Splunk offers fourteen certifications, and security practitioners get the most from them by choosing a clear route from Core Certified User through Power User to the Cybersecurity Defense Analyst and Engineer exams. This guide sets out what Splunk publishes about the security-relevant certifications: who each is for, exam length, question counts and fees, the Cybersecurity Defense Analyst and Engineer blueprints with their weightings, prerequisites, how to prepare, the three-year recertification cycle and retake waiting periods, and where each credential fits in a SOC career. It is written for SOC analysts, detection engineers and Splunk administrators, and the managers who plan their development. Exam facts were checked on Splunk's certification pages, test blueprints and candidate handbook in November 2026; confirm them with Splunk before you register.
This is an independent guide from NHI Mgmt Group, based on Splunk's public certification documentation as of November 2026. It is not sponsored or reviewed by Splunk. Exam details change, so confirm them against Splunk's current documentation.
Key takeaways
- A clear security route. Core Certified User, then Core Certified Power User, then Cybersecurity Defense Analyst, then Cybersecurity Defense Engineer, with Enterprise Certified Admin for those who also run the platform.
- Consistent, modest fees. Each exam page checked lists $130 USD per attempt, delivered by Pearson VUE at a test centre or online, with registration through Cisco's certification tracking system.
- The Analyst exam is broad, the Engineer exam is detection-heavy. The Defense Analyst blueprint spreads across six domains; 40% of the Defense Engineer blueprint is detection engineering.
- Three-year cycle with a 90-day grace period. Recertify by passing a higher-level exam or retaking your current exam in the final year of the window.
- Know the retake waits. The candidate handbook sets 7 days after a first fail and 14 after a second, rising to 28 and then 56 days for later attempts.
Who the certification is for
Splunk's certification page groups its credentials by product and skill. The table lists the ones most relevant to security work, with Splunk's own summary of the skills each covers. Certifications are listed in the order a security practitioner would usually take them.
| Certification | Skills Splunk lists | Typical holder |
|---|---|---|
| Core Certified User | Searches, fields and lookups, basic alerts, reports and dashboards | New SOC analysts, IT staff starting with Splunk |
| Core Certified Power User | SPL commands, knowledge objects, workflow actions, data models, field aliases, calculated fields, macros, data normalisation | Analysts who write their own searches and content |
| Core Certified Advanced Power User | Complex searches and reports, advanced knowledge object use cases, dashboard best practice | Senior analysts and content developers |
| Enterprise Certified Admin / Cloud Certified Admin | Platform management, licences, indexers and search heads, configuration, data inputs and forwarders, users | Splunk administrators and SIEM engineers |
| Cybersecurity Defense Analyst | Threat detection and analysis, continual monitoring, risk mitigation and vulnerability management | SOC analysts working in Enterprise Security |
| Cybersecurity Defense Engineer | Creating and tuning detections, threat intelligence, automation and orchestration for SOPs | Detection engineers and SOAR developers |
| Cybersecurity Defense Architect | Security defence control design, data-driven architectures, governance-based risk measurement | Security architects and SOC leads |
Splunk marks the Enterprise Security Certified Admin and SOAR Certified Automation Developer certifications as Legacy on its certification page, so new security candidates should plan around the Cybersecurity Defense series. For career context see the SOC Analyst Career Guide and the Detection Engineer Career Guide.
Exam format and domains
Exam facts by certification
| Exam | Level | Length | Questions | Prerequisite | Fee |
|---|---|---|---|---|---|
| Core Certified User | Entry | 60 minutes | 60 multiple choice | None | $130 per attempt |
| Core Certified Power User | Entry | 60 minutes | 65 multiple choice | None | $130 per attempt |
| Enterprise Certified Admin | Professional | 60 minutes | 56 multiple choice | Core Certified Power User | $130 per attempt |
| Cybersecurity Defense Analyst | Intermediate | 75 minutes, including 3 minutes for the exam agreement | 66 multiple choice | None (Power User level knowledge recommended) | $130 per attempt |
| Cybersecurity Defense Engineer | Professional | 75 minutes | 60 multiple choice | None | $130 per attempt |
All five are delivered by Pearson VUE. Splunk does not publish a passing score; the handbook says pass or fail is shown straight after submission and failing candidates see section-level feedback in their Pearson account.
