Splunk SPLK-1002 Practice Exams
Last updated on Oct 06,2026- Exam Code: SPLK-1002
- Exam Name: Splunk Core Certified Power User
- Certification Provider: Splunk
- Latest update: Oct 06,2026
When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)
- A . Tabs
- B . Pipes
- C . Colons
- D . Spaces
which of the following commands are used when creating visualizations(select all that apply.)
- A . Geom
- B . Choropleth
- C . Geostats
- D . iplocation
For the following search, which field populates the x-axis?
index=security sourcetype=linux secure | timechart count by action
- A . action
- B . source type
- C . _time
- D . time
What does the fillnull command replace null values with, if the value argument is not specified?
- A . 0
- B . N/A
- C . NaN
- D . NULL
Which of the following about reports is/are true?
- A . Reports are knowledge objects.
- B . Reports can be scheduled.
- C . Reports can run a script.
- D . All of the above.
Which of the following search control will not re-rerun the search? (Select all that apply.)
- A . zoom out
- B . selecting a bar on the timeline
- C . deselect
- D . selecting a range of bars on the timelines
What field must be present in order to use the timechart command?
- A . _raw
- B . rime
- C . _time
- D . index
Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.
- A . inputlookup
- B . lookup
When would transaction be used instead of stats?
- A . To group events based on a single field value.
- B . To see results of a calculation.
- C . To have a faster and more efficient search.
- D . To group events based on start/end values.
When defining a macro, what are the required elements?
- A . Name and arguments.
- B . Name and a validation error message.
- C . Name and definition.
- D . Definition and arguments.