About the Splunk Enterprise Certified Admin Exam
Key Takeaways
- The exam has 56 questions in 60 minutes, including 3 minutes to accept the exam agreement, and is a professional-level exam delivered by Pearson VUE in person or online.
- The prerequisite is Splunk Core Certified Power User, and each attempt costs $130 USD, or five registrations cost $500 USD.
- The blueprint has 17 domains: Splunk Indexes, Distributed Search, and Forwarder Management are 10% each, and the other 14 domains are 5% each.
- After a failed attempt, the wait is 7 days, then 14 days, then 28 days before a fourth attempt and 56 days before a fifth or sixth.
- The certification lasts three years; recertify by passing the exam again in the final year or by passing Splunk Enterprise Certified Architect, since coursework no longer counts after 1 March 2026.
About the Splunk Enterprise Certified Admin Exam
Quick Summary: The Splunk Enterprise Certified Admin exam is the final step to the Splunk Enterprise Certified Admin certification. It is a professional-level, closed-book exam of 56 questions in 60 minutes (including 3 minutes to accept the exam agreement), delivered by Pearson VUE. The prerequisite is Splunk Core Certified Power User. Its blueprint has 17 domains: 14 are weighted 5% each, and three (Splunk Indexes, Distributed Search, and Forwarder Management) are weighted 10% each. This independent OpenExamPrep guide follows the same 17 domains, one chapter per domain.
The Exam at a Glance
| Item | Detail |
|---|---|
| Questions | 56 |
| Time | 60 minutes, which includes 3 minutes to review and accept the Splunk Certification Agreement |
| Level | Professional |
| Prerequisite certification | Splunk Core Certified Power User |
| Registration fee | $130 USD per attempt, or five registrations for $500 USD |
| Delivery | In person at a Pearson VUE test center, or at home with an online proctor (OnVUE) |
| Reference material | None: exams are closed book, and any perceived violation means automatic failure |
| Results | Pass or fail. Unsuccessful candidates can view section feedback in their Pearson account; no question-by-question analysis is given |
| Certification validity | Three years |
| Next-level certification | Splunk Enterprise Certified Architect |
During the exam you can flag questions for review, return to earlier questions, and review everything before submitting. Once submitted, scores are final.
Scheduling, Retakes, and Recertification
- Cancelling or rescheduling: you must do so at least 48 hours before the appointment, or you forfeit the fee. Online candidates must pass Pearson's system test on the computer they will use.
- Retake waits: 7 days after a first failed attempt, 14 days after a second, 28 days before a fourth attempt, and 56 days before a fifth or sixth. Attempts beyond the sixth are considered case by case. Each attempt costs the full fee, and you cannot retake an exam you have passed except for recertification.
- Recertification: certifications last three years from the date you earned your highest-level certification. You can recertify by passing the same exam again in the final year of the cycle, or by passing a higher-level certification; for this certification that is Splunk Enterprise Certified Architect. There is a 90-day grace period, after which the certification becomes inactive. Renewing the Admin certification also renews the downstream Power User certification. It also updates the Core Certified User and Advanced Power User badges, but only if you already hold them.
- Policy change: Splunk removed the option to recertify by completing coursework, effective 1 March 2026.
Blueprint Map: Domains, Weights, and Chapters
With 56 questions, a 5% domain is worth about 3 questions and a 10% domain about 5 or 6. These are our own approximations; Splunk publishes only the percentages.
| Domain | Weight | ≈ Questions | Chapter in this guide |
|---|---|---|---|
| 1.0 Splunk Admin Basics | 5% | 3 | Chapter 1 |
| 2.0 License Management | 5% | 3 | Chapter 2 |
| 3.0 Splunk Configuration Files | 5% | 3 | Chapter 3 |
| 4.0 Splunk Indexes | 10% | 5–6 | Chapter 4 |
| 5.0 Splunk User Management | 5% | 3 | Chapter 5 |
| 6.0 Splunk Authentication Management | 5% | 3 | Chapter 6 |
| 7.0 Getting Data In | 5% | 3 | Chapter 7 (7.3 in Chapter 10) |
| 8.0 Distributed Search | 10% | 5–6 | Chapter 8 |
| 9.0 Getting Data In – Staging | 5% | 3 | Chapter 9 |
| 10.0 Configuring Forwarders | 5% | 3 | Chapter 10 |
| 11.0 Forwarder Management | 10% | 5–6 | Chapter 11 |
| 12.0 Monitor Inputs | 5% | 3 | Chapter 12 |
| 13.0 Network and Scripted Inputs | 5% | 3 | Chapter 13 |
| 14.0 Agentless Inputs | 5% | 3 | Chapter 14 |
| 15.0 Fine Tuning Inputs | 5% | 3 | Chapter 15 |
| 16.0 Parsing Phase and Data | 5% | 3 | Chapter 16 |
| 17.0 Manipulating Raw Data | 5% | 3 | Chapter 17 |
The blueprint says its topics are general guidelines, that related topics may also appear, and that the guidelines can change without notice. Check the current blueprint PDF before your exam.
How to Use This Guide
- Weight your time by the blueprint. The three 10% domains together are 30% of the exam: bucket lifecycle and retention, distributed search and search head clustering, and deployment server management. Give them extra practice.
- Follow the data. Chapters 7 and 9–17 follow data from input, through forwarding and the parsing, merging, typing, and index pipelines, to transformation. Knowing which tier applies which setting (universal forwarder, heavy forwarder, indexer, or search head) answers many questions.
- Learn the files and their defaults. Many questions turn on a setting name or default, such as
inputs.conf,outputs.conf,props.conf,transforms.conf,indexes.conf,serverclass.conf, orauthorize.conf. Each chapter shows the real stanza syntax. - Practice hands-on. A small lab (a Splunk Enterprise instance plus a universal forwarder) lets you try
btool, deployment apps, monitor inputs, and props/transforms changes yourself. - Use the official preparation list. The blueprint suggests the Splunk Enterprise System Administration and Data Administration courses, and says candidates may also use the Splunk How-To YouTube channel, Splunk Docs, and their own experience.
Each section ends with practice questions that explain why the right answer is right, using the facts taught in that section.
How many questions does the Splunk Enterprise Certified Admin exam have, and how much time is allowed?
Which three blueprint domains are weighted 10% each?
A candidate fails the exam for the first time on a Monday. According to the candidate handbook, when can they retake it?
Which of these renews a Splunk Enterprise Certified Admin certification after 1 March 2026?