Looking for a downloadable resource for all things Splunk Certification? Look no further.

You Ask, We Answer

We've compiled our frequently asked questions regarding Training, Certification, and Recertification. Please see below for more information.

Training FAQ

With course offerings ranging from novice to expert and instructors teaching online (and live!) classes all over the world, Splunk Education is here for you, wherever you are. For course completion certificates, please fill out this form. Please review the questions below prior to contacting Education_AMER@splunk.com for one-on-one assistance.

It all starts with Splunk.com/Education


You'll notice that our curriculum is organized under different Learning Paths (courses only) and Certification Tracks (courses + exams) based on different Splunk roles or personas. Use the sidebar navigation to select the path or track that best corresponds to the Splunk role in which you are interested. 


Many of the foundational classes repeat across different pathways. You do not need to repeat classes – once you complete a course, you have met that prerequisite for all the paths to which it applies.


Found the perfect course? Simply click View Topics & Register to view the course description (which you can download), then click View Schedule.


Splunk Education accepts two forms of payment: credit card payment or existing Education credits. If you need to identify your existing credits, please contact your Splunk account manager. If you do not know your account manager, please contact us directly at Education_AMER@splunk.com


Complete the check-out steps. You will then receive a confirmation email with instructions to access the course. That's it! You're now registered.


Please note: our introductory courses are offered via self-paced eLearning/Instructor-on-demand (IOD) and instructor-led (Virtual) delivery. For these courses, select whichever format you prefer. Note that Virtual courses are offered across different time zones. Pick the best time zone offering for you, click Add to Cart, and proceed to checkout. 


As a reminder, there are mandatory prerequisites courses for advanced training. These prerequisites are critical for your success in learning Splunk – the shortcuts and tricks we show you in earlier courses are necessary to understand our advanced concepts. Without these shortcuts, you will not get full value from the advanced training.

First and foremost, look for the confirmation email sent to the email address you used to create your Education account. 


When you're ready: 


1.  Log in to Splunk.com/Education


2.  Scroll down and click View My Training Profile (Hint: it's at the bottom of the sidebar). 


3.  Log in with the username you used to create your account.  You may need to create a new account. Forgot your password? Reset it here. Any other login-related issues are best directed to Splunk Support.  


Reminder: Virtual (instructor-led) courses may have extensive connectivity requirements – see your confirmation email for full details. We strongly recommend verifying compatibility prior to the start date of your course.

You can launch an eLearning / IOD course from the confirmation email or directly from your Splunk Education account.


1.  Start by logging in to Splunk.com/Education.


2.  Click View My Training Profile (Hint: at the bottom of the left sidebar).

Courses you have registered for will be displayed at the bottom of the page. If you are having problems finding your courses, click the “My Learning” link, and use the “Filter Results” drop-down to filter courses by status.


3.  Once you have found the course, click the “Resume Course/Pathway” button to launch it.

REMEMBER: eLearning / IOD classes have a 30-day time limit. This clock starts as soon as you start the course.


Before launching a course, we suggest you use the test link at https://splk.it/2TKvg6K to verify that it will work with your system / network.

You must let Splunk Education know at least 5 business days before the scheduled start time of your class in order to avoid any penalties for late cancellation. 


We close registration for many of our courses before the start date, so a late cancellation means we will not be able to fill that seat. This means that any cancellation (or no-show) within the 5-day window will not be reimbursed (via credits or other form of payment).


To reschedule or cancel a registration, simply log in to Splunk.com/Education, and click View My Training Profile. 


From your profile, identify the course you wish to reschedule, then click the Cancel link. After you have cancelled, your credits will be returned to your account and you may reschedule for a new date at your convenience.  If you have any problems, simply contact Education_AMER@splunk.com and request a reschedule.

Certification FAQ
Exams, digital badges, & bragging rights.


Helping you get and stay current.



Splunk Certification is excited to be working with industry leader Pearson VUE on exam delivery and Acclaim on digital badging.

