What is the format of the Splunk Core Certified User exam?
Per Splunk's official exam page, the Splunk Core Certified User exam is entry level with no prerequisites: 60 multiple-choice questions in 60 minutes, priced at $130 USD per exam attempt, and delivered by Splunk's testing partner Pearson VUE. Pearson VUE's dedicated Splunk OnVUE page confirms the same exam can be scheduled online from home, with a passed system test on the exam-day device and network required beforehand.
What the Exam Actually Validates
Splunk describes the credential as proof of a strong understanding of Splunk Enterprise and Splunk Cloud basics. Concretely, a certified user can search, use fields and lookups, and create alerts, basic statistical reports, and dashboards. It is deliberately the entry rung of the Splunk certification ladder — the line on a resume that says the platform's fundamentals are covered.
Splunk names the intended audiences directly: career changers moving into data roles and data analysts proving basic platform proficiency. The exam is an optional entry point to the certification program, and Splunk publishes a test blueprint so the topic coverage is visible before you book.
The Real Difficulty: One Minute per Question
Sixty questions in 60 minutes is a flat one-minute-per-item pace with no slack. The concepts are entry level, but the format punishes hesitation: a candidate who stalls on three early items runs out of clock on easy later ones.
The second pressure point is financial. Every attempt costs the full $130, so two underprepared sittings cost $260 — more than most prep courses for this exam. Splunk does not publish a passing score on its exam page, so treat any third-party 'pass mark' figure with suspicion and prepare to the blueprint instead.
Taking It at Home: The OnVUE Requirements That Matter
Pearson VUE runs a dedicated 'Online testing for Splunk' OnVUE page for scheduling, rescheduling, and canceling from home. The published minimums: Windows 10 or macOS 14 or higher; a working webcam, microphone, and speaker with no headphones or headsets; one display only — multi-monitor setups are not permitted; and at least 6 Mbps download with 2 Mbps upload.
The disqualifiers are just as concrete: no virtual machines, no mobile devices, no smart devices with recording or AI features in the room, and no VPNs, corporate networks, or public or shared networks. The system test must pass on the same device and network you will use on exam day — running it the night before, on the actual setup, is the single cheapest insurance this exam offers.
Booking the Sitting: What the Pearson VUE Flow Looks Like
Everything runs through a Pearson VUE web account, because Pearson VUE is Splunk's testing partner. From the Splunk OnVUE page you create an account or log in, choose the Splunk Core Certified User exam, pick a test-center appointment or an online OnVUE slot, and pay the $130 attempt fee. The same portal handles rescheduling and cancellation, so a calendar change does not mean losing the fee by default.
Two booking habits separate smooth sittings from forfeited fees. First, schedule around the system test: run it on the exact device and network you will use, on a day when a failure still leaves time to fix the setup. Second, respect the single-display and no-headphones rules at home — a second monitor or a pair of earbuds can end the check-in before the first question loads.
Who This Credential Is (and Is Not) For
Take it if a target job description says 'Splunk fundamentals', if you are pivoting into a data or SOC role and need a first vendor credential, or if your team adopted Splunk and you want the basics certified rather than asserted.
Skip it — at least as a first move — if the role asks for admin-level Splunk skills, a cloud data credential like SnowPro Core, or a broad security certification; the Core Certified User proves basic use, not platform administration. And if the deadline behind the credential is closer than your practice calendar, Exam Assist handles the sitting end to end, with the service fee due only after the agreed result posts.