Splunk Core Certified Power User (SPLK-1002) Practice Exam

What the Splunk Core Certified Power User (SPLK-1002) exam covers

• Search and Transforming Commands146 questions
• Filtering, Formatting, and Correlating Events146 questions
• Fields, Lookups, and Knowledge Objects146 questions
• Tags, Event Types, Macros, and Workflow Actions146 questions
• Data Models, CIM, and Reporting145 questions

Free Splunk Core Certified Power User (SPLK-1002) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 729.

1. Question 1Search and Transforming Commands

   A Power User runs: index=web sourcetype=access_combined status=500 | stats count by host. What role does the pipe (|) character play in this SPL?

   • ASends the left results as input to the command on the rightCorrect
   • BMerges two indexes into a single dataset before the filter runs
   • CForces the search to run on every indexer at the same time
   • DEscapes the status field so 500 is treated as literal text
   ✓ Correct answer: A

   The pipe character is the core mechanic of the SPL pipeline: everything to its left produces a set of events or results, and everything to its right acts on that output as its input. Here the raw status=500 events are streamed into stats, which then counts them per host. No merging, distribution, or escaping occurs.

   Why the other options are wrong

   • BThe pipe does not combine indexes; only one index is targeted before the first pipe here.
   • CSearch distribution across indexers happens automatically and is unrelated to the pipe symbol.
   • DEscaping literal characters uses quotes or backslashes, not the pipe character.
2. Question 2Search and Transforming Commands

   A search runs top showperc=false uri. What is missing from the output compared to running top uri with default settings?

   • AThe percent column is not includedCorrect
   • BThe count column is not included
   • CThe uri field itself is not included
   • DThe results are not sorted by frequency
   ✓ Correct answer: A

   showperc controls only whether the automatically generated percent column is included; setting it to false removes that column while count, the uri field, and the default frequency-based sort order are all unaffected. The results are still ranked from most to least frequent, and count is still present unless countfield or another option changes that.

   Why the other options are wrong

   • Bcount is unrelated to showperc, it still appears in the output by default.
   • CThe ranked field itself, uri, is always kept in the output regardless of showperc.
   • Dtop still sorts by frequency by default, showperc does not change the sort order.
3. Question 3Filtering, Formatting, and Correlating Events

   In the search command, two field=value expressions separated only by whitespace are combined with an implicit AND. If the same filter is written with the where command using two comparisons separated only by whitespace and no explicit boolean operator, what happens?

   • Awhere ignores the second comparison and evaluates only the first
   • Bwhere treats it the same and implicitly ANDs the comparisons
   • Cwhere implicitly ORs the comparisons instead of ANDing them
   • Dwhere raises a search error, since it needs an explicit operatorCorrect
   ✓ Correct answer: D

   The where command parses its argument as a single eval boolean expression, which has no rule that treats adjacent terms separated only by whitespace as an implied AND. The search command has that convenience built into its own keyword grammar, but carrying the same habit into where produces a syntax error unless AND, OR, or NOT is written explicitly.

   Why the other options are wrong

   • Awhere does not silently drop part of the expression; an incomplete boolean expression causes a search error instead of being ignored.
   • Bthis describes how the search command behaves, not where; the where command requires an explicit boolean operator such as AND between comparisons.
   • Cwhere does not implicitly OR bare comparisons either; omitting the operator produces a search error rather than silently choosing OR.
4. Question 4Filtering, Formatting, and Correlating EventsSelect all that apply

   A field discount_code may be absent from some events. Which two eval expressions correctly create has_discount set to "yes" only when discount_code actually has a value? (Select two.)

   • Aeval has_discount=if(isnotnull(discount_code), "yes", "no")Correct
   • Beval has_discount=if(isnull(discount_code), "no", "yes")Correct
   • Ceval has_discount=if(NOT isnotnull(discount_code), "yes", "no")
   • Deval has_discount=if(discount_code=null, "no", "yes")
   ✓ Correct answer: A, B

   isnotnull(discount_code) directly tests for a present value, and its logical mirror, if(isnull(discount_code), "no", "yes"), reaches the identical result by inverting both the test and the branch order together. Swapping which branch returns "yes" flips the meaning entirely, and comparing a field to null with the = operator is not valid null-testing syntax in eval.

   Why the other options are wrong

   • CThe branches here are reversed compared to option B, so events with no discount code are marked "yes" and events with one are marked "no".
   • DComparing a field directly to null with the = operator does not correctly test for a null value in eval.
5. Question 5Fields, Lookups, and Knowledge Objects

   A Power User tries the delimiter method on a CSV export but finds that one column occasionally contains a comma inside quoted text, such as "Smith, John", which breaks the column count. What is the best next step?

   • ASwitch to the regular expression methodCorrect
   • BPick a different, unused delimiter character
   • CIgnore the misaligned events going forward
   • DIncrease the number of expected columns
   ✓ Correct answer: A

   Quoted values that embed the delimiter break simple positional splitting, so a regex that matches quoted and unquoted fields separately handles the exception correctly, unlike delimiter mode. Choosing a different separator does not fix a value that already contains commas, ignoring events loses data, and forcing extra columns just shifts every field after the bad one.