These partnerships mean a new exam registration process, new resources for exam preparation, a new exam delivery experience, and all-new digital badges to share (hint: bragging rights).

Please review the FAQ below for all the details. Many of these questions are also covered in our Splunk Certification Candidate Handbook.

For the visual learners in the crowd, we highly recommend reviewing our Exam Registration Tutorial and watching our candidate journey video (popcorn not included).

- For all candidates attempting their first exam under the new program, please start by filling out this form to connect your Splunk account to your new Pearson VUE account. This only needs to be done once.


- Once your accounts are connected (which may take up to 3 business days), you will receive your exam authorizations via email. If you have not received any communication from Pearson VUE after 3 business days, please send an email to certification@splunk.com for assistance.


- These authorization emails will contain your "Splunk ID" (hint: not your Splunk.com username), which you'll use to create an account with Pearson VUE. Your Splunk ID will look like PV-12345678.


- You can register for the exam at a Pearson VUE testing facility near you, or in your home or office via online proctor. We strongly encourage all candidates considering the online proctored option to read this overview prior to scheduling their exam appointment.


- For any questions regarding exam delivery, please contact Pearson VUE directly.


Please note: exam registration costs $125 USD (or five registrations for $500 USD). This cost applies to each exam attempt.

First and foremost, we recommend working with your supervisor, HR department, and/or other internal training departments to see if there are already policies in place where you work.


Generally speaking, there are three ways to purchase a Pearson VUE registration voucher:


1) Directly from PearsonVUE. This is the most streamlined approach. Follow the steps for account creation and exam registration provided at www.pearsonvue.com/splunk. Payment will be collected at the time of registration. You can also visit the Pearson VUE voucher store for direct purchase. This is a great option for individuals looking to buy bulk registrations (5 vouchers for $500) or for candidates who need to submit expense reports for reimbursement within a specific time frame, but are not ready to schedule an exam appointment.


2) Convert existing EDU credits to registration vouchers. If you (or your company) hold existing EDU credits and you’d like to use these for exam registration, please email certification@splunk.com for assistance. Our team can convert EDU credit ($500 each) into voucher codes in groups of five (1 credit = 5 vouchers).


3) From Splunk (as an account). Your Splunk Sales Rep can add certification exams to any deal. Once the number of vouchers has been requested, Splunk will email your unique registration codes, which can be used for registration at www.pearsonvue.com/splunk.

The certification exams include standard multiple choice and multiselect ("select all that apply") questions.


For a complete list of topics covered by the exam, please refer to the test blueprints linked below:


Splunk Core Certified User

Splunk Core Certified Power User

Splunk Enterprise Certified Admin

Splunk Enterprise Certified Architect

Splunk Certified Developer*

Splunk Enterprise Security Certified Admin

Splunk IT Service Intelligence Certified Admin


*Splunk Certified Developer is in its beta phase through February 28, 2019. This means that candidates who complete this exam will not immediately receive pass/fail results. Our targeted date for announcing results to individuals who complete the beta exam is Spring 2019. Registration for the beta exam is free at the time of registration (no voucher code required).

You can fill out this form to update or correct your Pearson VUE account information. The changes should reflect in your Pearson VUE account within 4 hours. Please contact certification@splunk.com if this is not the case.

First things first: congratulations!


The general timeline after passing the new certification exams is as follows:


- Within 24 hours you will see your new certification in your Splunk account (via your Customer Support Portal or your Partner Portal). For instructions to access your certifications, please click here.


- Within 24 hours you will receive the next-level Authorization to Test from Pearson VUE. You can also log in to your Pearson VUE account to see your eligible exams in your account profile. If this is not the case and you've already completed the prerequisite coursework, please send an email to certification@splunk.com for assistance.


- Last, but certainly not least, you can expect to receive communication regarding your digital badge within 5-7 days. Please note: the email will come from admin@youracclaim.com and may be routed to your spam or quarantined mail folder. We recommend whitelisting this email address in advance to ensure you receive all digital badging communication.

