Splunk Core Certified User exam-day guide
Splunk Core Certified User · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring one valid, unexpired photo ID. The name on it must match the name on your exam registration exactly; a mismatch can block you from testing. Confirm the specific accepted ID forms with the exam provider before test day.
Appointment confirmation
Have your exam appointment confirmation (email or screenshot) with the date, time, time zone, and your registration/confirmation number ready. You may be asked to reference it at check-in.
Run the delivery system test in advance
If you are testing online-proctored, run the vendor's system check on the same computer, webcam, microphone, and network you will use on exam day. Do this at least 24 hours early so there is time to fix problems.
A private, quiet, well-lit room
Choose a room with a closed door where you will not be interrupted. You will likely be asked to show the room on camera. Tell household members your exam window so nobody walks in.
Clear desk and clear surroundings
Remove notes, books, phones, smart watches, second monitors, and any paper from the desk and immediate area. Anything left in view may be treated as a conduct issue.
Stable internet and power
Use a reliable connection and keep your laptop plugged in. A dropped connection mid-exam is the most common avoidable failure mode.
Close everything else on the computer
Quit chat apps, email, browsers with other tabs, and anything that produces notifications. Silence your phone and put it out of reach.
Confirm the rules on scratch paper and breaks
Scratch paper, whiteboards, calculators, and break allowances vary by delivery method. Check the provider's candidate handbook rather than assuming; default to using nothing unless explicitly permitted.
Know the exam format before you sit down
The Splunk Core Certified User exam (SPLK-1001) is a timed multiple-choice exam of about 60 questions in 60 minutes, with a passing score of 70%. Plan roughly one minute per question so you finish with time to revisit anything you flagged.
Provider support contact
Keep the proctor/support phone number or chat link handy in case of a technical problem at check-in. If the exam fails to launch, contact support rather than repeatedly retrying.
Water in a clear container, if permitted
Some proctors allow a clear glass or bottle; others do not. Ask before the timer starts or simply go without.
Plan the day
Confirm your appointment date, time, and time zone, and read the provider's cancellation and reschedule policy so you know your deadline. Run the system test if you are testing remotely. Do your last substantial study block now on your two weakest areas (for most candidates: search fundamentals and the Search Processing Language, fields and field extraction, and reports/dashboards/alerts), then stop adding new material.
Switch to active recall: write out the main SPL commands you know and what each one does, and explain out loud how a search moves from the search head to results. Keep sessions to about an hour and take breaks. Do not start a brand-new topic.
Do a light review of a one-page cheat sheet only, no new practice exams. Lay out your ID, confirm the confirmation email, run the system test once more if remote, tidy the test room, charge devices, and set two alarms. Sleep on your normal schedule; a full night's sleep is worth more than one more hour of review.
Eat a normal meal and hydrate normally (not excessively). Avoid cramming. Set up your workspace 30 minutes early, close every other application, silence your phone, and have your ID and confirmation in reach.
Start the check-in process early, since identity verification and room scans can take time. Follow the proctor's instructions exactly, including any request to show your ID, your desk, or the room. Raise a hand or use the chat if anything is unclear before the timer starts.
Read each stem fully and watch for qualifiers such as 'which is NOT' or 'most likely'. Answer every question - an unanswered question is certainly wrong, while a reasoned guess has a chance. If the interface lets you flag and revisit, flag anything that takes more than about 90 seconds and come back at the end. Use leftover time to re-check flagged items, not to second-guess answers you already reasoned through.
Your provisional result is typically shown or emailed shortly after submission; confirm the exact reporting timeline with the provider. Save your score report. If you did not pass, note the score, check the retake waiting period, and rebuild your study plan around the domains the score report highlights.
Rules to check
Bring the ID required by the provider, and make sure the name matches your registration. If your ID name differs from your registration, fix it before test day - do not expect an exception at the desk.
No reference materials of any kind during the exam: no notes, books, phone, smart watch, or second screen. Treat the exam as closed-book even if you think something might be allowed.
If you are testing online-proctored, do not talk to yourself, read questions aloud, or leave the camera frame. Narrating your reasoning can be flagged as suspicious behavior.
Breaks: policies differ between test-center and online-proctored delivery, and the clock generally does not stop. Confirm the rule with the provider and plan to complete the exam in one sitting.
The exam is scored against a fixed passing standard (70% for SPLK-1001) on roughly 60 multiple-choice questions in 60 minutes. Expect no partial credit; correct answers must be selected outright.
Exam content is confidential under the provider's candidate agreement. Do not reproduce, discuss, or share actual exam questions afterward.
Retake rules, waiting periods, and fees are set by the provider and can change. Confirm the current policy on the official certification page before you book a second attempt.
If a technical failure interrupts your session, stop and contact proctor support immediately rather than troubleshooting alone; unreported interruptions are harder to resolve afterward.