Skip to content
CBT Nuggets
DemoBook a Demo
SplunkEntry

Splunk Core Certified User

Standardize your team on Splunk Core Certified User with a structured Splunk training path — virtual labs and team admin reporting included on every CBT Nuggets Teams seat.

Book a DemoAll Splunk certs
1
Course
8
Core skills
$130
Exam fee (Splunk)
IT operations team at help desk workstations with ticket queues and network diagrams
Difficulty
Difficulty: 1 of 5 (Easy)
Easy
Exam fee (Splunk)
$130
Courses on path
1
Official source
Splunk’s official exam page
Exam code
  • SPLK-1001

Exam datasheet

Format
60 multiple-choice questions
Prerequisites
None
Recommended experience
None
Recertification
3 years
Testing center

Exams

Exams for this certification

Exam fees per engineer, paid to the exam vendor$130

Exam — Required

Every engineer on the Splunk Core Certified User path takes SPLK-1001.

  1. SPLK-1001Splunk Core Certified User
    Exam fee
    $130
    Exam length
    60 minutes
    Questions
    60
    Passing score
    Not publicly available

    Exam blueprint: SPLK-1001

Skills your team builds

Perform searchesUse fields and lookupsCreate alertsCreate basic reportsCreate dashboardsSplunk Enterprise basicsSplunk Cloud basicsNavigate and use Splunk software

Training path

Your team's training path

One CBT Nuggets course covers the full Splunk Core Certified User path. Your team can start today and have admin reporting visible from day one.

  1. Start here · primary course

    Splunk Core Certified User

    Many security and operations teams collect large volumes of machine data but lack a shared, repeatable way to search it and act on what they find. This course gives IT Directors and Training Managers a consistent Splunk baseline for SOC analysts, security analysts, SIEM users, and IT operations staff. Across 11 skills and about 9.3 hours, learners move from Splunk navigation and basic management into searching with indexes, hosts, and fields. They write foundational SPL, summarize data with the top, rare, and stats commands, and build reports, dashboards, lookups, scheduled reports, and alerts. All practice runs in an isolated lab loaded with realistic data from many system types, so no one touches production while they learn. The course aligns with the Splunk Core Certified User certification and fits teams adopting Splunk or moving past basic navigation into repeatable reporting. Assign it through Playlists, and use Team Reporting to track progress across your SOC and operations staff. The Splunk Core Certified Power User course is the natural next step.

    Erik Choron, Bob Salmans
    75 videos11 labs9h
    Open course

Every certification course includes

  • Expert-led video training
  • Hands-on virtual labs
  • Per-team completion reporting

Splunk career ladder

Where Splunk Core Certified User sits in your team's Splunk progression

The cert your team is on now, plus the levels above and below. Use this to map an engineer's next-step credential or to plan headcount coverage across tiers.

  1. Entry level

    2 certs

    Splunk Core Certified Power User

    SPLK-1002

    Splunk Core Certified User

    SPLK-1001

    You are here
Customer outcome

Build SPLK-1001 capability across the whole team, not one engineer

Assign the Splunk Core Certified User course to the engineers who need it, and the team report shows who has started, who has finished — the view leadership uses to see Splunk skills coverage across the team and where the gaps are.

See team pricing

Team capability

Make SPLK-1001 a number on your team capability sheet, not a single engineer’s certificate.

Standardizing your team on SPLK-1001 gives leadership a clear picture of Splunk skills coverage — who has completed the training, who is still on the path, and where the gaps are — so staffing and escalation plans rest on known capability instead of on one engineer.

Credential: Splunk Core Certified User

Exam
  • SPLK-1001

Frequently asked questions about Splunk Core Certified User training

Common questions IT directors ask when evaluating Splunk Core Certified User training for their team.

How does Splunk Core Certified User fit into our internal compliance and governance program?

Teams often cite Splunk Core Certified User when documenting who can search and report on security and operational log data in Splunk. CBT Nuggets team reporting provides per-learner progress, completion and completion exports that can serve as training evidence, while the auditor's control crosswalk decides how the credential maps to a specific framework.

Who on the team should hold Splunk Core Certified User, and what can a certified team own?

IT leaders typically assign it to SOC analysts, security analysts and IT operations staff who work in Splunk daily. The linked course prepares them to write SPL searches, work with fields and lookups, summarize results with transforming commands such as rare and stats, and build reports, dashboards, scheduled reports and alerts, so a certified team can own routine log investigation and alert setup.

What does CBT Nuggets Splunk Core Certified User training include for a team?

CBT Nuggets Splunk Core Certified User courses are built by named expert trainers. Where a course includes hands-on virtual labs or a practice exam mapped to Splunk's published exam objectives, the course list on this page says so. Team admin reporting tracks assignment, completion and exam readiness per engineer — the view managers use to run a team training program.

How do I assign and track Splunk Core Certified User training for my team?

From the admin console, managers assign the Splunk Core Certified User courses directly to specific engineers or role groups and track completion and practice-exam scores per learner. Team-wide reporting rolls up to a single dashboard you can review or export for leadership reviews or compliance reporting.

How long does it take to certify a team on Splunk Core Certified User?

The linked CBT Nuggets training totals about 9 hours of video. How long a team takes to certify depends on its starting point with Splunk and how much time each analyst can give the course alongside their regular work.

What if Splunk updates the Splunk Core Certified User exam objectives?

CBT Nuggets updates Splunk course content as exam objectives refresh, and this page shows the current exam's status and any retirement date the vendor has announced. When Splunk restructures or renames a track, the assigned training stays aligned with the same team training plan, and the training stays current without anyone losing their progress mid-stream.

Ready to Splunk Core Certified User-certify your team?

Build Splunk Core Certified User capability across your team

See how CBT Nuggets helps IT leaders plan and track Splunk Core Certified User training across the team — labs and reporting included.

Book a Demo