Free Splunk Core Certified User Exam Flashcards

The official test blueprint lists 60 multiple-choice questions in 60 minutes of total seat time. Three of those minutes are reserved for reviewing and accepting the Splunk Certification Agreement, which leaves 57 minutes of actual assessment time. Do not confuse this with the Splunk Core Certified Power User exam, which is a different, higher-level exam with 65 questions.

Splunk does not publish a numeric passing score or a public pass rate for this exam. Results are reported as pass or fail immediately after you submit. Ignore third-party sites that claim a specific cut score such as 70% or 75%, because no official Splunk source states one. Candidates who do not pass can review section-level feedback in their Pearson VUE account, but never a question-by-question breakdown.

The blueprint has eight content areas: Splunk Basics 5%, Basic Searching 22%, Using Fields in Searches 20%, Search Language Fundamentals 15%, Using Basic Transforming Commands 15%, Creating Reports and Dashboards 12%, Creating and Using Lookups 6%, and Creating Scheduled Reports and Alerts 5%. Basic Searching and Using Fields together account for 42% of the exam, so weight your study time accordingly.

Splunk lists $130 USD per exam attempt, with bulk vouchers of five registrations for $500 USD. Delivery is through Pearson VUE, either in person at an authorized test center or at home through the OnVUE online proctor. All Splunk certification exams are closed book: no notes, course materials, or access to Splunk Docs are permitted, and a violation results in automatic failure and forfeiture of your fee.

After a first failure you wait 7 days, and the wait begins the day after your attempt. After a second failure you wait 14 days. Subsequent waits are 28 days before the fourth attempt and 56 days before the fifth and sixth attempts. Retakes beyond the sixth attempt are considered case by case, and Splunk reserves the right to deny them. Each attempt costs another $130 USD.

All Splunk certifications are valid for three years from the date earned, with a 90-day grace period after the cycle ends before the credential goes inactive. Since 1 March 2026 you can no longer recertify through coursework. You renew either by retaking and passing the same exam during the final year of your recertification window, or by earning a higher-level certification in the track, which for Core User means Splunk Core Certified Power User.