Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Splunk
Exam Format
Registration
Validity
Skills this practice test covers
- Build multi-series charts with chart and timechart, splitting results with the by clause.
- Create calculated values with eval and fill empty fields with fillnull.
- Group related events into transactions with maxspan and maxpause limits.
- Extract new fields with the Field Extractor, using regular expressions or delimiters.
- Write a search macro that takes arguments and call it with backtick syntax.
- Normalize data to the Common Information Model with field aliases, tags and event types.
Explore related topics
SPLK-1002 exam content
10 domains · 28 topics · 230 of 295 questions sorted by domain
Using Transforming Commands for Visualizations19 questions
This domain turns search results into charts. Candidates use the chart and timechart commands, split series with the by clause, and control the time span of each bucket.
Skills tested
- Build a multi-series chart with the chart command and a by clause.
- Apply statistical functions within the chart command.
- Create a time-based chart with timechart and set its span.
- Shape a timechart with the limit and cont options.
Questions by topic
- Use the chart command10
- Use the timechart command9
Filtering and Formatting Results32 questions
This domain shapes results after the search runs. It covers the eval command and its functions, filtering with search and where, and filling empty fields with fillnull.
Skills tested
- Create calculated fields with eval and its conditional functions.
- Filter results with the search command or with where expressions, and know when each fits.
- Use comparison and boolean operators inside where.
- Replace null values with fillnull, for all fields or for named ones.
Questions by topic
- The eval command13
- Use the search and where commands to filter results6
- The fillnull command13
Correlating Events30 questions
This domain groups separate events into one transaction. Candidates choose the fields that link the events, set time limits with maxspan and maxpause, and search the duration and eventcount fields that transactions add.
Skills tested
- Identify events that belong to the same transaction.
- Group events by common fields with the transaction command.
- Bound transactions with maxspan, maxpause and an endswith condition.
- Analyze transaction duration and event counts in later search steps.
Questions by topic
- Group events using fields6
- Search with transactions6
- Group events using fields and time9
- Identify transactions9
Creating and Managing Fields17 questions
This domain covers fields that Splunk does not extract on its own. Candidates use the Field Extractor to build regex or delimiter extractions and then test them.
Skills tested
- Create a regex field extraction in the Field Extractor and check it against sample events.
- Extract fields from delimiter-separated data, such as CSV data.
- Validate and test a field extraction before sharing it.
Questions by topic
- Perform regex field extractions using the Field Extractor (FX)11
- Perform delimiter field extractions using the FX6
Creating Field Aliases and Calculated Fields18 questions
This domain is about fields defined once and applied to every search. Field aliases give the same data one common name, and calculated fields run an eval expression automatically.
Skills tested
- Create a field alias that maps a source field to a shared name.
- Apply field aliases to normalize data from several sources.
- Create a calculated field from an eval expression.
- Use a calculated field in a search without writing its eval again.
Questions by topic
- Describe, create, and use calculated fields11
- Describe, create, and use field aliases7
Creating Tags and Event Types17 questions
This domain adds labels to data. Candidates tag field-value pairs, save searches as event types, and tell event types apart from other knowledge objects.
Skills tested
- Apply tags to field-value pairs and search with them.
- Create an event type from a search with the event type builder.
- Set event type properties such as priority and color coding.
- Differentiate event types from other knowledge objects.
Questions by topic
- Create an event type6
- Create and use tags6
- Describe event types and their uses5
Creating and Using Macros28 questions
Macros store part of a search for reuse. This domain covers when a macro helps, how to create one, and how to define and pass its arguments.
Skills tested
- Identify searches that are worth saving as macros.
- Create a basic macro and call it with backtick syntax.
- Define macro arguments and use them as variables in the definition.
- Pass several arguments to a macro and check its expansion.
Questions by topic
- Define arguments and variables for a macro9
- Describe macros7
- Create and use a basic macro6
- Add and use arguments with a macro6
Creating and Using Workflow Actions26 questions
Workflow actions link a field in an event to another resource. Candidates choose between GET, POST and Search actions and pass field values to a web page, an external application or a new search.
Skills tested
- Pick the right workflow action type for a use case.
- Create a GET workflow action that opens a URL with field values in its parameters.
- Create a POST workflow action that submits form data to an external application.
- Create a Search workflow action with a dynamic search string and time range.
Questions by topic
- Create a GET workflow action9
- Create a Search workflow action5
- Describe the function of GET, POST, and Search workflow actions5
- Create a POST workflow action7
Creating Data Models18 questions
Data models arrange events into datasets that Pivot users can report on without writing searches. This domain covers that relationship and the basics of building a data model.
Skills tested
- Explain how data models supply datasets to Pivot.
- Build a basic data model in the Data Model Editor with child objects and constraints.
- Create a Pivot report with drag-and-drop for non-technical users.
