Free SPLK-1002 mock test – Exam 2

Splunk Core Certified Power User

Free SPLK-1002 practice exam for Splunk Core Power User prep.

Use this free SPLK-1002 practice exam to review Splunk SPL searches, fields, lookups, reports, dashboards, alerts, macros, event types, tags, workflow actions, and knowledge objects.

10 exam-style questionsQuiz Maker examDetailed option explanationsNo signup required

Start Practice Exam 2 below. Answer each question first, then review why each option is correct or incorrect.

SPLK-1002 Practice Exam 2

Free SPLK-1002 practice exam 2 with 10 original questions on SPL, reports, dashboards, lookups, fields, alerts, macros, and Splunk knowledge objects.

1 / 10

Question

A search must return the top 10 source IP addresses by event count. Which command is most direct?

Which option best meets the requirement?

A. top src_ip limit=10.

B. rare src_ip limit=10.

C. fields src_ip limit=10.

D. rename src_ip as top.

2 / 10

Question

Which search returns events where either action is blocked or signature contains malware?

Which option best meets the requirement?

A. index=security action=blocked AND signature=malware

B. index=security (action=blocked OR signature=*malware*)

C. index=security action=blocked | OR signature=malware

D. index=security action=blocked signature!=malware

3 / 10

Question

A user wants to normalize vendor field clientip to the common field src_ip without changing raw events. Which knowledge object can help?

Which option best meets the requirement?

A. Index retention setting.

B. License pool.

C. Field alias.

D. Fishbucket reset.

4 / 10

Question

When should a calculated field be used?

Which option best meets the requirement?

A. To change the index name of old data.

B. To delete events from disk.

C. To assign a deployment server class.

D. To create a search-time field from an eval expression automatically.

5 / 10

Question

A scheduled alert runs every 15 minutes and should not create repeated tickets for the same host for one hour. Which setting is most relevant?

Which option best meets the requirement?

A. Alert throttling or suppression.

B. Search mode verbose.

C. Field discovery off.

D. Dashboard dark mode.

6 / 10

Question

Which report action allows users to receive scheduled search results by email?

Which option best meets the requirement?

A. Add to event type only.

B. Reset fishbucket.

C. Schedule PDF or email delivery for the report.

D. Change the source type.

7 / 10

Question

Which search is most appropriate for creating a timechart of average response time by service?

Which option best meets the requirement?

A. index=app | table _time service response_time.

B. index=app | timechart avg(response_time) by service.

C. index=app | dedup response_time by service.

D. index=app | fields - _time.

8 / 10

Question

A workflow action should open an external ticket system using the event's ticket_id field. What must the action include?

Which option best meets the requirement?

A. An indexer cluster manager.

B. A frozen bucket path.

C. Only a license pool.

D. A URL or action definition that uses field substitution for ticket_id.

9 / 10

Question

Which knowledge objects commonly support Common Information Model style normalization? (Choose THREE.)

Choose all options that meet the requirement.

A. Field aliases.

B. Calculated fields.

C. License warnings.

D. Search job artifacts only.

E. Event types and tags.

Correct Answer: A, B, E

Explanation

A. Correct.
This is the best answer because Field aliases help map vendor fields to normalized field names. In easy words, option A matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
B. Correct.
This is the best answer because Calculated fields can derive normalized values at search time. In easy words, option B matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
License warnings do not normalize event fields. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Job artifacts are not knowledge objects for data normalization. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
E. Correct.
This is the best answer because Event types and tags are commonly used to categorize normalized datasets. In easy words, option E matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.

Correct Answer: A, B, E

Explanation

A. Correct.
This is the best answer because Field aliases help map vendor fields to normalized field names. In easy words, option A matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
B. Correct.
This is the best answer because Calculated fields can derive normalized values at search time. In easy words, option B matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
License warnings do not normalize event fields. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Job artifacts are not knowledge objects for data normalization. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
E. Correct.
This is the best answer because Event types and tags are commonly used to categorize normalized datasets. In easy words, option E matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.

Correct Answer: A, B, E

Explanation

A. Correct.
This is the best answer because Field aliases help map vendor fields to normalized field names. In easy words, option A matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
B. Correct.
This is the best answer because Calculated fields can derive normalized values at search time. In easy words, option B matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
License warnings do not normalize event fields. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Job artifacts are not knowledge objects for data normalization. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
E. Correct.
This is the best answer because Event types and tags are commonly used to categorize normalized datasets. In easy words, option E matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.

10 / 10

Question

A power user changes a private dashboard and wants the whole app team to use it. What should be checked?

Which option best meets the requirement?

