Splunk Certification Program Relaunch

Splunk Announcement

If you haven’t heard yet, there is a major re-work of Splunk Certifications. Splunk announced a major upgrade to their certification program. This announcement introduces seven new certifications:

  • Splunk Core Certified User
  • Splunk Core Certified Power User
  • Splunk Enterprise Certified Admin
  • Splunk Enterprise Certified Architect
  • Splunk Certified Developer
  • Splunk Enterprise Security Certified Admin*
  • Splunk IT Service Intelligence Certified Admin*

Notable Changes

All version 6.x certifications will NOT be grandfathered into the new program. So yes, you must re-take the certifications under version 7.x and pass the new exams. Splunk has detailed what this entails on their recertification page.

A post on reddit discloses one of the biggest changes to the certifications, and that they will be conducted closed book.




A Splunker who goes by shifty21 went into details on r/splunk as to what lead to this change. In summary, rampant cheating was taking place, thus devaluing the certifications we all (non-cheaters) worked so hard to obtain. I recommend reading shifty21’s post,  and if you feel it necessary use that platform to comment on it to express your concerns / ideas / requests.

What Does this mean for me?

Let’s walk through an example. I myself (Joe) am currently a certified architect in version 6.x. According to Splunk’s handy guide on the aforementioned re-certification page. I’m entitled to the following:

Source: https://www.splunk.com/en_us/training/recertification.html


So if you are in the same situation as I am, you’ll have to register, take, and pass the exam by October 1st 2019.

In-fact the only two certs that are not being recognized as current and eligible for a re-certification are the V5 Splunk Certified Architect, and the Splunk Certified Knowledge Manager.


If you have any of the following certificates Certified User / Power User / Admin,  V6.x Splunk Certified Architect, or Certified Architect II you need to adhear to the timeline below:

  • September 4th, 2018
    • All exam registrations will go through test partner and industry leader PearsonVue.
  • October 1st, 2018
    • Register for your exam
  • October 8th, 2018
    • Exams will be available onsite at Pearson Testing Centers.
    • Online exams will still be available and hosted by Pearson, but will be subject to online proctoring.
  • October 1st, 2019
    • Pass your exams before this date, or be subjected to the full certification path INCLUDING all prerequisite exams.
My Thoughts

I was upset at first, but after learning about the excessive amounts of cheating I feel it is necessary for Splunk to make a change. I’m not sure this is the right change, but time will tell.

I’m an advocate for open book testing as I don’t feel referencing personal notes or utilizing search engines is outside the realm of normal, in-fact NOT using readily available resources to tackle a problem IS outside of normal behavior. No proper system engineer would ever not want to use any available weapon in his or her arsenal when it comes to tackling a problem.

As I stated on reddit and elsewhere, I’ll suck it up and go get re-certified albeit complaining the whole way.


Add Comment

Required fields are marked *. Your email address will not be published.