Yes. The Pearson VUE platform requires that candidates have a unique account for each certification program in which they'd like to participate.

A digital badge is a representation of a credential or accomplishment that can be shared across the web. Digital badges contain metadata that allows a third party to verify your accomplishments including the criteria required to earn the badge and the period for which a badge is valid.


In short: Splunk digital badges are your proof of certification.


Representing your credential(s) with a digital badge gives you the ability to broadcast your skills and tell your professional story online. It also allows you to securely represent your certification across a growing number of social media outlets and forums.


Employers, potential employers, and anyone else with whom you wish to share your certification have single-click access to validated credential information without ever contacting Splunk Certification for assistance.

First and foremost, please double-check your spam and quarantined email folders for emails from admin@youracclaim.com.


As a best practice, we recommend whitelisting this email address ahead of time (or working with your IT department to make this happen).


If you still cannot locate your email from Acclaim, you can simply create an account on Acclaim, using the email address to which your badge was issued.


To create an account and claim your badge, follow the steps below:


1) Go to www.youracclaim.com.

2) Select "Create an Account"

3) Fill in the required fields, then read and agree to the Terms of Use

4) Click "Create My Account"


Acclaim will send you a confirmation email (from admin@youracclaim.com). You must click the link in that email to confirm your account. Once you've created and confirmed your account, any badges issued to that email address will be available for you to accept and share.


For general questions about Acclaim, including account troubleshooting and general information on sharing your digital badge(s), please visit http://support.youracclaim.com.

You can share your badge at your discretion; it can be as public or as private as fits your professional goals.


The ease with which you can share your badge(s) on social media sites and other digital properties is one of the valuable features of a Splunk digital badge. Each digital badge has a unique URL that can be embedded on a resume, website or social media channel. Click here for more details from Acclaim, our partner in digital badging.


If you decide you do not want your certification or your profile to be visible to the public, you can make it private. All information regarding you and your credentials can be configured within your Acclaim account.


In order to share either your profile or a badge, your profile must be marked "public". Having your profile public increases your visibility in the marketplace and provides employers with easy, valid verification of your credential(s).

While badges are simply digital image files, they are uniquely linked to data hosted on the Acclaim platform. This link to verified data makes them more reliable and secure than a traditional paper-based credential.


The unique link is associated only with your profile and your certifications.


The Acclaim Support team can answer questions about your badge account or navigating Acclaim. Please contact Acclaim support directly for assistance.

No! You can manage and share all of the badges that are issued to you through Acclaim within one Acclaim account.

Yes. For specific questions or 1:1 guidance regarding your particular path to certification, please contact us directly at certification@splunk.com.


Whether you have a legacy certification or a shiny new digital badge, the paths below give you clear guidance into your next steps so you get (and stay!) current with Splunk Certification.

Not sure which version your certification is? Please double check your list of certifications before asking for help. Click here for instructions to access your certifications (scroll down for Splunk Partners). 

Congratulations! As part of the Fall 2018 relaunch, we've updated the way we version our certifications. Our goal is to minimize confusion and simplify the recertification process in the years to come. For this reason, we are not tying certification versions to product versions. In other words, these certifications are not V7 (or V6 or V8...).


The following life-cycles will apply to recertifications moving forward, beginning with the date the digital badge was received:


Splunk Core Certified User - 2 years
Splunk Core Certified Power User - 2 years
Splunk Enterprise Certified Admin - 2 years
Splunk Enterprise Certified Architect - 3 years
Splunk Certified Developer - 3 years
Splunk Enterprise Security Certified Admin - 3 years
Splunk IT Service Intelligence Certified Admin - 3 years

Good news! You are eligible for a one-year recertification window under the new program. This means that from program launch (October 1, 2018) through October 1, 2019, you have two options for recertification:


1) Register for the highest level exam you held as a V6.x Certification (no prerequisites necessary).


2) Complete the prerequisite coursework and register for the next-level exam, moving beyond the highest V6.x certification you held.


