Splunk Certification Moves to Cisco: What Exam Candidates Need to Know in 2026

New Splunk certification exam registrations have moved to Cisco’s Certification Tracking System as of October 20, 2026. If you already booked through Splunk’s previous system, Splunk says existing appointments will be honored through March 1, 2027. Active Splunk exam vouchers can still be used for Splunk exams booked through Cisco.

Cisco announced its agreement to acquire Splunk on September 21, 2023, valuing the deal at approximately $28 billion in equity. The acquisition closed on March 18, 2024, bringing Splunk’s security and observability products into Cisco’s portfolio. The October 2026 certification move is a later step in that integration, and it affects where candidates book exams, view their exam history, and get certification support.

Key Information for Splunk Certification Candidates

The transition primarily changes how candidates register, manage exam records, use certification support, and access their credentials. Candidates should continue preparing according to the current official blueprint for their selected certification.

Candidates who need to cancel or reschedule should manage their appointment through the appropriate certification account at least 48 hours before the scheduled exam. Missing this deadline may result in forfeiture of the exam fee.

What Splunk exam candidates need to do

Sources: Splunk Certification Transition FAQ and Splunk Training and Certification FAQs.

Splunk certification exam list for 2026

As of November 13, 2026, the Splunk certification portfolio includes the 14 exams listed below. Three certifications are currently classified as Legacy. Exam availability and registration information may change, so candidates should confirm the exact exam name and code in Cisco’s Certification Tracking System before purchasing or redeeming a voucher.

What Legacy status means for SPK-301, SPK-302, and SPK-203

Splunk moved these three credentials to its Legacy category on January 1, 2026. Splunk says candidates can still take the exams and share valid credentials they earn. The exam objectives and content are frozen, so newer product features may fall outside the published blueprint.

If your job specifically involves administering Splunk Enterprise Security, building SOAR playbooks, or maintaining ITSI, the corresponding Legacy blueprint can help you decide whether the exam fits your role. For candidates exploring a broader cybersecurity path, Splunk points to its Cybersecurity Defense Analyst and Cybersecurity Defense Engineer credentials. The Analyst track centers on monitoring and investigation, while the Engineer track emphasizes building and tuning detections, applying threat intelligence, and automating security workflows.

Legacy does not mean retired. These exams remain available and the credentials remain valid, but their objectives will no longer be updated with new product releases.

How to prepare for a Splunk certification exam after the move

1. Choose the credential that matches your work. Start with Core User or Power User if you mainly search and analyze data. Compare the Enterprise and Cloud Admin blueprints if you manage a deployment. For security work, choose based on whether you investigate alerts, build detections, or design security controls.

2. Open the official blueprint before choosing study materials. Search by the full certification name, compare the objectives with your materials, and use the exam code shown in Cisco’s system when booking.

3. Practice the tasks in the blueprint. For Power User, build a search and reuse its logic through a macro or another knowledge object. For Defense Engineer, tune a detection against sample data and check how the change affects false positives. For the Metrics User exam, practice sending metrics through an OpenTelemetry Collector and setting an alert on a meaningful threshold.

Frequently asked questions

Do I need to rebook my existing Splunk exam through Cisco?

If you booked through Splunk’s previous system and your appointment falls within the transition window, Splunk says it will be honored through March 1, 2027. Use your original confirmation to check the appointment and contact the Learn with Cisco Help Center if the booking details are missing or unclear.

Where do I register for a Splunk certification exam now?

Start from the official Splunk certification catalog and follow its login link to Cisco’s Certification Tracking System. New registrations have used Cisco’s system since October 20, 2026.

Can I still renew my Splunk certification through coursework?

Splunk removed coursework-based renewal on March 1, 2026. Its policy update lists two renewal routes: retake the same exam in the final year of your recertification window or earn a higher-level credential in the same track. Check your badge in Credly for your expiration date.