Splunk SPLK-1002 - Core Certified Power User - Advanced SPL Knowledge Objects CIM Data Models Pivot

By Drew Nguyen · Updated Jul 10, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged1,656
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.3 (8)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

A Splunk analyst needs to use the `tstats` command for fast statistics on an accelerated data model. Which search correctly uses `tstats` against the "Network_Traffic" CIM data model?

Answer choices

  • A. `| tstats count FROM datamodel=Network_Traffic WHERE nodename=All_Traffic.src_ip BY All_Traffic.src_ip`

  • B. `| tstats count from datamodel="Network_Traffic" where All_Traffic.action=blocked by All_Traffic.src_ip`

  • C. `index=firewall | tstats count by src_ip`

  • D. `| stats count FROM datamodel=Network_Traffic by src_ip`

Question 2

A power user wants to create a correlation search that identifies when a user fails to log in 10 times followed by a successful login (suggesting a successful brute force). They need to correlate events over time. Beyond basic `stats`, what advanced command should they use?

Answer choices

  • A. `streamstats` to maintain a running count of failures per user and detect the threshold

  • B. `eventstats` to calculate statistics without grouping events

  • C. `appendcols` to add failure columns alongside success columns

  • D. `inputlookup` to query a pre-built table of known bad users

Question 3

A power user creates a Splunk dashboard with multiple panels that all reference the same base search. Instead of each panel running its own search, they want all panels to share a single search execution to reduce load. Which Splunk feature enables this?

Answer choices

  • A. Dashboard acceleration with a scheduled saved report

  • B. Post-Process Searches where a base search feeds multiple result-transformation subsearches

  • C. Search job sharing where the same job ID is referenced by multiple panels

  • D. Inline searches with identical search strings that Splunk automatically deduplicates

Question 4

A Splunk power user needs to create a reusable SPL macro that calculates the 95th percentile of response time. The macro should accept the field name as an argument. How should this macro be defined?

Answer choices

  • A. Create a saved search named `percentile_calc` with the SPL as the search string

  • B. Create a Search Macro named `percentile_macro(1)` with definition `perc95($field$)` and call it as `` `percentile_macro(response_ms)` ``

  • C. Create a lookup table containing pre-calculated percentile values

  • D. Create an Alert with the percentile calculation as the search string

Question 5

A power user needs to find all events where a specific pattern appears in any field (not just `_raw`), searching across all indexed fields simultaneously. Which Splunk command provides multi-field searching?

Answer choices

  • A. `index=* | search pattern=*` to search all field values

  • B. `| fieldsummary` to analyze field contents

  • C. Use `WHERE` clause with `like()` function on specific fields

  • D. The initial search keyword search checks against `_raw` and indexed fields; for specific fields use `field=value` syntax or `| search field=*pattern*`