   Why the other options are wrong

   • BChanging the delimiter character does not help when the problem value itself already contains a comma.
   • CSkipping the affected events silently drops data instead of fixing the extraction.
   • DAdding expected columns does not correct a shifted alignment caused by an embedded delimiter character.
6. Question 6Fields, Lookups, and Knowledge Objects

   A field bandwidth_tier should read 'low', 'medium', or 'high' based on ranges of an existing bytes_transferred field, computed automatically on every search. This is a job for:

   • AA field alias that renames bytes_transferred to bandwidth_tier
   • BA calculated field with nested eval conditionals on the bytesCorrect
   • CA single static tag named bandwidth_tier applied to every event
   • DA lookup that always returns the fixed value medium regardless
   ✓ Correct answer: B

   Because bandwidth_tier must express three distinct outcomes depending on which range bytes_transferred falls into, this requires nested if() or case() logic saved as a calculated field. A rename via alias would leave the field holding raw byte counts rather than a tier label, a static tag cannot vary by range, and a lookup returning one fixed value ignores the actual data entirely.

   Why the other options are wrong

   • AA rename would not change the meaning of the value; it would still just be raw byte counts, not a tier label.
   • CA single static tag cannot express three different range-based outcomes at once.
   • DA lookup that always returns one fixed value ignores the actual ranges in bytes_transferred entirely.
7. Question 7Tags, Event Types, Macros, and Workflow Actions

   Which of the following is NOT allowed inside the search string that defines an event type?

   • AA pipe to a transforming command, such as | stats countCorrect
   • BA plain keyword search term, such as error
   • CA field=value expression, such as sourcetype=app_log
   • DA Boolean AND combining two separate search terms together
   ✓ Correct answer: A

   An event type's search string can only contain plain search terms: keywords, field=value expressions, and Boolean operators like AND or OR. It cannot include a pipe to a transforming or reporting command, and it cannot contain a subsearch, because event types classify raw matching events rather than run a pipeline.

   Why the other options are wrong

   • BPlain keyword terms are exactly the kind of content an event type definition is built from.
   • Cfield=value expressions are fully valid inside an event type's search string.
   • DBoolean operators like AND are standard, supported parts of an event type's search criteria.
8. Question 8Tags, Event Types, Macros, and Workflow Actions

   A macro needs to be usable by every app on a Splunk instance, not just the app it was created in. Which sharing level accomplishes this?

   • AAll apps sharing, also called global sharingCorrect
   • BPrivate sharing, visible only to its sole owner
   • CApp-only sharing, visible within one app
   • DA role-restricted sharing tier for admins
   ✓ Correct answer: A

   Setting a macro's sharing to All apps makes its definition visible across every app on the instance rather than confining it to the app context where it was created. Private restricts it to the owner alone, App sharing exposes it only within its own app, and there is no separate sharing tier called role-restricted; read and write access by role is layered on top of whichever sharing level is chosen.

   Why the other options are wrong

   • BPrivate sharing restricts the macro to its owner only and does not extend visibility to other apps.
   • CApp-level sharing keeps the macro scoped to its own app rather than exposing it instance-wide.
   • DThere is no distinct sharing tier named role-restricted; role-based read and write access is configured separately from sharing level.
9. Question 9Data Models, CIM, and Reporting

   A child object needs to represent only the subset of its parent's events that occurred from a mobile app. What is the correct way to accomplish this?

   • AAdd a child constraint like app_platform=mobile on top of the parentCorrect
   • BDelete the parent object and rebuild the entire hierarchy from a blank data model
   • CCreate the mobile filter as a dashboard panel filter instead of touching the data model
   • DTurn on data model acceleration, which automatically narrows child objects by platform
   ✓ Correct answer: A

   The idiomatic approach is to add the extra constraint directly on the child object, so it keeps the parent's inherited filter and layers app_platform=mobile on top, producing exactly the desired narrower subset. There is no need to rebuild the hierarchy, a dashboard-level filter would not change what the data model dataset itself represents, and acceleration only speeds up existing definitions, it never changes which events a child matches.

   Why the other options are wrong

   • BRebuilding the whole hierarchy is unnecessary; a single added constraint on the child achieves the goal.
   • CA dashboard filter only affects that one panel's view; it does not redefine the data model dataset.
   • DAcceleration improves search performance on the existing definition; it does not add filtering logic.
10. Question 10Data Models, CIM, and Reporting

    A vendor's technology add-on for a new firewall already ships CIM-compliant field extractions out of the box. What does this mean for the onboarding team?

    • AThey likely need little or no manual field alias or tagging workCorrect
    • BThey must still disable CIM before the technology add-on will load
    • CThey cannot use the Network Traffic data model with this source
    • DThey must rebuild the CIM add-on itself before installing the new add-on
    ✓ Correct answer: A

    Many Splunk-supported technology add-ons already include the field aliases, calculated fields, and tags needed to satisfy relevant CIM data models, so once installed, the source is often already close to compliant, needing at most a validation check rather than building tags and aliases from scratch. Nothing about this requires disabling CIM or excludes the source from the model.

    Why the other options are wrong

    • BCIM does not need to be disabled for any technology add-on to function normally.
    • CA CIM-ready add-on is specifically designed to work with the relevant data model, not excluded from it.
    • DThe CIM add-on itself does not need to be rebuilt when installing an unrelated technology add-on.

Who this Splunk Core Certified Power User (SPLK-1002) practice exam is for

This practice set is for anyone preparing for the Splunk Core Certified Power User (SPLK-1002) exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Splunk Core Certified Power User (SPLK-1002) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Splunk Core Certified Power User (SPLK-1002) exam.

Related Security resources

• Splunk Core Certified Power User (SPLK-1002) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• CompTIA SecurityX (CAS-005, formerly CASP+) practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated

Splunk Core Certified Power User (SPLK-1002) practice exam FAQ