Cybersecurity Defense Analyst blueprint
| Domain | Weight | What it covers |
|---|---|---|
| 1. The Cyber Landscape, Frameworks, and Standards | 10% | SOC roles (Analyst, Engineer, Architect), common controls, standards and frameworks, CIA and basic risk management |
| 2. Threat and Attack Types, Motivations, and Tactics | 20% | Attack types and vectors, key terms such as account takeover and C2, threat intelligence tiers, Enterprise Security annotations, TTPs |
| 3. Defenses, Data Sources, and SIEM Best Practices | 20% | Defence systems and data sources, CIM, data models and acceleration, the Asset and Identity framework, assessing data sources with Splunk Security Essentials |
| 4. Investigation, Event Handling, Correlation, and Risk | 20% | Five stages of investigation, MTTR and dwell time, dispositions, notable and risk notable events, built-in dashboards, Risk Based Alerting and correlation searches |
| 5. SPL and Efficient Searching | 20% | tstats, transaction, first and last, rex, eval, foreach, lookup, makeresults; efficient search practice; SPL resources in ES, Security Essentials and Splunk Lantern |
| 6. Threat Hunting and Remediation | 10% | Hunting techniques, long tail and outlier analysis, hypothesis hunting, adaptive response actions, triggering SOAR playbooks |
Cybersecurity Defense Engineer blueprint
| Domain | Weight | What it covers |
|---|---|---|
| 1. Data Engineering | 10% | Data review and analysis, performant indexing, Splunk normalisation methods |
| 2. Detection Engineering | 40% | Creating and tuning correlation searches, adding context, risk-based modifiers and detections, notable events and findings, detection lifecycle |
| 3. Building Effective Security Processes and Programs | 20% | Threat intelligence research, risk and detection prioritisation, documentation and SOPs |
| 4. Automation and Efficiency | 20% | Orchestration of SOPs, case management, REST APIs, SOAR playbook responses, Enterprise Security and SOAR integration |
| 5. Auditing and Reporting on Security Programs | 10% | Security metrics, reports and programme analytics dashboards |
How the security exams map to frameworks
| Blueprint area | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Data sources, CIM and normalisation | PR.PS-04 | AU-6 Audit Record Review, Analysis, and Reporting |
| Correlation searches and detection engineering | DE.CM-01; DE.AE-02 | SI-4 System Monitoring |
| Threat intelligence tiers and TTPs | ID.RA-02; DE.AE-07 | RA-10 Threat Hunting |
| Investigation and event handling | RS.AN-03 | IR-4 Incident Handling |
| Asset and Identity framework | PR.AA-01 | IA-5 Authenticator Management |
The Asset and Identity framework deserves attention from identity teams: the quality of identity data in Enterprise Security decides whether a risk notable points at a person, a service account or nobody. Keeping service accounts and other non-human identities in those lookups with owners is a direct identity contribution to SOC quality.
Prerequisites and experience
- Formal prerequisites: only the Enterprise Certified Admin page among those checked lists one, Core Certified Power User. The Analyst and Engineer exams list none.
- Recommended knowledge: the Defense Analyst blueprint recommends Power User level knowledge of Splunk Enterprise. The Analyst page also recommends Boss of the SOC (BOTS), the SOC administrator learning path and Enterprise Security admin knowledge.
- Accounts: register through the Cisco certification portal and keep a Splunk.com account linked to a current email address.
- Identification: a valid photo ID and a second form of identification showing your legal name, which must match your registration.
- Online testing: pass the Pearson system test on the same computer and location you will use, with administrative rights to install the software. The handbook warns that a refund is unlikely if your system fails after the 48-hour cancellation window.
Preparation plan
- Pick the target and download the blueprint: each exam page links a test blueprint. Turn every sub-topic into a line in a tracker.
- Build SPL fluency first (Core User and Power User): practise searches, fields, lookups, knowledge objects, data models, macros and normalisation until they are routine. The Splunk SPL for Threat Hunting Guide shows the security patterns.
- Learn Enterprise Security concepts (Analyst): the CIM, data model acceleration, Asset and Identity framework, notable and risk notable events, built-in dashboards and Risk Based Alerting. The Splunk Enterprise Security Guide covers the product in depth.
