Splunk · 2026 Edition
A complete preparation guide written by Splunk-certified engineers. Covers the exam format,all 4 blueprint domains, a week-by-week study plan, and proven tips for passing first time.
4–8 weeks
Prep time
Intermediate
Difficulty
65
Exam questions
700/1000
Pass mark
Exam code
SPLK-1003
Full name
Splunk Core Certified Power User
Vendor
Splunk
Duration
60 minutes
Questions
65 items
Passing score
700/1000 (scaled)
Domains covered
4 blueprint domains
Recommended experience
Splunk Core Certified User or equivalent Splunk experience; familiarity with basic SPL
Typical prep time
4–8 weeks
Splunk Core Certified Power User validates the ability to create knowledge objects, write advanced SPL, build field extractions, and create sophisticated reports and dashboards. It is the credential expected for Splunk developers and senior SOC analysts.
Job roles this opens
Domain percentage weights are not currently available for this exam. The checklist below is still useful for planning your study.
Weeks 1–2
Creating Knowledge Objects: field extractions, lookups, tags, event types, workflow actions
Tip: Field extractions are tested in depth on SPLK-1003. Know how to create a rex command extraction (inline: | rex field=_raw '(?P<fieldname>pattern)') and a field extraction in the Settings menu (uses the same regex but runs at search time on every event). Know the difference between a TRANSFORMS-type extraction (runs at index time) and a REPORT-type extraction (runs at search time).
Weeks 3–4
Advanced SPL: conditional statements, statistical functions, event correlation, subsearches
Tip: The eval command with if/case functions is heavily tested. Know: eval status=if(code=200,'OK','Error'), eval category=case(score>=90,'A',score>=80,'B',score>=70,'C',1=1,'F'). The subsearch with [search ...] allows the output of one search to be fed as filter criteria to a parent search.
Weeks 5–6
Lookups: CSV lookups, geospatial lookups, lookup transforms, automatic lookups
Tip: Know the difference between a lookup table file (the CSV), a lookup definition (the Settings configuration linking the file to field names), and an automatic lookup (runs the lookup automatically on every search without requiring a lookup command). Know how to use the inputlookup command to query a lookup file directly.
Weeks 7–8
Alerts and Advanced Dashboards: scheduled alerts, webhook actions, dynamic drilldowns, tokens
Tip: Dashboard tokens in Splunk XML allow dynamic filtering. Know that $form.fieldname$ represents a form input, $click.value$ represents a value clicked in a visualisation, and these tokens are referenced in search queries with $tokenname$ syntax. Dynamic drilldowns use tokens to pass context from a chart click to a new search.
SPLK-1003 exam: 63 questions, 60 minutes, 70% passing score. The jump from User to Power User is significant — Power User tests creating knowledge objects and writing non-trivial SPL, not just using built-in commands.
The transaction command is tested on SPLK-1003. Know that transaction groups events together based on a common field (groupby) and optionally a start/end event (startswith, endswith). Know the difference between transaction and stats — stats is always preferred for performance; use transaction only when you need to preserve the original events in the result.
Geospatial lookups and the iplocation command are Power User topics. Know that iplocation appends geographic information (city, country, latitude, longitude) to IP address fields, and that the Choropleth map visualisation requires geospatial data to render country or region shading.
Macros are reusable SPL expressions defined in Settings. Know how to define a macro (name, definition, optional arguments), call a macro in a search (`macroname` for no-argument, `macroname(arg1,arg2)` for macros with arguments), and why macros are useful for encapsulating complex SPL that is reused across multiple searches.
SPLK-1003 is valid for 3 years. Splunk recommends following it with Splunk Enterprise Certified Admin (SPLK-1004), which covers Splunk installation, configuration, and data management at the administrator level.
Apply everything in this guide with adaptive practice questions, detailed answer explanations, and domain analytics.
Deep-dive explanations of the key topics tested on SPLK-1003 — with exam key points and common misconceptions.