Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Splunk
Exam Format
60 min
700
Entry
Registration
$130 USD
Pearson VUE or online proctoring
English
Validity
Does not expire
Certification does not expire; Recommended to pursue advanced certifications
SPLK-1002 Exam Topics and Domains
SPLK-1002 is organized into 10 weighted domains. Expect to work with SPL, Splunk Web, Knowledge Objects, CIM Add-On, and more.
1
Using Transforming Commands for Visualizations
10%
Use the chart command
Chart command syntax and optionsCreating visualizations with chart
- Understand the chart command syntax and its various options
- Create multi-series charts using the by clause
- Apply statistical functions within chart commands
Use the timechart command
Timechart command fundamentalsAdvanced timechart options
- Create time-based visualizations using timechart
- Control time span and bucketing in timechart
- Apply advanced timechart options for complex visualizations
2
Filtering and Formatting Results
10%
The eval command
Eval command basicsEval functions
- Create calculated fields using eval
- Apply eval functions for data manipulation
- Use conditional logic in eval expressions
Use the search and where commands to filter results
Search command filteringWhere command filtering
- Filter search results using the search command
- Apply where command for expression-based filtering
- Understand when to use search vs where
The fillnull command
Handling null values
- Replace null values in search results
- Apply fillnull to specific fields or all fields
- Set appropriate default values for null fields
3
Correlating Events
10%
Identify transactions
Transaction concepts
- Understand what transactions are in Splunk
- Identify events that belong to the same transaction
- Recognize transaction patterns in data
Group events using fields
Field-based grouping
- Group related events using common fields
- Create transactions based on field values
- Use the transaction command effectively
Group events using fields and time
Time-based transaction grouping
- Create transactions with time constraints
- Define transaction boundaries using time and fields
- Apply maxspan and maxpause parameters
Search with transactions
Transaction searching
- Search and filter transaction results
- Use transaction-specific fields in searches
- Analyze transaction duration and event counts
4
Creating and Managing Fields
10%
Perform regex field extractions using the Field Extractor (FX)
Regular expression extractionsField Extractor workflow
- Create field extractions using regular expressions
- Use the Field Extractor interface effectively
- Validate and test field extractions
Perform delimiter field extractions using the FX
Delimiter-based extractions
- Extract fields from delimiter-separated data
- Configure delimiter-based extractions
- Handle various delimiter types
5
Creating Field Aliases and Calculated Fields
10%
Describe, create, and use field aliases
Field alias conceptsField alias configuration
- Understand the purpose of field aliases
- Create and configure field aliases
- Apply field aliases to normalize data
Describe, create, and use calculated fields
Calculated field conceptsCreating calculated fields
- Create calculated fields using eval expressions
- Configure automatic field calculations
- Apply calculated fields in searches
6
Creating Tags and Event Types
10%
Create and use tags
Tag concepts and creationUsing tags in searches
- Create and manage tags
- Apply tags to field-value pairs
- Use tags effectively in searches
Describe event types and their uses
Event type concepts
- Understand event type concepts
- Recognize use cases for event types
- Differentiate event types from other knowledge objects
Create an event type
Event type creation
- Create event types from searches
- Configure event type properties
- Apply event types to categorize data
7
Creating and Using Macros
10%
Describe macros
Macro concepts
- Understand search macro concepts
- Recognize benefits of using macros
- Identify appropriate use cases for macros
Create and use a basic macro
Basic macro creation
- Create basic search macros
- Invoke macros in searches
- Test and validate macro functionality
Define arguments and variables for a macro
Macro arguments
- Define arguments for macros
- Understand variable substitution
- Create flexible, parameterized macros
Add and use arguments with a macro
Using macro arguments
- Invoke macros with arguments
- Pass multiple arguments to macros
- Validate macro argument usage
8
Creating and Using Workflow Actions
10%
Describe the function of GET, POST, and Search workflow actions
Workflow action types
- Understand different workflow action types
- Identify appropriate action type for use cases
- Recognize workflow action capabilities
Create a GET workflow action
GET action configuration
- Create GET workflow actions
- Configure URL parameters
- Pass field values to external resources
Create a POST workflow action
POST action configuration
- Create POST workflow actions
- Configure POST parameters
- Submit data to external applications
Create a Search workflow action
Search action configuration
- Create Search workflow actions
- Build dynamic search strings
- Configure search time ranges
9
Creating Data Models
10%
Describe the relationship between data models and pivot
Data model conceptsPivot interfaceData model creation basics
- Understand data model architecture
- Recognize the relationship between data models and pivot
- Create basic data models for pivot reporting
10
Using the Common Information Model (CIM) Add-On
10%
Describe the Splunk CIM
CIM overview
- Understand the Common Information Model
- Recognize benefits of data normalization
- Identify CIM use cases
List the knowledge objects included with the Splunk CIM Add-On
CIM knowledge objects
- Identify knowledge objects in CIM
- Understand CIM data model categories
- Recognize CIM field conventions
Use the CIM Add-On to normalize data
Data normalization with CIM
- Apply CIM to normalize data sources
- Map custom fields to CIM standards
- Validate CIM compliance
How do I earn this certification?
Passing SPLK-1002 earns the Splunk Core Certified Power User certification. It sits in the Splunk Core track.
Current Level Exams
Next Level Options
Alternative Paths
- SPLK-1004 - Splunk Cloud Certified AdminCloud platform administration focus
- SPLK-1005 - Splunk Enterprise Certified AdminOn-premises administration focus
- SPLK-3001 - Splunk Enterprise Security Certified Admin Security operations specialization
- SPLK-3002 - Splunk Phantom Certified AdminSecurity orchestration and automation
- SPLK-3003 - Splunk SOAR Certified Automation DeveloperAutomation development specialization
- SPLK-4001 - Splunk O11y Cloud Certified Metrics UserObservability and metrics focus
- SPLK-5001 - Splunk Certified Cybersecurity Defense AnalystCybersecurity defense specialization
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for SPLK-1002 is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2024
Updates
- Search Processing Language (SPL) Latest Core focus area - 40% of exam content • Release date: Ongoing
- Common Information Model (CIM) 5.x 10% of exam - normalization concepts critical • Release date: 2024
- Splunk Web Framework Latest Workflow actions and dashboard creation • Release date: Ongoing
Who should take this exam?
This exam is typically taken by IT professionals seeking Splunk expertise and Data analysts working with machine data.
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- 3-6 months of hands-on Splunk experience
- Experience with searching and reporting in Splunk
- Basic understanding of SPL (Search Processing Language)