A Splunk admin is preparing to onboard a new data source and wants to ensure it is CIM-compliant. They have installed the CIM Add-On. Which set of knowledge objects should they review to understand what is already provided for this data source?

Only the data models, since they define the structure

Event types, tags, field extractions, lookups, and data models

Only the field extractions, since they normalize the data

Only the lookups, since they enrich the data

What is the role of lookups in the Splunk CIM Add-On?

To extract fields from raw data

To categorize data into logical groups

A Splunk admin is planning to onboard a new data source that is not currently supported by the CIM Add-On. They want to make the data CIM-compliant. What is the most appropriate approach?

Use a generic lookup to map all fields to CIM standard names

Disable the CIM Add-On for this data source and use manual searches

Create custom event types, tags, field extractions, and lookups to map the data to the appropriate CIM data model

Modify the existing CIM data models to include the new data source

SplunkCore Certified Power User

Domain 10Objective 2

List the Knowledge Objects Included with the Splunk CIM Add-On SPLK-1002 Practice Questions (Page 4)

Part of the Using the Common Information Model (CIM) Add-On domain, which accounts for 10% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~3–4 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

6concepts

10%of the exam

Questions 16–20

16application · medium
A Splunk admin is preparing to onboard a new data source and wants to ensure it is CIM-compliant. They have installed the CIM Add-On. Which set of knowledge objects should they review to understand what is already provided for this data source?
Select an answer first
17foundation · easy
Which of the following is a lookup bundled with the CIM Add-On?
Select an answer first
18foundation · easy
What is the role of lookups in the Splunk CIM Add-On?
Select an answer first
19expert · hard
A Splunk admin is planning to onboard a new data source that is not currently supported by the CIM Add-On. They want to make the data CIM-compliant. What is the most appropriate approach?
Select an answer first
20foundation · easy
Which of the following is a category of knowledge object included in the Splunk CIM Add-On?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.

List the Knowledge Objects Included with the Splunk CIM Add-On SPLK-1002 Practice Questions (Page 4)

Questions 16–20

A Splunk admin is preparing to onboard a new data source and wants to ensure it is CIM-compliant. They have installed the CIM Add-On. Which set of knowledge objects should they review to understand what is already provided for this data source?

Which of the following is a lookup bundled with the CIM Add-On?

What is the role of lookups in the Splunk CIM Add-On?

A Splunk admin is planning to onboard a new data source that is not currently supported by the CIM Add-On. They want to make the data CIM-compliant. What is the most appropriate approach?

Which of the following is a category of knowledge object included in the Splunk CIM Add-On?

Keep studying — Using the Common Information Model (CIM) Add-On