I’m now a Splunk Certified Power User!

Update (2017-08-16): Yesterday I got certified as a Splunk Admin! You can see the tips to get that certification in this other blog post.

Last week I got certified as a Splunk Power User! I took the online test after doing all the pre-required courses and passed it.

For those interested in getting certified, here are some tips:

  1. The test is free, but you have to take the required courses first, which are not free. When you register for the test, the Splunk people will check if you’ve taken the courses.
  2. After finishing the courses, don’t take too long to take the certification test. It’ll be easier for you to remember all the content, which is a lot.
  3. The test is not hard, but they ask about everything you saw in the required courses, so make sure you study everything.
  4. You can view all the required and optional courses here.
  5. After you pass the test, they give you a nice diploma and some cool badges you can use online.

Splunk Power User Badge

Let me know if you have any questions about the certification.


Add Yours →

Hi Nikhil,

The “Using Splunk” course takes about 5 hours.
The “Searching and Reporting with Splunk” and “Creating Splunk Knowledge Objects” took 1 full day each. These were very intensive and the instructor was really good so you learn a lot.
The “Infrastructure Overview” is a self paced course that is available for 30 days for you too study but it took me about 5 hours in total to review all its content.

Thanks Felipe. I am currently doing the 3rd course in the pipeline, “creating splunk knowledge objects”. Just out of curiosity, Were the questions in the certification exam similar to the graded quiz which we answer at the the end of every course. ?

Hi Nikhil,

Yes, they were similar. Make sure you have all course material handy when you take the exam because they ask some detailed questions also that were not asked in the graded quizzes before.
Good luck!

Hello Venkat,

Did you do all the required courses first?
If so, I recommend you study all the course material again and have it handy when taking the test.

Good luck!

I faced the same issue now. I have used all of my 3 attempts. The questions for really on a higher level and sometimes not related to the pre-req courses at all. I contacted splunk certification and they gave me 3 more attempts. I havent taken the exam in the new attempts, as I am currently going through the labs one more time. I would tell you any other info if I pass my exam in these additional attempts.

Hello Vinit, the 3 additional retakes were complimentary. You don’t have to pay for them. If you can’t pass in these additional attempts, solunk suggests you to retake the courses and labs again. Good luck

Hi Nikhil, I am also looking for doing power user certification. Can you please tell me the fee for the course in INR.


I also failed 2 attempts(65%, 70%), and 3rd attempt got crashed.I have sent an email to ‘certification@splunk.com’ .But i have not seen any response yet.Can some one help me to find out is there any other way to contact or how long do they take to respond back.

Hey Felipe,

From what I understand the Splunk cert test is online. Is it based more along the questions from the final tests and quiz? Or more on what you did during the labs? I’ve done everything except the architecture course. I’ve aced every single final quiz, but have seen people fail the cert test.

Hi Leor,

Yes, the cert test is online and it is based on everything you saw during the courses, from the content itself to the quizzes, so yes, some people could ace the final quizzes but fail in the cert test. Don’t underestimate the content from the courses.
There are also many questions that you can find on Splunk Docs (http://docs.splunk.com). The test is “open book” so have that website open and the material from the required courses so you can access them easily.

Good luck!

Hi Felipe,

First of all, your response is very helpful. I’m just curious about the format of the quiz. Is it similar to the final quizzes where it is more of a multiple choice and fill in the blanks? Or we will be required to perform simple to complex search syntax?

Thanks in advance.

I believe theirs only an hour to complete the test correct?I dont think is enough time to to look trough a book or guide. any other way that you believe we can pass this test.

Hi Luis,

Yes, There’s only 1 hour to complete the test but that’s more than enough if you’ve done all the required courses and studied previously. In my case I think I finished it with about 10 minutes to spare.

I don’t think there’s another way but to do the courses and study. As I’ve said before, try to have the docs website and PDFs from the courses handy. Also, try to get familiar with the docs website so you know where to find things. You won’t have too much time to browse when doing the test but instead you’ll want to go exactly where you need to go.