Questions by topic
- Describe the relationship between data models and pivot18
Using the Common Information Model (CIM) Add-On25 questions
The Common Information Model gives data from different sources the same field names. Candidates describe the CIM, list the knowledge objects in the CIM Add-On, and normalize a data source to it.
Skills tested
- Explain why normalized field names help searches across data sources.
- Identify the knowledge objects that come with the CIM Add-On.
- Map custom fields to CIM standards with aliases and tags.
- Validate that a data source is CIM compliant.
Questions by topic
- Use the CIM Add-On to normalize data10
- Describe the Splunk CIM8
- List the knowledge objects included with the Splunk CIM Add-On7
Requirements
- No formal prerequisites: anyone can book the exam.
- Recommended: hands-on Splunk experience of three to six months, with regular searching and reporting.
- Recommended: a basic understanding of SPL (Search Processing Language).
About the SPLK-1002 exam
In SPLK-1002, Splunk checks that a user can write advanced searches in the Search Processing Language (SPL) and save the knowledge objects a team reuses. It covers transforming commands, transactions, field extraction, knowledge objects such as macros and event types, data models and the Common Information Model. Passing earns the Splunk Core Certified Power User certification. It is a base for Splunk's administrator, developer and advanced search certifications.
In the PlanetCert practice test, filtering and formatting results has the largest set of questions, led by eval and fillnull, with correlating events and macros close behind. The explanations matter most where two commands look alike, such as search and where, or chart and timechart. Flashcard Mode suits the many knowledge object types, from field aliases to event types. Brainy AI Assistant can take a transaction search apart clause by clause, or rewrite a long search as a macro with arguments.
How to earn the certification
- Earns
- Splunk Core Certified Power UserEntry
- Before
- SPLK-1001 Splunk Core Certified User
The Splunk Core certification below Power User, on basic searches, reports and dashboards.
- SPLK-1001 Splunk Core Certified User
How to prepare for SPLK-1002
- 1
Load real logs into a test instance
Set up a test Splunk instance and add a few log files, such as web access logs. Every objective, from field extraction to data models, needs real events to try.
- 2
Drill eval, where and fillnull together
Filtering and formatting carries the most practice questions. Write searches that build a field with eval, filter it with where and fill the gaps with fillnull, then compare the output with and without each step.
- 3
Turn one search into knowledge objects
Take a useful search and save its parts as a field extraction, a field alias, a calculated field, a tag, an event type and a macro. Then map the fields to the CIM and watch how the objects depend on each other.
- 4
Correlate one user's web session
Group web events into sessions with the transaction command, then tighten them with maxspan and maxpause. Check the duration and eventcount fields after each change.
- 5
Measure readiness with timed runs
Take the SPLK-1002 practice test in Timed Mode once each knowledge object can be built from memory. Ask Brainy AI Assistant to explain any missed search, command by command.
Start a timed SPLK-1002run
Who SPLK-1002 is for
- Data analysts who search machine data in Splunk every day.
- Security analysts who build their own Splunk searches and reports.
- System administrators and DevOps engineers who turn logs into charts and dashboards.
- Career changers who are moving into data or security work with Splunk.
Typical job titles: Splunk power user · Data analyst · Security analyst · SOC analyst · Systems administrator · DevOps engineer
SPLK-1002 glossary
18 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- backtick syntax
- The way to call a macro in a search: its name, and any arguments, placed between backtick characters.
- by clause
- The part of a chart or timechart command that splits results into one series for each value of a field.
- calculated fields
- Fields defined by an eval expression that Splunk works out automatically at search time.
- chart command
- A transforming command that turns results into a table for a chart, with one field on the x-axis and an optional by clause for more series.
- Common Information Model
- A shared set of field names and data models that lets data from different sources be searched the same way.
- eval expressions
- Calculations in an eval command that create or change a field, using math, text, date/time and conditional functions.
- event types
- Saved searches whose matching events are labeled with the event type's name, so they can be found as a group.
- field aliases
- Alternative names for a field, so data from different sources can be searched under one name.
- Field Extractor
- Splunk's guided screen for building new field extractions from sample events, with regular expressions or delimiters.
- fillnull
- A command that puts a value, such as zero, into fields that are empty in the results.
- GET actions
- Workflow actions that open a URL in the browser, with field values placed in the link.
- Knowledge Objects
- Saved, reusable items such as field extractions, aliases, tags, event types and macros that add meaning to data.
- maxpause
- A transaction option that sets the longest gap allowed between two events in the same transaction.
- maxspan
- A transaction option that sets the longest time allowed from the first to the last event of a transaction.
- Pivot
- Splunk's drag-and-drop interface that builds reports and charts from a data model's datasets.
- POST actions
- Workflow actions that send field values as form data to an external web application.
- props.conf
- The configuration file where search-time settings such as field aliases and calculated fields are stored.
- Search Processing Language (SPL)
- Splunk's query language, in which commands are joined by pipes so each one works on the results of the one before.