in-flight candidates.
For a comprehensive program guide, please refer to our Splunk Certification Candidate Handbook.
If you're looking for a specific policy, please refer to the links below:
- Splunk Certification Agreement
- Testing Accommodations Policy
A beta exam is a soft-launch of an all-new certification exam. All eligible candidates can register for beta exams for free (the registration fee is waived during the beta phase) for a single attempt only.
Beta exams are typically longer than our standard certification exams (ranging from 90-120 minutes total seat time) and candidates do not receive results upon exam completion.
The length of the beta phase is typically 3+ months (meaning candidates will not receive results for this amount of time), but is predicated on a sufficient number of beta participants (meaning it can be extended, if needed).
Performance data from beta candidates is analyzed by a third-party psychometrician to determine the passing score and, ultimately, the content of the final form of the exam. Once this analysis is complete, Splunk Certification distributes results to the beta candidates and publishes the final form of the certification exam.
For more information on our rigorous exam development process, please see here.
Please contact certification@splunk.com so we can manually update your Pearson VUE account information.
First things first: congratulations!
The general timeline after passing the new certification exams is as follows:
- Within 24 hours you will see your new certification in your Splunk account (via your Customer Support Portal or your Partner Portal). For instructions to access this unofficial copy of your certification, please click here.
- Within 24 hours you will receive the next-level Authorization to Test from Pearson VUE. You can also log in to your Pearson VUE account to see your eligible exams in your account profile. If this is not the case and you've already completed the prerequisite coursework, please send an email to certification@splunk.com for assistance.
- Last, but certainly not least, you can expect to receive communication regarding your digital badge within 5-7 days. Please note: the email will come from admin@youracclaim.com and may be routed to your spam or quarantined mail folder. We recommend whitelisting this email address in advance to ensure you receive all digital badging communication.
Yes. The Pearson VUE platform requires that candidates have a unique account for each certification program in which they'd like to participate.
No! You can manage and share all of the badges that are issued to you through Acclaim within one Acclaim account.
First and foremost, please double-check your spam and quarantined email folders for emails from admin@youracclaim.com.
As a best practice, we recommend whitelisting this email address ahead of time (or working with your IT department to make this happen).
If you still cannot locate your email from Acclaim, you can simply create an account on Acclaim, using the email address to which your badge was issued.
To create an account and claim your badge, follow the steps below:
1) Go to www.youracclaim.com.
2) Select "Create an Account"
3) Fill in the required fields, then read and agree to the Terms of Use
4) Click "Create My Account"
Acclaim will send you a confirmation email (from admin@youracclaim.com). You must click the link in that email to confirm your account. Once you've created and confirmed your account, any badges issued to that email address will be available for you to accept and share.
For general questions about Acclaim, including account troubleshooting and general information on sharing your digital badge(s), please visit http://support.youracclaim.com.
A digital badge is a representation of a credential or accomplishment that can be shared across the web. Digital badges contain metadata that allows a third party to verify your accomplishments including the criteria required to earn the badge and the period for which a badge is valid.
In short: Splunk digital badges are your proof of certification.
Representing your credential(s) with a digital badge gives you the ability to broadcast your skills and tell your professional story online. It also allows you to securely represent your certification across a growing number of social media outlets and forums.
Employers, potential employers, and anyone else with whom you wish to share your certification have single-click access to validated credential information without ever contacting Splunk Certification for assistance.
Yes. For specific questions or 1:1 guidance regarding your particular path to certification, please contact us directly at certification@splunk.com.
Whether you have a legacy certification or a shiny new digital badge, the paths below give you clear guidance into your next steps so you get (and stay!) current with Splunk Certification.
Please double check your certification records before asking for help. Click here for instructions to access your certifications (scroll down for Splunk Partners).
Great question (and congratulations!). Our goal is to minimize confusion and make recertification as simple and straightforward as possible. For this reason, our certification exams are not tied to product versions.
The following life-cycles will apply to recertifications moving forward, beginning with the date the digital badge was received:
Splunk Core Certified User - 2 years
Splunk Core Certified Power User - 2 years
Splunk Enterprise Certified Admin - 2 years
Splunk Enterprise Certified Architect - 3 years
Splunk Certified Developer - 3 years
Splunk Enterprise Security Certified Admin - 3 years
Splunk IT Service Intelligence Certified Admin - 3 years
Splunk Core Certified Consultant - 3 years
Welcome to Splunk Certification! We're so excited about the launch of the Splunk Core Certified Consultant track. We understand you may have some questions about your next steps and we've made it as streamlined as possible.
Candidates who only completed the Implementation Fundamentals accreditation path should refer to our Implementation Fundamentals Fast-track Flowchart for their next steps.
Candidates who completed the Core Implementation accreditation path have until October 1, 2020 to pass the Splunk Core Certified Consultant exam. That's it! All downstream certifications (Enterprise Architect through Core User) will be granted to these successful candidates during this window.
For more details on the PS track history, please see here.
For a full FAQ detailing the path, the requirements, and professional services delivery eligibility, please see our Splunk Core Certified Consultant FAQ.
As of October 1, 2019 the recertification window is closed.
Legacy cert-holders (V6.x and older) will not be required to repeat previously completed coursework, but the exams must be completed in the following order:
- Splunk Core Certified User
- Splunk Core Certified Power User
- Splunk Enterprise Certified Admin
- Splunk Enterprise Certified Architect
No exceptions or extensions will be granted to the recertification policy.
Once a candidate passes a lower level exam, the next-level exam authorization will be automatically issued within 24 hours.
This does not apply to the Architect exam authorization, which will be issued within 7-10 business days of passing the deployment practical lab.
Candidates who have not received their next-level exam authorization should contact certification@splunk.com for assistance.
As of October 1, 2019, all V6.x (and older) certifications are considered out of date. As such, these records have been marked "Inactive".
If you wish to earn a current certification, please see the above FAQ for your next-steps.
Why recertify? Two words: digital badge. And, of course, bragging rights.
But seriously, folks, staying current with your certifications proves to your employer, your peers, and prospective employers that you are committed to staying relevent in an ever-changing technical landscape and that your knowledge and skills are sharper than ever.
That being said - you don't have to recertify. Here's what that looks like:
As of October 1, 2019, your (V6.x and older) certification(s) will be considered out of date. You will not be granted a digital badge. Digital badges will only be granted to cert-holders under the new program. This means that, moving forward, if a third party (potential employer, etc.) contacts us to verify your certifications, we would be able to verify that you hold an outdated certification*.
*Please note - Splunk will never provide information regarding your certifications to a third party without your written consent.
If you believe you have noted an error on an exam or believe that a specific question you saw on a Splunk Certification exam is invalid, you may submit the Certification Exam Challenge Form found here.