Splunk Enterprise Certified Admin exam-day guide
Splunk Enterprise Certified Admin · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring a valid, unexpired government-issued photo ID (e.g., passport or driver's license). The name must match your exam registration exactly. Confirm accepted ID types and whether a second ID is required with the exam provider (needs_review: verify with provider).
Appointment confirmation
Have your appointment confirmation number, exam name, date, time, and time zone accessible, either printed or on your phone before check-in (phones are stowed once the exam starts).
Splunk account / certification record access
Know the email address tied to your Splunk account and certification profile, so your score can be matched to your record. Log in the day before to confirm access works.
Delivery-mode preparation (test center)
If testing at a center, confirm the address, parking/transit plan, and arrive 15–30 minutes before your slot. Confirm the center's check-in window with the provider (needs_review: verify with provider).
Delivery-mode preparation (online proctored)
If testing online, run the provider's system test on the exact computer, webcam, and network you will use at least 24 hours ahead. Confirm supported browsers, plugin requirements, and room-scan rules with the provider (needs_review: verify with provider).
Private, compliant testing space
For online proctoring: a quiet, closed room, clear desk, no second monitor, no notes or papers unless explicitly allowed, and a working webcam, microphone, and stable connection. Confirm whether a physical whiteboard or scratch paper is permitted (needs_review: verify with provider).
Exam blueprint review (done beforehand, not on exam day)
Review the published exam topic areas in advance, e.g., Splunk architecture and distributed components, license management, index and bucket management, forwarder management, data input and parsing, user/role and authentication management, deployment apps and configuration management, and monitoring console usage. No reference material is available during the exam.
Time-management plan
Plan roughly 1.5 minutes per question for a ~60-question, ~90-minute exam. Confirm the current question count and time limit on the official certification page before test day (needs_review: verify with provider).
Know the flag-and-return workflow
Familiarize yourself in advance with how the exam software lets you mark questions for review and navigate back, so you do not lose time learning the interface mid-exam.
Personal logistics
Eat, hydrate, and use the restroom before check-in. Assume you cannot leave the room or pause the clock once the exam begins unless the provider's policy says otherwise (needs_review: verify with provider).
Technical fallback contacts
Have the provider's support phone number and the proctor chat route saved in case of a disconnection or software failure during an online-proctored session.
Rest and schedule alignment
Sleep normally the night before and, if possible, schedule practice sessions at the same time of day as your real appointment to align alertness.
Plan the day
Confirm the appointment date, time, time zone, and delivery mode. Run the online-system test if applicable and confirm the test-center address if not. Re-read the official exam blueprint and list your three weakest domains. Spend remaining study time on those domains plus hands-on practice in your own Splunk lab: managing indexes and retention, configuring inputs and props.conf/transforms.conf, deploying apps via the deployment server, managing licenses and distributed components, and using the monitoring console.
Do light review only of high-yield areas: license types and warnings, index/bucket lifecycle and retention, forwarder types and outputs.conf, deployment server vs. cluster manager roles, roles and capabilities, and common troubleshooting commands (btool, splunk diag, splunk list). Pack your ID and appointment details. Charge devices. Get a full night's sleep. Do not try to learn new material.
Eat a normal meal, hydrate, and use the restroom before check-in. Do a short skim of your own summary notes only - no deep problem-solving. Arrive at the test center 15–30 minutes early, or start the online check-in well before your slot per the provider's instructions. Silence and stow your phone, watch, and any other prohibited items.
Accept the confidentiality agreement, then read each question completely, watching for 'choose all that apply' and multi-part scenarios. Answer the questions you know first, flag uncertain ones, and return to them. Use the final 10–15 minutes to re-read flagged items and verify you have answered every question before submitting.
Note your score report details and keep a copy. If you did not pass, confirm the retake waiting period and fee policy with the provider before scheduling (needs_review: verify with provider).
Rules to check
Present valid, unexpired government-issued photo ID whose name matches your registration exactly; confirm the specific ID requirements with the exam provider before test day (needs_review: verify with provider).
No unauthorized materials are allowed in the testing environment - notes, books, phones, smart watches, second monitors, or other devices. Follow the provider's prohibited-items list to the letter.
Accept the exam confidentiality/non-disclosure agreement before starting; do not record, reproduce, or discuss specific exam questions afterward.
Breaks: assume no scheduled breaks and that the timer keeps running regardless. Confirm the provider's break policy in advance, since leaving the room during an online-proctored session may end the exam (needs_review: verify with provider).
Scoring: the exam is scored against a passing standard set by the certifying body, and results are typically reported on your score report at the end of the session. Confirm the current passing score and question count on the official certification page rather than relying on secondhand sources (needs_review: verify with provider).
Arrival and lateness: arriving after the check-in window may result in forfeiture of your seat and fee. Confirm the exact late-arrival rule with the provider (needs_review: verify with provider).
Retakes: a waiting period and additional fee usually apply between attempts. Confirm the current retake policy with the provider before you need it (needs_review: verify with provider).
If a technical failure occurs during an online-proctored exam, stop and contact the proctor immediately via the provided chat or support channel instead of troubleshooting on your own.