A Splunk admin notices that the field `src_ip` is used in firewall logs, but the security team consistently searches for `source_ip` in their queries. The admin wants to make the security team's searches work without requiring them to change their queries. Which action should the admin take?

Create a field alias that maps `src_ip` to `source_ip`.

Rename the `src_ip` field to `source_ip` in the firewall logs.

Create a calculated field that copies `src_ip` to `source_ip`.

Use the `rename` command in every search.

What happens if a field alias is defined for a field that is also extracted by a field extraction?

The alias and the extracted field both exist, and the alias can be used to refer to the extracted field

The alias is only applied if the field extraction fails

The field extraction overrides the alias, and the alias is ignored

The alias overrides the field extraction, and the extracted field is no longer available

What is the primary purpose of a field alias in Splunk?

To extract a new field from raw event text using regular expressions

To create a new field by combining values from multiple existing fields

To rename a field for display purposes without changing the underlying data

To permanently rename a field in the indexed data

In Splunk, a field alias is best described as:

A field that is automatically extracted from all events in an index

A field that is only visible in the Fields sidebar, not in search results

A secondary name for an existing field that can be used in searches

A field that stores the result of a calculation performed on other fields

SplunkCore Certified Power User

Domain 5Objective 1

Describe, Create, and Use Field Aliases SPLK-1002 Practice Questions (Page 1)

Part of the Creating Field Aliases and Calculated Fields domain, which accounts for 10% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~3–4 in this domain), expect 2–2 from this objective — we provide 10 practice questions to prepare you well beyond it. (estimate)

10questions here

2free pages

4concepts

10%of the exam

Questions 1–5

1application · medium
A Splunk admin notices that the field `src_ip` is used in firewall logs, but the security team consistently searches for `source_ip` in their queries. The admin wants to make the security team's searches work without requiring them to change their queries. Which action should the admin take?
Select an answer first
2foundation · easy
What happens if a field alias is defined for a field that is also extracted by a field extraction?
Select an answer first
3application · easy
A user has a field alias that maps `user` to `username`. Which search will return events that contain the value `admin` in the original `user` field?
Select an answer first
4foundation · easy
What is the primary purpose of a field alias in Splunk?
Select an answer first
5foundation · easy
In Splunk, a field alias is best described as:
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.