Splunk Core Certified Power User (SPLK-1002) practice questions

Domain coverage 10 domains

• Using Transforming Commands for Visualizations (5%)
• Filtering and Formatting Results (10%)
• Correlating Events (15%)
• Creating and Managing Fields (10%)
• Creating Field Aliases and Calculated Fields (10%)
• Creating Tags and Event Types (10%)
• Creating and Using Macros (10%)
• Creating and Using Workflow Actions (10%)
• Creating Data Models (10%)
• Using the Common Information Model (CIM) Add-On (10%)

Sample questions 10 of 100 shown

1. Q1 Using Transforming Commands for Visualization (5%)

   Which Splunk command is specifically designed to chart values over time without manually binning the timestamp field?

   1. stats
   2. chart
   3. timechart
   4. table

   The timechart command automatically bins the internal _time field and generates series suitable for time-based visualizations. It is the go-to command when the x-axis should represent time.
2. Q2 Using Transforming Commands for Visualization (5%)

   A user wants to count events by sourcetype to create a pie chart. Which command is most appropriate?

   1. timechart count by sourcetype
   2. chart count over sourcetype
   3. transaction sourcetype
   4. table sourcetype count

   Pie charts require aggregation by a non-time field. chart count over sourcetype groups data by category and produces results suitable for Splunk visualizations.
3. Q3 Using Transforming Commands for Visualization (5%)

   Which statement best distinguishes transforming commands from non-transforming commands in Splunk?

   1. Transforming commands replace raw events with statistical or tabular results
   2. Transforming commands can only run after timechart
   3. Non-transforming commands always run faster than transforming commands
   4. Transforming commands are used only for dashboards, not searches

   Transforming commands change the result set from individual events to aggregated statistical information. Commands like stats, chart, and timechart are classic examples as they reshape data for reporting.
4. Q4 Using Transforming Commands for Visualization (5%)

   Which search will produce a line chart of failed logins per hour broken down by host?

   1. index=auth action=failure | chart count over host by _time
   2. index=auth action=failure | stats count by _time host
   3. index=auth action=failure | timechart span=1h count by host
   4. index=auth action=failure | table _time host count

   timechart span=1h count by host creates hourly time buckets and generates separate series for each host, which is exactly what a multi-line time visualization needs.
5. Q5 Using Transforming Commands for Visualization (5%)

   A search should show the top five HTTP status codes sorted by event count. Which command is the most direct?

   1. top limit=5 status
   2. timechart count by status limit=5
   3. transaction status
   4. lookup status_codes.csv status

   The top command is built to return the most frequent values of a field with counts and percentages. It is more direct than manually constructing the same output.
6. Q6 Filtering and Formatting Results (10%)

   Which of the following is NOT a comparison operator in Splunk?

   1. <=
   2. =
   3. !=
   4. >
   5. ?=

   Splunk supports comparison operators like <, >, =, !=, <=, >=, IN, and LIKE. The ?= operator is not valid in Splunk and would cause a syntax error.
7. Q7 Filtering and Formatting Results (10%)

   What is the expected result of the search | where A=B?

   1. Events containing the string value where A=B
   2. Events containing the string value A=B
   3. Events where the value of field A equals the value of field B
   4. Events where field A contains the string value B

   The where command filters results based on an expression that evaluates to true or false. | where A=B compares two fields without quotes — only events where both fields have the same value are returned.
8. Q8 Filtering and Formatting Results (10%)

   Which eval command function is valid in Splunk?

   1. int()
   2. count()
   3. print()
   4. tostring()

   tostring() is a valid eval function in Splunk that converts a field value to a string. count() is a stats function, while int() and print() are not standard Splunk eval functions.
9. Q9 Filtering and Formatting Results (10%)

   What can the eval command do?

   1. Remove fields from results
   2. Create or replace an existing field value
   3. Group events into transactions by one or more fields
   4. Save an SPL command for reuse in other searches

   The eval command evaluates an expression and puts the resulting value into a search-time field. It can create new fields or overwrite existing ones using expressions and functions.
10. Q10 Filtering and Formatting Results (10%)

    If the data has fields with empty values, which command adds a value to replace null fields?

    1. | eval notNULL = "" | nullfill value=0 notNULL
    2. | eval notNULL = if(isnull(notNULL), "0")
    3. | eval notNULL = if(isnull(notNULL), "0"
    4. | eval notNULL = "" | fillnull value=0 notNULL

    The fillnull command replaces null values in specified fields with a default value. The syntax | fillnull value=0 notNULL correctly fills null values in the notNULL field with 0.

Answer all 100 questions with instant feedback →

Reader reviews 204 ratings

• The SPLK-1002 questions were tougher than the actual exam, which honestly made me more confident. Great prep tool.

  ★★★★★★ Brandon L.

• Bought lifetime access for the SPLK-1002 bank and it’s been great. Still use it to brush up even after passing the cert.

  ★★★★★★ Sophie L.

• The SPLK-1002 explanations are gold. I learned almost as much from reviewing wrong answers as from the correct ones.

  ★★★★★★ Julian M.

• Solid Splunk prep material. The SPLK-1002 questions are well-written and the answer rationales are thorough.

  ★★★★★★ Madison T.

• Honestly, I wouldn’t have passed SPLK-1002 without these. The explanations actually teach you instead of just giving the answer.

  ★★★★★★ Jordan P.

• The review mode for SPLK-1002 is awesome. Being able to see all questions and explanations at once really helps with last-minute cramming.

  ★★★★★★ Ezra J.

Frequently asked questions

Free study resources

Community-verified analysis of 15 questions from real test-taker discussions — 9 deep analyses and 15 FAQs.

More Splunk exams