Latest Splunk SPLK-1002 Dumps Splunk Core Certified Power User Questions | Exam4Help
                     Splunk
SPLK-1002 Dumps
Splunk Core Certified Power User Exam
SPLK-1002  Dumps  PDF
Exam Description
The Splunk Core Certified Power User exam is the final step towards completion of the 
Splunk Core Certified Power User certification. This next-level certification exam is a 57-
minute, 65-question assessment which evaluates a candidate’s knowledge and skills of field 
aliases and calculated fields, creating tags and event types, using macros, creating workflow 
actions and data models, and normalizing data with the CIM. Candidates can expect an 
additional 3 minutes to review the exam agreement, for a total seat time of 60 minutes. 
Candidates for this certification must complete the lecture, hands-on labs, and quizzes that 
are part of the Splunk Fundamentals 2 course in order to be eligible for the certification 
exam. Splunk Core Certified Power User is a required prerequisite to the Splunk Enterprise 
Certified Admin certification track.
SPLK-1002  Dumps  Materiiall
Exam Topics
 Transforming commands and visualizations
 Filtering and formatting results
 Correlating events
 Knowledge objects
 Fields (field aliases, field extractions, calculated fields)
 Tags and event types
 Macros
 Workflow actions
 Data models
 Splunk Common Information Model (CIM)
Sample Questions
Question: 1
Which of the following Statements about macros is true? (select all that apply)
A. Arguments are defined at execution time.
B. Arguments are defined when the macro is created.
C. Argument values are used to resolve the search string at execution time.
D. Argument values are used to resolve the search string when the macro is created.
Answer: A, C
SPLK-1002  Questiion  Answers
Question: 2
What is required for a macro to accept three arguments?
A. The macro's name ends with (3).
B. The macro's name starts with (3).
C. The macro's argument count setting is 3 or more.
D. Nothing, all macros can accept any number of arguments.
Answer: A
SPLK-1002  Dumps  Materiiall
Question: 3
Which of the following statements describes POST workflow actions?
A. POST workflow actions are always encrypted.
B. POST workflow actions cannot use field values in their URI.
C. POST workflow actions cannot be created on custom sourcetypes.
D. POST workflow actions can open a web page in either the same window or a new .
Answer: D
SPLK-1002  Dumps  Materiiall
Question: 4
Which of the following workflow actions can be executed from search results? (select all that apply)
A. GET
B. POST
C. LOOKUP
D. Search
Answer: A, B, D
SPLK-1002  Dumps  Materiiall
Question: 5
Which of the following is the correct way to use the data model command to search field in the 
data model within the web dataset?
A. | datamodel web search | filed web *
B. | Search datamodel web web | filed web*
C. | datamodel web web field | search web*
D. Datamodel=web | search web | filed web*
Answer: A
SPLK-1002  Dumps  PDF