Good luck!

Hi Felipe,

First of all, your tips are very helpful. I’m just curious related to the quiz format. Is it similar to the Final Quizzes where it is composed of multiple choices and fill in the blanks? OR we are required to do simple to complex search syntax?

Thanks in advance.

Hi Jeremie,

It is similar to the final quizzes. It is all multiple choice and fill in the blanks (by choosing one of the options). You won’t have to type words nor searches.

Good luck!

I no longer have access to the first three courses in order to study. Sadly, I didn’t complete the courses back to back. Any suggestions?


Not that I can think of. I guess the closest thing would be to go to the docs page because all the information from the courses is there, but it is not organized in a way that is useful for you to prepare for the certification test.
Did you try sending an email to the Education team at Splunk?

Good luck.

Hi Felipe,

I am about to start the first course of the series for this certification and need your inputs to know if it is really required to complete all the optional courses as well along with the required courses? Request you to please suggest if you went through the optional courses that are listed? Is going through the required courses should be enough to pass the certification?

Thanks in advance!

Hi Uday,

The optional courses are not required to pass the test.
I only went though the required courses and that was enough. I will take the optional courses in the near future because they teach you new things that are useful for my job.

Good luck!

Hi Paul,

Not right now since there’s another team in my organization that has all the administration of our Splunk implementation, but I could do it in the future if I get more into administration.


Hi Felipe,

i have taken all the 4 courses but unfortunately the “Using SPlunk” course got expired because i did it long back,so could you please suggest me whether the splunk will allow me to take test for Poser user or not.


Hi Priyanka,

I think they will let you take the test for Power User if you tell them you have enough experience using Splunk, let’s say at least 1 year using it.
That is what I did when I registered for the test and they asked me how much time I had using Splunk.

Good luck!

I am now eligible to get power user certification as i passed all modules with final test. But from where can i extract the certificate.. I cannot see any link

Hi Felipe,

I would like to know below details :
1. is there any negative marking ?
2. how many questions are there ?
3. can we browse the internet while taking the test on the same machine ?


Dear Felipe,

Your account of the power user exam helped me a lot to get past this barrier. After scores of 70 and 74, I took your advice, went back to basics and it really helped me ace it.


Hi Felipe,

Please accept my heartiest congratulations for completing Splunk Power User Certification.

I am doing the 4 required courses and haven’t got much time to do all labs and have skipped a few(just downloaded the material). One of the instructors mentions lab work is tracked and not to cheat. Is it really tracked as just by downloading we get the completed mark. I wanted to know the same before I mail for certification exam.
Also regarding certification, is the difficulty level of questions same as of quizzes in course and how much is exam focused on tasks given in lab exercises.

Thanks for helping us all out.

Hi Adi,

As far as I know, lab work is tracked when they check that you’ve saved the required reports in the lab Splunk environment they give you with each course. I don’t know any other method of tracking. You could just copy-paste the queries and save the reports and you’d be ok, although I don’t recommend this because you wouldn’t learn much.

The difficulty level yeah is kinda the same as the quizzes and I’d say is about 50% focused on the tasks given in lab exercises. There are plenty of questions about concepts and definitions and not so much about checking what a query is doing.

Good luck!

Hi Felipe,
I have cleared exam in my first attempt and got final acknowledgement (showing % for each module/domain), but I did not get certificate to my email, or I can’t see certificate/badge in https://splunkcommunities.force.com. Status is ‘In Progress’, I cleared this exam yesterday.
Is it normal that this certificate/badge is uploaded in some days? Will they also send email certificate afterwords?


Hi Felipe, is there a way to take the final exam without doing the courses, if i have good knowledge in Splunk with 2 years of hands on experience? Or its mandatory to take the course before take the online test?