A. The dashboard sharing permissions and app context.

B. The indexer replication factor.

C. The deployment server phonehome interval.

D. The rawdata journal size.

Correct Answer: A

Explanation

A. Correct.
This is the best answer because Knowledge object visibility depends on ownership, app context, and sharing permissions. In easy words, option A matches what the question is asking you to do with dashboard behavior, panels, reports, or visual layout. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
B. Incorrect.
Replication factor affects indexed data availability, not dashboard visibility. In easy words, option B may sound related, but it does not fix the actual requirement in this question. The question is testing dashboard behavior, panels, reports, or visual layout, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
C. Incorrect.
Phonehome controls deployment clients, not dashboard sharing. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing dashboard behavior, panels, reports, or visual layout, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Rawdata size does not control knowledge object permissions. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing dashboard behavior, panels, reports, or visual layout, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

Correct Answer: A

Explanation

A. Correct.
This is the best answer because Knowledge object visibility depends on ownership, app context, and sharing permissions. In easy words, option A matches what the question is asking you to do with dashboard behavior, panels, reports, or visual layout. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
B. Incorrect.
Replication factor affects indexed data availability, not dashboard visibility. In easy words, option B may sound related, but it does not fix the actual requirement in this question. The question is testing dashboard behavior, panels, reports, or visual layout, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
C. Incorrect.
Phonehome controls deployment clients, not dashboard sharing. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing dashboard behavior, panels, reports, or visual layout, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Rawdata size does not control knowledge object permissions. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing dashboard behavior, panels, reports, or visual layout, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

Correct Answer: A

Explanation

A. Correct.
This is the best answer because Knowledge object visibility depends on ownership, app context, and sharing permissions. In easy words, option A matches what the question is asking you to do with dashboard behavior, panels, reports, or visual layout. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
B. Incorrect.
Replication factor affects indexed data availability, not dashboard visibility. In easy words, option B may sound related, but it does not fix the actual requirement in this question. The question is testing dashboard behavior, panels, reports, or visual layout, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
C. Incorrect.
Phonehome controls deployment clients, not dashboard sharing. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing dashboard behavior, panels, reports, or visual layout, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Rawdata size does not control knowledge object permissions. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing dashboard behavior, panels, reports, or visual layout, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

Your score is

The average score is 80%

What Practice Exam 2 covers

SPL command types including streaming, transforming, filtering, and formatting commands
Search-time field discovery, extraction, calculated fields, aliases, and field normalization
Report acceleration, scheduled reports, alert triggers, throttling, and result actions
Dashboard panels, drilldowns, tokens, time pickers, and workflow actions
Knowledge object management, permissions, tags, event types, macros, and lookup maintenance

Who should take this free mock test

Use this SPLK-1002 practice exam if you are preparing for the Splunk Core Certified Power User certification and want scenario-based review with detailed answer explanations.

Browse Splunk practice exams Visit DevOpsEngine

FAQ

Is this SPLK-1002 practice exam free?

Yes. This Splunk Core Certified Power User mock test is free to open and retake.

Does this practice exam use Quiz Maker?

Yes. The questions are published as a Quiz Maker exam with answer checking and detailed explanations.

Are these official Splunk exam questions?

No. These are original independent practice questions based on SPLK-1002 topic coverage, not official exam dumps.

Free SPLK-1002 practice exam for Splunk Core Power User prep.

Question

Correct Answer: A

Explanation

Correct Answer: A

Explanation

Correct Answer: A

Explanation

Question

Correct Answer: B

Explanation

Correct Answer: B

Explanation

Correct Answer: B

Explanation

Question

Correct Answer: C

Explanation

Correct Answer: C

Explanation

Correct Answer: C

Explanation

Question

Correct Answer: D

Explanation

Correct Answer: D

Explanation

Correct Answer: D

Explanation

Question

Correct Answer: A

Explanation

Correct Answer: A

Explanation

Correct Answer: A

Explanation

Question

Correct Answer: C

Explanation

Correct Answer: C

Explanation

Correct Answer: C

Explanation

Question

Correct Answer: B

Explanation

Correct Answer: B

Explanation

Correct Answer: B

Explanation

Question

Correct Answer: D

Explanation

Correct Answer: D

Explanation

Correct Answer: D

Explanation

Question

Correct Answer: A, B, E

Explanation

Correct Answer: A, B, E

Explanation

Correct Answer: A, B, E

Explanation

Question

Correct Answer: A

Explanation

Correct Answer: A

Explanation

Correct Answer: A

Explanation

What Practice Exam 2 covers

Who should take this free mock test

FAQ

Is this SPLK-1002 practice exam free?

Does this practice exam use Quiz Maker?

Are these official Splunk exam questions?