Splunk Core Certified Power User 2026: The SOC Analyst's Must-Have Cert

Cisco acquired Splunk. The certifications stayed.

Cisco completed its $28 billion acquisition of Splunk in March 2024 — the largest acquisition in Cisco’s history and a clear signal of how central SIEM and security operations data platforms have become to enterprise security architecture. The acquisition raised immediate questions for Splunk certification holders and candidates: would the SPLK-* exam codes survive, would Splunk become absorbed into Cisco’s DevNet and CertPro certification tracks, and would existing credentials become obsolete?

The answer in 2026 is: the Splunk certification programme has been maintained largely intact under the Cisco umbrella. The SPLK-1001 (Core Certified User), SPLK-1002 (Core Certified Power User), SPLK-1003 (Core Certified Advanced Power User), SPLK-2001 (Enterprise Certified Admin), and the specialist ES and ITSI certifications all remain valid and continue to be delivered via Pearson VUE using the original exam codes. Cisco has begun integrating Splunk expertise into its broader security certification narrative — Cisco’s Certified CyberOps Associate and Professional tracks now reference Splunk as the dominant SIEM platform in enterprise environments — but the Splunk-branded certifications are not being retired. For hiring managers in 2026, “Splunk Power User” and “SPLK-1002” are still the language used in security operations job postings, not “Cisco Certified Splunk Practitioner.”

What the Cisco acquisition has changed is distribution and training availability. Cisco Learning & Certifications now co-promotes Splunk training alongside its own Security certifications, and Cisco Learning Credits (CLCs) can be applied toward Splunk training purchases through authorised training partners. For organisations that already have Cisco enterprise agreements with training budget, this means Splunk preparation courses are more accessible than before the acquisition — a practical benefit for IT teams with Cisco-dominant infrastructure who want to upskill on Splunk without a separate purchasing relationship.

What SPLK-1002 actually tests

The Power User exam sits one level above the Core Certified User (SPLK-1001) in Splunk’s certification hierarchy. Where the User exam tests basic search, navigation, and simple SPL commands, the Power User exam tests applied SPL proficiency — the ability to construct searches that answer real operational questions from log data, not just retrieve events. The official exam blueprint organises content into five primary domains.

Exam format: 57 questions, 60 minutes, Pearson VUE

The SPLK-1002 exam is a fixed-format, proctored assessment delivered exclusively through Pearson VUE — either at an authorised test centre or via online remote proctoring. The exam consists of 57 questions, a mix of single-answer multiple choice and multiple-response questions (where two or more answers must be selected). The pass mark is a scaled score of 700 out of 1000. Splunk uses scaled scoring, meaning the raw number of correct answers required to achieve 700 varies slightly between exam form versions based on statistical calibration — candidates should assume a pass threshold of approximately 70–72% of questions correct.

The exam registration fee is $130 USD. Vouchers purchased through Splunk’s authorised training partner network sometimes include an exam attempt or a discount voucher. Retake policy: there is a 14-day wait period before a failed candidate may reattempt. No limit on the total number of attempts. Results are available immediately upon submission of the exam.

The most common SPLK-1002 failure pattern is over-confidence in SPL syntax recall and under-investment in knowledge object configuration scenarios. Candidates who use Splunk daily for searching and investigation often score well on Domain 3 (transforming commands) but underperform on Domains 2 and 4 because they have never actually configured a lookup definition, a calculated field, or an alert suppression window — those tasks fall to admins or senior engineers in many SOC environments. Hands-on lab time configuring knowledge objects in a Splunk environment is the highest-value preparation activity for Power User candidates with search-but-not-admin experience.

Splunk Power User in the job market: what it signals in 2026

Splunk holds approximately 30% of the global SIEM market by revenue, with particular dominance in large enterprise and government security operations centre (SOC) environments. Despite competition from Microsoft Sentinel, IBM QRadar, and newer cloud-native SIEM platforms, Splunk remains the default SIEM platform at Fortune 500 companies, financial services firms, and federal agencies — environments where IT security professionals are most likely to encounter it in their daily work. The Power User certification is the credential that distinguishes analysts who can use Splunk from analysts who can build with Splunk.

