Skip to content
CBT Nuggets
DemoBook a Demo
SplunkEntry

Splunk Core Certified Power User

Standardize your team on Splunk Core Certified Power User with a structured Splunk training path — virtual labs and team admin reporting included on every CBT Nuggets Teams seat.

Book a DemoAll Splunk certs
1
Course
12
Core skills
$130
Exam fee (Splunk)
IT operations team at help desk workstations with ticket queues and network diagrams
Difficulty
Difficulty: 3 of 5 (Moderate)
Moderate
Exam fee (Splunk)
$130
Courses on path
1
Official source
Splunk’s official exam page
Exam code
  • SPLK-1002

Exam datasheet

Format
Multiple choice questions
Prerequisites
None
Recommended experience
None
Recertification
3 years
Testing center

Exams

Exams for this certification

Exam fees per engineer, paid to the exam vendor$130

Exam — Required

Every engineer on the Splunk Core Certified Power User path takes SPLK-1002.

  1. SPLK-1002Splunk Core Certified Power User
    Exam fee
    $130
    Exam length
    60 minutes
    Questions
    65
    Passing score
    Not publicly available

    Exam blueprint: SPLK-1002

Skills your team builds

Searching and reportingSPL commandsWorkflow actionsEvent typesKnowledge objectsData modelsField aliasesCalculated fieldsMacrosData normalizationSplunk EnterpriseSplunk Cloud

Training path

Your team's training path

One CBT Nuggets course covers the full Splunk Core Certified Power User path. Your team can start today and have admin reporting visible from day one.

  1. Start here · primary course

    Splunk Core Certified Power User

    When only one or two analysts understand the saved searches, dashboards, fields, and event mappings a SOC depends on, every shift change and staff departure becomes a risk. This course helps IT Directors and Team Leads move Splunk users from personal searches to shared knowledge objects and repeatable workflows the whole team can rely on. Built for SOC analysts, SIEM administrators, and IT practitioners who already work with Splunk, the training covers charts, filtering and formatting, event correlation, fields, tags, event types, macros, workflow actions, data models, and the Common Information Model (CIM) add-on. Throughout, the instructor frames Splunk objects around SOPs, corporate policy, and team handoffs, so the skills apply directly to how your SOC operates. At 6.6 hours across eight skills, Training Managers can assign the course in short blocks alongside daily operations. CBT Nuggets Virtual Labs provide a Splunk VM with a preconfigured data set for hands-on practice, and the course aligns with the Splunk Core Certified Power User certification, a practical next step for teams standardizing Splunk skills.

    Bob Salmans, Erik Choron
    54 videos8 labs7h
    Open course

Every certification course includes

  • Expert-led video training
  • Hands-on virtual labs
  • Per-team completion reporting

Splunk career ladder

Where Splunk Core Certified Power User sits in your team's Splunk progression

The cert your team is on now, plus the levels above and below. Use this to map an engineer's next-step credential or to plan headcount coverage across tiers.

  1. Entry level

    2 certs

    Splunk Core Certified Power User

    SPLK-1002

    You are here

    Splunk Core Certified User

    SPLK-1001

Customer outcome

Build SPLK-1002 capability across the whole team, not one engineer

Assign the Splunk Core Certified Power User course to the engineers who need it, and the team report shows who has started, who has finished — the view leadership uses to see Splunk skills coverage across the team and where the gaps are.

See team pricing

Team capability

Make SPLK-1002 a number on your team capability sheet, not a single engineer’s certificate.

Standardizing your team on SPLK-1002 gives leadership a clear picture of Splunk skills coverage — who has completed the training, who is still on the path, and where the gaps are — so staffing and escalation plans rest on known capability instead of on one engineer.

Credential: Splunk Core Certified Power User

Exam
  • SPLK-1002

Frequently asked questions about Splunk Core Certified Power User training

Common questions IT directors ask when evaluating Splunk Core Certified Power User training for their team.

How does Splunk Core Certified Power User fit into our internal compliance and governance program?

IT leaders often cite SPLK-1002 when documenting who on the team can maintain the search knowledge objects, data models and CIM-aligned fields that security monitoring depends on. Team reporting in CBT Nuggets provides per-learner progress, completion and completion exports that can serve as audit evidence of assigned training. Your auditor's control crosswalk decides how the credential maps to any formal framework requirement.

Who on the team should hold Splunk Core Certified Power User, and what can a certified team own?

The credential fits SOC analysts, SIEM administrators and IT operations staff who work in Splunk every day and build content others reuse. The linked course prepares them to own charting and formatting of search results, event correlation, field creation and management, tags and event types, macros and workflow actions, data models, and normalization through the Common Information Model (CIM) Add-On.

What does CBT Nuggets Splunk Core Certified Power User training include for a team?

CBT Nuggets Splunk Core Certified Power User courses are built by named expert trainers. Where a course includes hands-on virtual labs or a practice exam mapped to Splunk's published exam objectives, the course list on this page says so. Team admin reporting tracks assignment, completion and exam readiness per engineer — the view managers use to run a team training program.

How do I assign and track Splunk Core Certified Power User training for my team?

From the admin console, managers assign the Splunk Core Certified Power User courses directly to specific engineers or role groups and track completion and practice-exam scores per learner. Team-wide reporting rolls up to a single dashboard you can review or export for leadership reviews or compliance reporting.

How long does it take to certify a team on Splunk Core Certified Power User?

The linked training runs about 7 hours of video, which gives Training Managers a concrete baseline for planning. Actual time to certify depends on the team's starting point, including how much hands-on Splunk search experience each engineer already has.

What if Splunk updates the Splunk Core Certified Power User exam objectives?

CBT Nuggets updates Splunk course content as exam objectives refresh, and this page shows the current exam's status and any retirement date the vendor has announced. When Splunk restructures or renames a track, the assigned training stays aligned with the same team training plan, and the training stays current without anyone losing their progress mid-stream.

Ready to Splunk Core Certified Power User-certify your team?

Build Splunk Core Certified Power User capability across your team

See how CBT Nuggets helps IT leaders plan and track Splunk Core Certified Power User training across the team — labs and reporting included.

Book a Demo