Splunk SPLK-1002 Practice Exams
Last updated on Oct 06,2026- Exam Code: SPLK-1002
- Exam Name: Splunk Core Certified Power User
- Certification Provider: Splunk
- Latest update: Oct 06,2026
When using | timchart by host, which filed is representted in the x-axis?
- A . date
- B . host
- C . time
- D . -time
Which of the following statements are true for this search? (Select all that apply.)
SEARCH: sourcetype=access* |fields action productld status
- A . is looking for all events that include the search terms: fields AND action AND productld AND status
- B . users the table command to improve performance
- C . limits the fields are extracted
- D . returns a table with 3 columns
How could the following syntax for the chart command be rewritten to remove the OTHER category? (select all that apply)
- A . | chart count over CurrentStanding by Action useother=f
- B . | chart count over CurrentStanding by Action usenull-f useother-t
- C . | chart count over CurrentStanding by Action limit=10 useother=f
- D . | chart count over CurrentStanding by Action limit-10
This function of the stats command allows you to return the sample standard deviation of a field.
- A . stdev
- B . dev
- C . count deviation
- D . by standarddev
Which of the following statements describes the use of the Filed Extractor (FX)?
- A . The Field Extractor automatically extracts all field at search time.
- B . The Field Extractor uses PERL to extract field from the raw events.
- C . Field extracted using the Extracted persist as knowledge objects.
- D . Fields extracted using the Field Extractor do not persist and must be defined for each search.
Which of the following eval commands will provide a new value for host from src if it exists?
- A . | eval host = if (isnu11 (src), src, host)
- B . | eval host = if (NOT src = host, src, host)
- C . | eval host = if (src = host, src, host)
- D . | eval host = if (isnotnull (src), src, host)
Highlighted search terms indicate _________ search results in Splunk.
- A . Display as selected fields.
- B . Sorted
- C . Charted based on time
- D . Matching
A search contains example(100,200).
What is the name of the macro?
- A . example (2)
- B . example (var1, var2)
- C . example ($,$)
- D . example [2]
When creating a data model, which root dataset requires at least one constraint?
- A . Root transaction dataset
- B . Root event dataset
- C . Root child dataset
- D . Root search dataset
Which of the following can a field alias be applied to?
- A . Tags
- B . Indexes
- C . Sourcetypes
- D . Event types