Hi Dinesh,

I’m not sure. I was told by the Splunk Education team that you need to take the courses, at least the searching and reporting and the knowledge objects course. You should send them an email asking this 😉

Good luck!

Hi Felipe,

I am a new user and want to go for certification.

As you mentioned, the exam is free, but not the courses.
Could you please let me know the course fee for “Splunk Certified Power User” and how i need to pay that to avail the course.


Splunk has introduced new Splunk User and Power User Certification . I have Successfully given the User Certification yesterday and would be appearing for Power User Next . Any one has got idea about the difference in Level of Exam Questions ?

Ayush. I was about to take splunk user certification. can you please give me some tips about passing the test and how hard is splunk User Test.

Splunk User Exam is really a bit hard if you haven’t practiced it well . Questions will be Random on the Lab Sessions too. Please make sure you complete all the modules carefully after reading the Study Module .

Hi Felipe,

I would like to thank you. After following your post and information you provided here helped me to clear my SPLUNK Certified user certification. Wish me luck for Power User Certification.

Again thank you very much

Hello Felipe,

I passed the class and am ready to take the exam for Splunk Certified User (not Power).
For the exam, may I ask:
1) Are you notified as you go along whether or not you have answered a question correctly (like in the class test), or do you only find out results after answering all 50 questions?
2) During the test, do we actually have to use the Splunk environment and lab data files on our computer? For instance, to do a search or use a dashboard to return some result to answer a question?
Thank you

Hi Roberto,

Answering your questions:

1. No you’re not notified as you go along. You only know the results after answering all questions.
2. You don’t use the Splunk environment. It’s a multiple choice exam.

Good luck!

Hello Felipe,

Thank you very much for this post.

I have a question concerning the Power User certification. I completed the required courses and have the “attendance” certificates. I am planning on taking the exam very very soon.

My question is : Are there questions about the Infrastructure overview course as well for the test ?

Thanks in advance.

Wish me luck for the test.

Hi Sharat, yes there were many questions about infrastructure. More than I though there would be anyway. Prepare for that too!

Good luck!

Oh well ! Thanks Felipe!

The infrastructure part is the toughest in my view. There are no notes for that course.

Anyway thanks a lot for these tips 🙂

Hi Felipe,
Do you have any idea if it is possible to take Splunk power user certification exam without taking the Splunk fundamentals 2 course?

Hi Felipe,
Do you have any idea that if it is possible to take the exam without actually taking the fundamentals 2 courses?


I have completed splunk Fundamentals E-learning Course 1 and registered for certification exam.
Could you let me know the exam pattern for this?
1)No of questions,
3) Toughness of exam
4) Open exam (search from google or splunk hand book)


Hi Varun,

1. 50 questions
2. 60 minutes
3. That depends on how well you’re prepared
4. Yes you can search google or read the material from the required courses but since you only have a little more than 1 minute to answer each question, that won’t work in general.

Good luck!

Hi All,
Any one attended Power User certification exam recently. Would it be possible without taking the Splunk Fundamentals2 course because it is bit costly around more than $2500/- dollars.

I couldn’t clear the Fundamentals 1 exam. It has 45 questions, not 50. I will be attempting it again. Does anyone know if it will offer the same set of questions again or different one?

Just finished my Splunk 6.6 Fundamentals Part 1 online course with 90% score overall. Attempting to get to certification . Now in training for Splunk 6.6 Fundamentals Part 2. Is there any certification for Splunk 6.6 Fundamentals Part 2 while going for Splunk 6.6 Fundamentals Part 1 certification?

Splunk fundamentals 1 was quite a jiffy to clear. Although it took me 2 attempts to make it to the certification. I admit with many of you that the course they teach and the questions that they put will bounce you from the seat. They, most of the time, don’t match with the level.

But, during the evaluation, you need to achieve 75% of the correct answers. So, it is not a mandate to complete all the 45 questions in 60 minutes. But better make sure the number of questions answered, and the number of right answers given, should be atleast 75% correct ones. This way, you will get a few minutes under your pocket to scoop out the correct options for the displayed MCQ.