• SOC Analyst (Tier 2 and above): tier 1 SOC analysts triage alerts; tier 2 analysts investigate them and build the searches and dashboards that make tier 1 triage more effective. The Power User cert is the primary signal that a candidate has the SPL depth to build detection logic, tune alert thresholds, and design investigation workflows rather than simply consuming output that someone else built. In job postings for tier 2 SOC Analyst and Threat Analyst roles at organisations with Splunk deployments, SPLK-1002 appears as a preferred or required qualification at approximately 40% of listed positions.
• Security Engineer: security engineers who build and maintain Splunk infrastructure — writing correlation searches for Splunk Enterprise Security (ES), onboarding new data sources, maintaining CIM compliance across sourcetypes — are expected to hold Power User certification as a baseline, with SPLK-2001 (Enterprise Certified Admin) as the next credential in the progression path. Salary data for Security Engineers with Splunk Power User certification in the US ranges from $95,000 to $135,000 annually in 2026, reflecting the combination of security domain knowledge and platform-specific technical depth the role requires.
• IT Operations Engineer: Splunk’s use case extends beyond security — IT operations teams use it for infrastructure monitoring, application performance observability, and incident response dashboards. Power User certification in an IT ops context signals the ability to build the operational dashboards and scheduled reports that make Splunk the “single pane of glass” infrastructure teams depend on. IT Operations Engineers and SREs with Splunk Power User certification earn $90,000–$125,000 annually in the US.
• Complement to security certifications: SPLK-1002 is increasingly paired with CompTIA CySA+ (CS0-003), which covers the broader threat detection and incident response methodology, and with Splunk Enterprise Security Certified Admin for practitioners in pure Splunk ES environments. For candidates pursuing a CISSP or CISM track, Power User signals platform-level technical competence that complements the policy-and-management focus of those exams. The combination of CySA+ and Splunk Power User effectively covers both the “why” (threat detection methodology) and the “how” (SPL implementation) of security operations analytics work.

The Splunk certification ladder: where Power User fits

Splunk’s certification programme has three practitioner tracks (Core, Enterprise Admin, and Enterprise Architect) and two specialist tracks (Enterprise Security and ITSI). Power User sits at the intermediate level of the Core track, between the entry-level User cert and the advanced-level Core Certified Advanced Power User.

SPLK-1001 (Core Certified User) is the entry level: basic searching, using the Search app, saving searches, and building simple dashboards. Candidates with any hands-on Splunk exposure typically find SPLK-1001 straightforward. It is the recommended but unenforced prerequisite for Power User.

SPLK-1002 (Core Certified Power User) — this exam — tests applied SPL, knowledge objects, and dashboard construction. It is the credential that most SOC and IT ops job descriptions reference when they specify Splunk experience. For the majority of Splunk-using practitioners who are not platform administrators, Power User is the target destination rather than a stepping stone.

SPLK-1003 (Core Certified Advanced Power User) tests advanced SPL topics: subsearches, tstats for accelerated data model queries, the Common Information Model (CIM), data model acceleration, and advanced dashboard design patterns. It is the natural next step for Power Users who need to work directly with CIM-compliant data models or build highly optimised searches against large data volumes. In Enterprise Security deployments, SPLK-1003 is increasingly expected of the engineers who maintain and tune ES correlation searches.

SPLK-2001 (Enterprise Certified Admin) covers the platform administration layer: index management, forwarder configuration, deployment server, user role management, and distributed search architecture. It is a separate track from Core and targets system administrators rather than analysts or engineers. Many organisations expect their Splunk administrators to hold both Power User and Admin certifications, since effective administration requires understanding how users and their knowledge objects interact with the platform configuration.

Preparing for SPLK-1002: what works

Splunk offers an official preparation course, “Splunk Power User,” as a two-day instructor-led training (ILT) or a self-paced e-learning option through the Splunk Education portal. The course covers all five exam domains with hands-on lab exercises in a Splunk lab environment. For candidates without prior SPL experience, the official course is the fastest path to exam readiness because the lab exercises build the hands-on knowledge object configuration experience that the exam tests heavily.

For candidates with existing Splunk search experience but limited knowledge object configuration exposure — the most common profile of a tier 2 SOC analyst — the most efficient preparation strategy is targeted lab work on the specific knowledge object types covered in Domain 2 and Domain 4. Splunk provides a free 60-day trial of Splunk Enterprise with sample data sets, and the Splunk Boss of the SOC (BOTS) dataset (a realistic simulated incident investigation dataset) is freely available for download and provides excellent scenario-based practice for the real-world search scenarios the exam mirrors.

Splunk’s free online training portal (Splunk Education) includes the “Introduction to Splunk” and “Using Fields” courses that directly cover SPLK-1001 and early SPLK-1002 domain material. The paid Power User course ($500 USD for e-learning) adds knowledge objects, scheduled searches, and dashboard configuration labs. Third-party practice exam providers offer question banks for SPLK-1002 that are reasonably representative of the exam’s scenario-based question style.