Splunk Core Certified Power User Exam
Last Update Dec 7, 2025
Total Questions : 306
We are offering FREE SPLK-1002 Splunk exam questions. All you do is to just go and sign up. Give your details, prepare SPLK-1002 free exam questions and then go for complete pool of Splunk Core Certified Power User Exam test questions that will help you more.
The Splunk Common Information Model (CIM) is a collection of what type of knowledge object?
The eval command 'if' function requires the following three arguments (in order):
Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)
Sally created several tags for employees of Buttercup Games. She tagged each employee’s badge number with the department name and location. Which search query would Sally use to filter for employees of the Marketing department who do not work in the San_Francisco office?
What does the fillnull command replace null values with, if the value argument is not specified?
It is mandatory for the lookup file to have this for an automatic lookup to work.
When using the transaction command, what is the assigned timestamp for each of the resulting transactions?
To create a tag, which of the following conditions must be met by the user?
When using the transaction command, how are evicted transactions identified?
When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?
What other syntax will produce exactly the same results as | chart count over vendor_action by user?
The eval command allows you to do which of the following? (Choose all that apply.)
Using the Field Extractor (FX) tool, a value is highlighted to extract and give a name to a new field. Splunk has not successfully extracted that value from all appropriate events. What steps can be taken so Splunk successfully extracts the value from all appropriate events? (select all that apply)
Which of the following statements would help a user choose between the transaction and stats commands?
When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?
Which of the following knowledge objects represents the output of an eval expression?
Which method in the Field Extractor would extract the port number from the following event? |
10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin
A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?
What is a benefit of installing the Splunk Common Information Model (CIM) add-on?
The timechart command is an example of which of the following command types?
This clause is used to group the output of a stats command by a specific name.
In the Field Extractor Utility, this button will display events that do not contain extracted fields.
Select your answer.
When should the regular expression mode of Field Extractor (FX) be used? (select all that apply)
The macro weekly_sales (2) contains the search string:
index—games I eval Product Sales = $price$ $AmountS01d$
Which of the following will return results?
What is the correct Boolean order of evaluation for the where command from first to last?
Which of the following statements about tags is true? (select all that apply.)
The transaction command allows you to __________ events across multiple sources
Given the following eval statement:
... | eval field1 = if(isnotnull(field1),field1,0), field2 = if(isnull(field2), "NO-VALUE", field2)
Which of the following is the equivalent using fillnull?
Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search
Information needed to create a GET workflow action includes which of the following? (select all that apply.)
Which search string would only return results for an event type called success ful_purchases?
Select this in the fields sidebar to automatically pipe you search results to the rare command
Which of the following statements is true, especially in large environments?
This function of the stats command allows you to identify the number of values a field has.
In most large Splunk environments, what is the most efficient command that can be used to group events by fields/
What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?
A user runs the following search:
index—X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother—f
Which of the following table headers match the order this command creates?
A user wants to create a workflow action that will retrieve a specific field value from an event and run a search in a new browser window
in the user's Splunk instance. What kind of workflow action should they create?
Marty has multiple data sources that contain fields with IP Address values. What knowledge object should he use to normalize the fields so his data is CIM compliant?
How is an event type created from the search window? (select all that apply)
There are several ways to access the field extractor. Which option automatically identifies data type, source type, and sample event?
Based on the macro definition shown below, what is the correct way to execute the macro in a search string?
Which of the following is a function of the Splunk Common Information Model (CIM)?
Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?
What does the fillnull command replace null values with, it the value argument is not specified?
A field alias is created where field1—fieid2 and the Overwrite Field Values checkbox is selected.
What happens if an event only contains values for fieid1?
TESTED 07 Dec 2025
