SPLK-1002 practice examsIn development
Splunk Core Certified Power User
The search language beyond the basics: transforming commands and result formatting, correlating events and extracting fields, the knowledge objects that normalise data, macros and workflow actions, and data models with the Common Information Model.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Transforming commands and formatting results | 15% |
| Correlating events and creating fields | 25% |
| Field aliases, calculated fields, tags and event types | 20% |
| Macros and workflow actions | 20% |
| Data models and the Common Information Model | 20% |
Two sample questions
1. Why are macros useful in a team that shares many similar searches?
- The shared logic lives in one editable place — correct
- The searches then run on a faster schedule
- The searches gain access to more indexes
- The macro results are cached between users
Why: Fixing the definition once fixes every search that calls it.
2. What does the field extractor use to pull fields?
- A workflow action
- A saved macro
- Regex or delimiters — correct
- An accelerated model
Why: The field extractor builds regex or delimiter-based extractions.
The real SPLK-1002 exam
| Length | 57 minutes |
|---|---|
| Questions | 65 |
| Pass mark | Not published by Splunk |
| Price | $130 USD per attempt; there is no free retake |
| Recommended before you sit it | None mandatory. The core certified user exam is recommended first. |
| Valid for | 3 years |
Exam facts as published by Splunk; always check the vendor’s page before you book.
Study SPLK-1002 with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.