Question 1

What is the SPLK-1002 exam?

Accepted Answer

The SPLK-1002 is the Splunk Core Certified Power User exam, an intermediate-level certification that validates a candidate's ability to create knowledge objects, write advanced SPL searches, and normalise data using the Splunk Common Information Model. It covers topics including field aliases, calculated fields, tags, event types, macros, workflow actions, and data models. The certification is recognised across data analytics, IT operations, and security operations roles.

Question 2

How many questions are on the SPLK-1002?

Accepted Answer

The SPLK-1002 exam contains 65 multiple-choice questions that must be completed within a 57-minute time limit. Questions test both conceptual understanding and practical application of Splunk power user features.

Question 3

What is the passing score for the SPLK-1002?

Accepted Answer

The passing score for the SPLK-1002 exam is 70%, meaning candidates must correctly answer at least 46 of the 65 questions. Scores are typically reported on a scale of 0 to 1000, with a passing threshold of 700.

Question 4

Is the SPLK-1002 a hands-on or multiple-choice exam?

Accepted Answer

The SPLK-1002 is a multiple-choice exam delivered through Pearson VUE. It does not include a practical or hands-on component. Questions are scenario-based and test candidates' ability to identify the correct approach to Power User tasks in Splunk Enterprise and Splunk Cloud.

Question 5

What topics does the SPLK-1002 cover?

Accepted Answer

The exam covers ten domains: using transforming commands for visualisations, filtering and formatting results, correlating events, creating and managing fields, field aliases and calculated fields, tags and event types, macros, workflow actions, data models, and the Common Information Model (CIM) add-on. Correlating events carries the highest weighting at 15%.

Question 6

Do I need any prerequisites to take the SPLK-1002?

Accepted Answer

There are no formal prerequisites for the SPLK-1002. However, Splunk strongly recommends holding the Splunk Core Certified User (SPLK-1001) certification or having equivalent hands-on experience before attempting this exam. Candidates should be comfortable with basic SPL searching, fields, reports, and dashboards before progressing to the Power User material.

Question 7

How long is the SPLK-1002 certification valid?

Accepted Answer

The Splunk Core Certified Power User certification is valid for three years from the date of passing. To renew, candidates must either retake the exam or earn a higher-level Splunk certification before the expiry date. Splunk also offers continuing education credits as part of its certification maintenance programme.