Here’s what it looks like in practice (see pdf for reference):


V6.x Splunk Certified User is eligible for Splunk Core Certified User or Splunk Core Certified Power User.


V6.x Splunk Certified Power User is eligible for Splunk Core Certified Power User or Splunk Enterprise Certified Admin.


V6.x Splunk Certified Admin is eligible for Splunk Enterprise Certified Admin or Splunk Enterprise Certified Architect.


Remember, leveling up still requires prerequisite coursework. The one year recertification window merely provides candidates an opportunity to maintain their highest level certification (or one level higher) without going back to pass additional prerequisite exams.


Please note: candidates who pass the new certification exams will earn all downstream certifications*. This means that if you pass the Splunk Core Certified Power User exam, you'll also get the digital badge for Splunk Core Certified User! Double bragging rights? Yes, please.


*Candidates who pass the Splunk Certified Developer exam will not be granted downstream certifications. Upon successful completion of the Splunk Certified Developer exam, candidates will only be granted the digital badge for Splunk Certified Developer.

Good news! You are eligible for a one-year recertification window under the new program.


It is important to note that Splunk Enterprise Certified Architect is an all-encompassing Architect certification, meaning it includes Cluster Administration and Troubleshooting Splunk Enterprise as part of its prerequisite coursework.


If you took these courses as part of your path to Architect II, you have until October 1, 2019 to register for (and pass) the new, multiple choice Splunk Enterprise Architect Certification exam.


That's it!


If you haven't taken these courses (we're looking at you V6.x Architects), you have two options:


1) Register for the Splunk Enterprise Certified Architect Exam as-is, without completing any additional coursework, with the understanding that there are topics covered on the exam that you haven't seen as part of your education thus far.


2) Complete the two courses (linked above) and then register for the exam, knowing that your coursework has fully prepared you for the exam content.


Be sure to act within this recertification window. Candidates who do not pass the Splunk Enterprise Certified Architect exam by October 1, 2019, will be subject to the full certification path including these courses and all prerequisite exams.


Hint: If you're worried about the timeline (or want to complete the courses but don't have the time or capital to invest this year), you can choose to recertify at a lower level (like Splunk Enterprise Certified Admin) so you don't have to start from the beginning after the October 1 deadline.

We're looking at you, Splunk Certified Knowledge Managers or old school Architects.


Your certification(s) are no longer current and you are not eligible for a shortened path to recertification.


This means that, in terms of prerequisites, it's time to go back to the basics and start with Fundamentals 1 (which is free!) to become a Splunk Core Certified User.


You can browse the available certification tracks via the left-hand sidebar to view (and register for) prerequisites for the other certification paths in which you might be interested.

Why recertify? Two words: digital badge. And, of course, bragging rights.


But seriously, folks, staying current with your certifications proves to your employer, your peers, and prospective employers that you are committed to staying relevent in an ever-changing technical landscape and that your knowledge and skills are sharper than ever.


As a final note - if you are considering recertification, now is the time to do it. During the recertification window, we're offering shortened paths for V6.x cert-holders (see above). This means passing only one exam (at your highest level V6.x certification for $125) and earning all downstream certifications. This is, by far, your most time- and cost-effective path to recertification.


If you wait until after October 1, 2019, you will be starting from scratch on your path to certification (meaning back to Fundamentals 1 and Splunk Core Certified User). This means more time and more money.


That being said - you don't have to recertify. Here's what that looks like:


As of October 1, 2019, your (V6.x and older) certification(s) will be considered out-of-date. You will not be granted a digital badge. Digital badges will only be granted to cert-holders under the new program. This means that, moving forward, if a third party (potential employer, etc.) contacts us to verify your certifications, we would be able to verify that you hold an outdated certification*.


*Please note -  Splunk will never provide information regarding your certifications to a third party without your written consent.


If you believe you have noted an error on an exam or believe that a specific question you saw on a Splunk Certification exam is invalid, you may ​submit the Certification Exam Challenge Form found here.