Splunk SPLK-1002 Practice Exams
Last updated on Oct 06,2026- Exam Code: SPLK-1002
- Exam Name: Splunk Core Certified Power User
- Certification Provider: Splunk
- Latest update: Oct 06,2026
Which of the following knowledge objects represents the output of an eval expression?
- A . Eval fields
- B . Calculated fields
- C . Field extractions
- D . Calculated lookups
Which of the following statements describe calculated fields? (select all that apply)
- A . Calculated fields can be used in the search bar.
- B . Calculated fields can be based on an extracted field.
- C . Calculated fields can only be applied to host and sourcetype.
- D . Calculated fields are shortcuts for performing calculations using the eval command.
How is an event type created from the search window? (select all that apply)
- A . In the top right corner, click Save As > Event Type.
- B . In an event’s detail dropdown, click Event Actions > Build Event Type.
- C . Edit eventtypes.conf and add a new stanza.
- D . Add | eventtype to the SPL and execute the search.
The timechart command is an example of which of the following command types?
- A . Orchestrating
- B . Transforming
- C . Statistical
- D . Generating
When is a GET workflow action needed?
- A . To send field values to an external resource.
- B . To retrieve information from an external resource.
- C . To use field values to perform a secondary search.
- D . To define how events flow from forwarders to indexes.
Which of the following Statements about macros is true? (select all that apply)
- A . Arguments are defined at execution time.
- B . Arguments are defined when the macro is created.
- C . Argument values are used to resolve the search string at execution time.
- D . Argument values are used to resolve the search string when the macro is created.
A user wants to create a workflow action that will retrieve a specific field value from an event and run a search in a new browser window in the user’s Splunk instance.
What kind of workflow action should they create?
- A . A Run workflow action, because the user is running a new search with a specific field value from an event returned in the user’s search.
- B . A Search workflow action, because the user is running a new search with a specific field value from an event returned in the user’s search.
- C . A POST workflow action, because the search is being sent to the user’s current Splunk instance.
- D . A GET workflow action, because a field value needs to be retrieved from the events returned in the user’s search.
Which workflow action method can be used the action type is set to link?
- A . GET
- B . PUT
- C . Search
- D . UPDATE
A user wants a table that will show the total revenue made for each product in each sales region.
Which would be the correct SPL query to use?
- A . index=X sourcetype=Y | chart sum(product) by price AND region
- B . index=X | chart sum(price) by product, region
- C . index=X | chart total(product) over price by region
- D . index=X | chart total(price) by product, region
Two separate results tables are being combined using the |join command.
The outer table has the following values:
Refer to following Tables
The line of SPL used to join the tables is: | join employeeNumber type=outer
How many rows are returned in the new table?
- A . Zero
- B . Five
- C . Eight
- D . Three