- Practise investigations: work Boss of the SOC datasets, assign dispositions and measure your own time to resolve.
- Move to detection engineering (Engineer): write and tune correlation searches, add risk modifiers, document SOPs and automate a response with a SOAR playbook through the REST API.
- Review and book: close gaps against the blueprint, run the Pearson system test and register through the Cisco portal.
Measuring readiness
- Blueprint coverage: share of sub-topics practised hands-on.
- Search efficiency: you can rewrite a slow raw search with tstats against an accelerated data model.
- Investigation time: median time to disposition a BOTS-style scenario.
- Detection quality: correlation searches you wrote that fire on test data with an acceptable false positive rate.
Common failure patterns
- Jumping to the Analyst exam without SPL: a fifth of the blueprint is SPL and efficient searching.
- Studying Enterprise Security screens, not concepts: the blueprints test CIM, risk and correlation ideas, not menu paths.
- Treating the Engineer exam as more analysis: 40% is detection engineering and a further 20% is automation.
- Letting the cycle lapse: Splunk does not grant extensions after the 90-day grace period.
- Online test set-up left to the day: run the system test early on the exact machine.
Cost, renewal and continuing education
| Item | What Splunk states |
|---|---|
| Fee | $130 USD per attempt on each exam page checked |
| Cycle | Three years, starting when you earn your highest-level certification; expiry shown on Credly |
| Grace period | 90 days after the cycle ends, then certifications become inactive |
| Recertify by stepping up | Pass a higher-level exam on an eligible path; downstream certifications renew and the new expiry is three years from the pass date |
| Recertify by retaking | Pass your current exam within the final year of the window; a new three-year cycle starts on the pass date |
| Retake waits | 7 days after the first fail; 14 days after the second; 28 days before a fourth attempt; 56 days before the fifth and sixth; later attempts reviewed case by case |
| Extensions | Not granted |
Splunk's certification page also mentions additional certifications and continuing education courses as ways to stay current. If you hold credentials with CPE schemes, Splunk study often counts there too; see the Certification Renewal and CPE Requirements Guide.
Where it fits on the career path
- Tier 1 SOC analyst: Core Certified User, then Power User, gives the search skills to triage confidently.
- Tier 2 analyst or threat hunter: Cybersecurity Defense Analyst shows you understand Enterprise Security, risk-based alerting and investigation method. Pair it with the tool-neutral Threat Hunting Guide.
- Detection engineer: Cybersecurity Defense Engineer recognises detection lifecycle, automation and programme reporting skills. The Detection Engineering Guide gives the vendor-neutral method.
- SIEM platform owner: Enterprise Certified Admin or Cloud Certified Admin, with the Splunk Universal Forwarder and Deployment Server Hardening Guide for securing the platform itself.
- Architect: Cybersecurity Defense Architect for those designing controls and measuring programme risk.
Practitioner checklist
- Choose your target certification and download its test blueprint from Splunk's exam page.
- Create your Cisco certification portal account and link a current Splunk.com email.
- Reach Power User level SPL before attempting the Defense Analyst exam.
- Practise CIM, data models, Asset and Identity lookups and Risk Based Alerting in a lab.
- Work at least one Boss of the SOC dataset end to end.
- For the Engineer exam, build, tune and document a correlation search and a SOAR playbook.
- Run the Pearson system test on the exam machine well before the 48-hour window.
- Check that your photo ID and second ID match your registered legal name.
- Note your Credly expiry date and plan a step-up or retake in the final year.
Standards and references
- Splunk: Certification overview
- Splunk: Certified Cybersecurity Defense Analyst
- Splunk: Cybersecurity Defense Analyst test blueprint
- Splunk: Certified Cybersecurity Defense Engineer
- Splunk: Cybersecurity Defense Engineer test blueprint
- Splunk: Core Certified User
- Splunk: Core Certified Power User
- Splunk: Certification candidate handbook
Related NHI Mgmt Group resources: Splunk Enterprise Security Guide · Splunk SPL for Threat Hunting Guide · SOC Analyst Career Guide · Detection Engineer Career Guide · SIEM Guide