A Splunk admin creates an event type named 'high_priority_errors' with the search string `error_level=critical`. Later, they notice that some critical events are not being tagged. They want to modify the event type to also include `error_level=alert` without breaking existing searches that reference the event type name. What should they do?

Use the `eventtype` command with the new search string in each search

Create a new event type named 'high_priority_errors_v2' with the expanded search string

Edit the event type in Settings > Event types and change the search string to `error_level=critical OR error_level=alert`

Delete the event type and recreate it with the same name and new search string

A team has 50 event types, and several are outdated. The admin wants to identify which event types are no longer used in any saved searches or dashboards before deleting them. What is the most efficient way to determine usage?

Review the list of event types in Settings > Event types and manually check each saved search and dashboard

Check the audit logs for event type creation dates

Use the `rest` command to search for event type usage in saved searches and dashboards

Delete all event types and recreate them as needed

A Splunk environment has an event type 'web_error' defined as `sourcetype=access_combined status>=400`. An analyst notices that some events with status=500 are not being tagged as 'web_error'. They also have an event type 'server_error' defined as `sourcetype=access_combined status=500` with a higher priority. What is the most likely reason for the missing tags?

Event types cannot match events with status codes above 499

The 'server_error' event type has a higher priority, so it takes precedence and the 'web_error' tag is not applied

The 'web_error' search string is incorrect because status>=400 does not match status=500

The events with status=500 are from a different sourcetype

A user wants to create an event type from a search they just ran. The search is `index=web status=404`. They want the event type to be named 'web_404_errors'. What is the correct way to do this from the search page?

Copy the search string and manually create the event type in Settings > Event types

Click 'Save As' > 'Event Type', enter the name, and confirm the search string

Use the `eventtype` command in the search and save the results

Click 'Save As' > 'Report', then convert the report to an event type

An admin needs to delete an event type that was created by mistake. They want to ensure that no saved searches reference it before deletion. What is the safest way to proceed?

Rename the event type instead of deleting it

Delete the event type immediately and recreate it if needed

Search for the event type name in all saved searches and dashboards, then delete the event type

Disable the event type instead of deleting it

SplunkCore Certified Power User

Domain 6Objective 3

Create an Event Type SPLK-1002 Practice Questions (Page 1)

Part of the Creating Tags and Event Types domain, which accounts for 10% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~3–4 in this domain), expect 1–1 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

5concepts

10%of the exam

Questions 1–5

1application · medium
A Splunk admin creates an event type named 'high_priority_errors' with the search string `error_level=critical`. Later, they notice that some critical events are not being tagged. They want to modify the event type to also include `error_level=alert` without breaking existing searches that reference the event type name. What should they do?
Select an answer first
2application · medium
A team has 50 event types, and several are outdated. The admin wants to identify which event types are no longer used in any saved searches or dashboards before deleting them. What is the most efficient way to determine usage?
Select an answer first
3expert · hard
A Splunk environment has an event type 'web_error' defined as `sourcetype=access_combined status>=400`. An analyst notices that some events with status=500 are not being tagged as 'web_error'. They also have an event type 'server_error' defined as `sourcetype=access_combined status=500` with a higher priority. What is the most likely reason for the missing tags?
Select an answer first
4application · medium
A user wants to create an event type from a search they just ran. The search is `index=web status=404`. They want the event type to be named 'web_404_errors'. What is the correct way to do this from the search page?
Select an answer first
5application · medium
An admin needs to delete an event type that was created by mistake. They want to ensure that no saved searches reference it before deletion. What is the safest way to proceed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.

Create an Event Type SPLK-1002 Practice Questions (Page 1)

Questions 1–5

A team has 50 event types, and several are outdated. The admin wants to identify which event types are no longer used in any saved searches or dashboards before deleting them. What is the most efficient way to determine usage?

A user wants to create an event type from a search they just ran. The search is `index=web status=404`. They want the event type to be named 'web_404_errors'. What is the correct way to do this from the search page?

An admin needs to delete an event type that was created by mistake. They want to ensure that no saved searches reference it before deletion. What is the safest way to proceed?

Keep studying — Creating Tags and Event Types