I am at the last day of my fundamentals 2 training. This time, the lab is limited till the last day of the training. Post completion of the training, in another 7 days, SPLUNK will share a link to go through the evaluation portal. Hope this doesn’t make me jump off the seat again!

Hope this helps you all.

Hey Felipe,

greetings from Hungary! I’ve kept your blog open on a browser tab for half a year while I was preparing for Certified User and Power User exams. I’ve checked the updates and comments frequently and today evening I said “It is time!”. Long story short from today I’m a Power User too 🙂
Even if we don’t celebrate Thanksgiving I’d like to say thank you for all your comments and advice. You’ve made real value with your attitude.

I wish you all the best!


Hi Felipe,

Its very difficult to get information of Splunk Certification via internet. Thank god I got your blog.

I have done with all the modules for Splunk User certification and applied for the final exam via mail.
But I have few queries below, if you answer them then it would be helpful for me.

1.) What would be the pattern for the final exam for user certification(how many questions and passing marks)?
2.) Can we get dumb questions for final exam of user certification? If yes then from where?
3.) The questions in the final exam will be similar to what they asked after each module and final quiz(after all modules) or they will be different?
4.) There is a lot of confusion in the retake policies for this exam as on splunk site it is mentioned that multiple attempts are allowed while during e-learning(modules) it was told that only one chance will be there to pass the exam. Could you please clarify this?

Kundan Singh Shekhawat

Hi Kundan,

I’ll try to answer your questions below:

1) When I took the exam it had 50 questions, but now it changed since now there are 2 certifications: User and Power User. I don’t know how many questions it has now.
2) I couldn’t find any dumb questions other than the ones in the courses.
3) They are similar but some of them are very specific. I think they are a little harder actually. It’s about the same topics you see in the courses but very specific.
4) There is more than 1 chance to retake the exam. Not sure how many but I had a colleage that failed the first attemt and passed the second. There are also some people here in the comments that have failed first and passed after that.

Good luck!

Thanks Felipe,

Your page is really helpful for splunkers.

I attempted it for first time but unfortunately I missed it with 63% of score.

Before going to second attempt I have some below queries.

1.) Whats is the end time limit(after 5 Days) of attempting it for second time?

2.) While giving Splunk User Certification exam for first time I found that nearly 15 questions are not from 14 modules(video,quiz and lab assignment) . I have already went through the all 14 modules 4 times each. So after failing in first attempt I am worried from where I should learn things to pass the exam. If you have any document then please refer it to me.


Hello Felipe Cerda, Just stumble upon your blog. Ive just failed my splunk user test with 69% result.. Its true like all you guys said the fundamental 1 quiz/question is more easier than the actual exam question. Gonna go thru all the topics again and focus on the ones that i slack on.

Hi Felipe,
For Splunk Fundamentals 2 which training option did you choose Instructor led training or instructor on demand? Which will be the best option?

Hi Nabendu,

I took the instructor led method because when I did it there was no other option. I think it’s the best because you have the trainer right there with you for the whole time so you can ask questions, while the instructor on demand only gives you a 20 minute session.


Hi Felipe,

I found your blogs very helpful. I passed my Certified User exam last Sunday and Certified Power User exam today (Sunday). The exam questions are definitely tricky and tough than the quizzes. For easy questions, it shouldn’t take more than 5 seconds to finish, so you’ll have plenty time to tackle the hard questions. I had about 10 minutes left for both exams.

Thanks a lot for all he messages and info… i read this before taking the certification and i am happy to say i am Splunk Certified Power User now… Started preparing for Admin now …:)

Are the questions different on the second attempt of the user exam?

How many chances do you get to take the power user exam?

any reference books or Video/audio material you refer to clear the power user certification.I am a Splunk certified user but doesn’t have Industry live setup experience on SPlunk

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.