thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Splunk · Cybersecurity · Entry

Splunk Core Certified User exam guide

Exam SPLK-1001

Splunk Core Certified User validates basic Splunk skills: searching, using fields, creating reports and dashboards, lookups and alerts. Splunk is widely used in SOCs and IT operations, and this entry certification is a common first step for security analysts.

Questions60
Time limit60 minutes
Passing scoreSee official page
Exam fee$130 USD
Valid for3 years
DeliveryPearson VUE test center or online proctored

Format: Multiple choice. Fee note: Per attempt.

Who it's for

Analysts and IT staff who search and report on data in Splunk Enterprise or Splunk Cloud.

What the exam covers

The vendor does not publish a domain breakdown for this exam. Check the official exam page for the current objectives.

Eligibility & prerequisites

Required: None

Recommended: Completion of Splunk's free Intro to Splunk and related eLearning.

Keeping it active

Splunk certifications are valid 3 years; recertify by passing the current exam or a higher-level exam in the same track.

Skills & careers

Skills it validates

  • Basic SPL searching
  • Using fields and time ranges
  • Transforming commands (stats, top, rare)
  • Reports and dashboards
  • Lookups
  • Scheduled reports and alerts

Job roles

SOC AnalystSecurity AnalystIT Operations AnalystData AnalystNOC Analyst

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Splunk free eLearning and a free Splunk trial.
  2. Week 2: Practice SPL with sample data: fields, stats and charts.
  3. Week 3: Reports, dashboards, lookups and alerts; practice questions.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know search mode differences (fast, smart, verbose).
  • Understand the default fields (host, source, sourcetype, _time).
  • Practice transforming commands until output is predictable.
  • Know where lookups and alerts are configured.

Key terms for this exam

All 7 terms Study with thinQcards™

Frequently asked questions

How much is SPLK-1001?

$130 USD.

How many questions?

60 in 60 minutes.

How long is it valid?

3 years.

Is it worth it?

Yes as a SOC entry credential.

What next?

Splunk Core Certified Power User (SPLK-1002).

Official page: www.splunk.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.