An analyst runs a search against the CIM Authentication data model and notices that some events are missing. The events are tagged correctly and have the correct source type. What is the most likely reason?

The data model is not accelerated.

The events are not being indexed.

The search is using the wrong time range.

The events do not have all the required fields for the Authentication data model.

During troubleshooting, you find that the 'src' field in your events is empty, but the original log contains 'source_ip'. What is the likely issue?

The field alias mapping 'source_ip' to 'src' is not configured or is not working

The 'src' field is not a valid CIM field

The data model acceleration is not enabled

The events are not being indexed

A team has configured the CIM Add-On for a new data source, but the events are not showing the expected CIM field names. The tags are correct. What is the most likely cause?

The events are being indexed into the wrong index.

The data model is not accelerated.

The CIM Add-On is not installed on the search head.

The field aliases for the source are not defined in the CIM Add-On.

An organization is adding a new data source for VPN logs. The logs contain authentication success and failure events. The team wants these events to be searchable using the CIM Authentication data model. What must be done to ensure the events are normalized?

Create a new index for the VPN logs and set the index to be CIM-compliant.

Enable the CIM Add-On and it will automatically normalize all incoming data without any configuration.

Use the field extractor to manually create all CIM fields for each event.

Configure the source type to match a CIM-compatible source type and ensure the events are tagged with authentication.

What is the primary action performed during the normalization process in the CIM Add-On?

Deleting all fields that are not defined in the CIM data model

Converting all event timestamps to UTC timezone

Mapping source-specific field names to CIM-compliant field names

Compressing events to reduce index size

SplunkCore Certified Power User

Domain 10Objective 3

Use the CIM Add-On to Normalize Data SPLK-1002 Practice Questions (Page 5)

Part of the Using the Common Information Model (CIM) Add-On domain, which accounts for 10% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~3–4 in this domain), expect 1–1 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

6concepts

10%of the exam

Questions 21–25

21application · medium
An analyst runs a search against the CIM Authentication data model and notices that some events are missing. The events are tagged correctly and have the correct source type. What is the most likely reason?
Select an answer first
22foundation · easy
During troubleshooting, you find that the 'src' field in your events is empty, but the original log contains 'source_ip'. What is the likely issue?
Select an answer first
23application · medium
A team has configured the CIM Add-On for a new data source, but the events are not showing the expected CIM field names. The tags are correct. What is the most likely cause?
Select an answer first
24application · medium
An organization is adding a new data source for VPN logs. The logs contain authentication success and failure events. The team wants these events to be searchable using the CIM Authentication data model. What must be done to ensure the events are normalized?
Select an answer first
25foundation · easy
What is the primary action performed during the normalization process in the CIM Add-On?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.