Splunk Core Certified Power User (SPLK-1002) is a power user-level Splunk certification exam. The blueprint splits the exam across 5 domains, starting with Advanced Search, Knowledge Objects, Data Models. On exam day you face around 75 questions in 75 minutes, in formats such as multiple-choice. The 20 questions below are free samples written to match that style: answer each one first, then reveal the correct answer and note which topics you miss. The SPLK-1002 is rated medium in difficulty, and most candidates prepare with at least 6 months of hands-on experience. Because every answer is revealed in place, you can work through the whole set without leaving this page. Work through all 20 samples before deciding whether to buy the full 181+ question PDF.
Looking for more? Click here to get the full PDF with 181+ practice questions for $10 for offline study and deeper preparation.
Which of the following statements describes macros?
When would a user select delimited field extractions using the Field Extractor (FX)?
When should you use the transaction command instead of the stats command?
Which field extraction method should be selected for comma-separated data?
What are the expected results for a search that contains the command | where A=B?
Which of the following statements describe the command below? (Choose all that apply.) sourcetype=access_combined | transaction JSESSIONID
Which of these stats commands will show the total bytes for each unique combination of page and server?
Ben created a macro named airport_code_translator(2). His coworker, Alice, wants to use the macro to find the name of a nearby airport. Which of the following search strings will return the results that Alice needs?
What is required for a macro to accept three arguments?
Which type of visualization shows relationships between discrete values in three dimensions?
What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?
What is the correct Boolean order of evaluation for the where command from first to last?
When using | timechart by host, which field is represented in the x-axis?
What field delimiter should be used for the event below? 2023-10-25:11:30:00.000 Logout john.doe Chromium splunk.com
Which of the following is true about a datamodel that has been accelerated?
A user runs the following search: index=X sourcetype=Y | chart count(domain) as count, sum(price) as sum by product, action usenull useother=f Which of the following table headers match the order this command creates?
Which of the following are required to create a POST workflow action?
A data model consists of which three types of datasets?
Consider the following search run over a time range of last 7 days: index=web sourcetype=access_combined | timechart avg(bytes) by product_name Which option is used to change the default time span so that results are grouped into 12 hour intervals?
Which tool uses data models to generate reports and dashboard panels without using SPL?
No. They are original practice questions written to match the format and topic mix of the Splunk Core Certified Power User exam, which contains around 75 questions. Treat them as representative practice, not leaked exam content.
This page includes 20 questions, each with its correct answer you can reveal in place. The full study PDF expands that to 181+ questions.
Yes. Open the answer panel under each question to see which option is correct. Answer first, then reveal, so the set works as a self-check rather than a reading exercise.
Not on its own. Use the samples to find weak topics, revise them against the official domains, then work through the full 181+ question set under timed conditions before booking the exam.
Download the complete SPLK-1002 study bundle with 181+ questions in a single printable PDF.