Splunk SPLK-1002 Practice Exams
Last updated on Oct 06,2026- Exam Code: SPLK-1002
- Exam Name: Splunk Core Certified Power User
- Certification Provider: Splunk
- Latest update: Oct 06,2026
How does a user display a chart in stack mode?
- A . By using the stack command.
- B . By turning on the Use Trellis Layout option.
- C . By changing Stack Mode in the Format menu.
- D . You cannot display a chart in stack mode, only a timechart.
Which of the following definitions describes a macro named "samplemacro" that accepts two arguments?
- A . Examplemacro [1,2]
- B . samplemacro(1,2)
- C . u amp -CJEUCXG (2)
- D . samplemacro[2]
Which of the following is a feature of the Pivot tool?
- A . Creates lookups without using SPL.
- B . Data Models are not required.
- C . Creates reports without using SPL
- D . Datasets are not required.
When using a field value variable with a Workflow Action, which punctuation mark will escape the data
- A . *
- B . !
- C . ^
- D . #
What are the expected search results from executing the following SPL command?
index=network NOT StatusCode=200
- A . Every event in the network index that does not have a value in this field.
- B . Every event in the network index that does not contain a StatusCode of 200 and excluding events
that do not have a value in this field. - C . Every event in the network index that does not contain a StatusCode of 200, including events that do not have a value in this field.
- D . No results as the syntax is incorrect, the != field expression needs to be used instead of the NOT operator.
Which of the following statements describes this search?
sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)
- A . This is a valid search and will display a timechart of the average duration, of each transaction event.
- B . This is a valid search and will display a stats table showing the maximum pause among transactions.
- C . No results will be returned because the transaction command must include the startswith and endswith options.
- D . No results will be returned because the transaction command must be the last command used in the search pipeline.
How many ways are there to access the Field Extractor Utility?
- A . 3
- B . 4
- C . 1
- D . 5
Which of the following options will define the first event in a transaction?
- A . startswith
- B . with
- C . startingwith
- D . firstevent
When using the transaction command, how are evicted transactions identified?
- A . Closed_txn field is set to o, or false.
- B . Max_txn field is set to O, or false.
- C . Txn_field is set to 1, or true.
- D . open_txn field is set to 1, or true.
When should the regular expression mode of Field Extractor (FX) be used? (select all that apply)
- A . For data cleanly separated by a space, a comma, or a pipe character.
- B . For data in a CSV (comma-separated value) file.
- C . For data with multiple, different characters separating fields.
- D . For unstructured data.