You can see it againUnder pressure people bring back shapes and positions long after the wording has gone.
Picture superiority · Shepard 1967, Standing 1973
SPLUNKSplunk Core Certified Power User
The Splunk Core Certified Power User certification validates your ability to use Splunk Enterprise and Splunk Cloud to search, report, and create knowledge objects. It is designed for users who want to move beyond basic searching and start building workflow actions, data models, and normalized data. Earning this credential demonstrates you can turn raw machine data into actionable insights and sets you on the path to advanced Splunk roles.
Exam formatMultiple choice
Duration60 minutes
DeliveryPearson VUE
Free questions494
Content last reviewed 30 July 2026 · Up to date
The certification
What SPLK-1002 proves, and what it asks of you
What this certification covers, who it is written for, and what the exam itself looks like on the day.
10domains
32objectives
189concepts
$130 USDexam fee
What it is
What this certification is
What it validates, who it is written for, and the experience it assumes.
About this certification
The Splunk Core Certified Power User certification confirms your foundational competence with Splunk's core software, from commands and knowledge objects to fields, tags, macros, workflow actions, and data models. It is the natural next step after the Splunk Core Certified User credential, helping you stand out as someone who can deliver more value from Splunk data.
This certification is for IT professionals, career changers, and Splunk enthusiasts who want to solidify their skills and unlock new opportunities. By earning it, you demonstrate that you can create workflow actions, event types, and data models, use field aliases, calculated fields, and macros, and normalize data for Splunk. It is the gateway to advanced certifications like Advanced Power User, Admin, Architect, or Consultant.
Who it’s for
This certification is for IT professionals who use Splunk Enterprise or Splunk Cloud and want to demonstrate their ability to search, report, and create knowledge objects. It is also ideal for career changers entering the big data field and Splunk enthusiasts who want to formalize their expertise. Candidates typically have some hands-on experience with Splunk and are comfortable with basic searching and reporting. They are looking to deepen their knowledge of SPL commands, knowledge objects, and data normalization to become more effective in their roles.
Recommended experience
While there are no mandatory prerequisites, Splunk recommends that candidates have completed the Splunk Core Certified User certification or have equivalent experience using Splunk Enterprise or Splunk Cloud. Familiarity with basic Splunk searching and reporting; Experience creating simple reports and dashboards; Understanding of fields, lookups, and basic knowledge objects
The syllabus
What you’ll learn
Every domain and objective Splunk measures, with the weight they carry on the exam.
The official Splunk exam outline · checked 30 July 2026 · See the source
Using Transforming Commands for Visualizations
- Use the chart command
- Use the timechart command
Filtering and Formatting Results
- The eval command
- Use the search and where commands to filter results
- The fillnull command
Correlating Events
- Identify transactions
- Group events using fields
- Group events using fields and time
- Search with transactions
- Report on transactions
- Determine when to use transactions vs. stats
Creating and Managing Fields
- Perform regex field extractions using the Field Extractor (FX)
- Perform delimiter field extractions using the FX
Creating Field Aliases and Calculated Fields
- Describe, create, and use field aliases
- Describe, create, and use calculated fields
Creating Tags and Event Types
- Create and use tags
- Describe event types and their uses
- Create an event type
Creating and Using Macros
- Describe macros
- Create and use a basic macro
- Define arguments and variables for a macro
- Add and use arguments with a macro
Creating and Using Workflow Actions
- Describe the function of GET, POST, and Search workflow actions
- Create a GET workflow action
- Create a POST workflow action
- Create a Search workflow action
Creating Data Models
- Describe the relationship between data models and pivot
- Identify data model attributes
- Create a data model
Using the Common Information Model (CIM) Add-On
- Describe the Splunk CIM
- List the knowledge objects included with the Splunk CIM Add-On
- Use the CIM Add-On to normalize data
On the day
The exam itself
Everything Splunk publishes about sitting it, and nothing we inferred.
Prerequisites
No mandatory prerequisites — this certification has no required predecessor exam or credential.
Exam codeSPLK-1002
CertificationSplunk Core Certified Power User
Exam formatMultiple choice
Duration60 minutes
Questions65 questions
DeliveryPearson VUE
LanguagesEnglish
Pricing$130 USD
After you pass
Where this credential goes next
The path Splunk lays out, how the credential is kept, and where to book.
Step-by-step path to Splunk Core Certified Power User
Credential earnedSplunk Core Certified Power User Certification Renewal and maintenance
Splunk certifications must be renewed every three years. You can renew by passing a higher-level certification, completing continuing education courses, or retaking the certification exam. Stay current with the latest technologies and maintain your certification.
Learn more about renewal requirements Lifecycle status
This certification is currently active and available. Splunk maintains this certification to validate current skills and industry relevance.
Exam status: ActiveMaintained by Splunk
Exam registration
Register for the exam through Pearson VUE, Splunk’s authorized testing partner.
Schedule your examVisit the official Splunk certification page for exam policies and requirements.
View the official pageYour coach
And when you are serious, your coach Pip takes over
Your coach in the app reads what you have answered with the book closed and tells you one thing to do tonight. It will not count an answer you gave with the page open, and it will tell you when you are not ready.
See how the coach worksBefore you book
Questions people ask
How does the Splunk Core Certified Power User exam relate to the Splunk Core Certified User exam?
The Power User exam builds on the skills validated by the Core Certified User exam. While the Core Certified User certification is not required, it is recommended as a foundational step before attempting the Power User exam.
Do I need to earn the Splunk Core Certified User certification before taking the Power User exam?
No, the Power User exam has no mandatory prerequisites. However, Splunk recommends that candidates have completed the Core Certified User certification or have equivalent experience.
Is there a hands-on or lab component in the SPLK-1002 exam?
No, the exam consists of 65 multiple-choice questions only. There is no hands-on or lab section.
What is the retake policy if I fail the SPLK-1002 exam?
Splunk's retake policy requires a waiting period of 24 hours before retaking a failed exam. Subsequent attempts require a 14-day waiting period.
What job roles does the Splunk Core Certified Power User credential map to?
This credential is designed for IT professionals, data analysts, and Splunk users who want to demonstrate their ability to search, report, and create knowledge objects. It is a stepping stone to roles like Splunk Administrator, Architect, or Consultant.
Can I recertify by passing a different Splunk exam?
Yes, passing a higher-level Splunk certification, such as the Splunk Core Certified Advanced Power User or any Admin-level certification, will renew your Power User certification.
Information freshness · Content last reviewed on 2026-07-30 Up to date
Practice free questions 494 questions, free, no account needed.
The curriculum
The whole exam, mapped and written
Every domain, every objective, and every concept Splunk measures — each one written out.
10domains
32objectives
189concepts
110free pages
The domains, and what sits inside them
Every objective below is a page you can open and practise now, without an account.
The official Splunk exam outline · checked 30 July 2026 · See the source
1Using Transforming Commands for Visualizations31 questions
2Filtering and Formatting Results48 questions
3Correlating Events83 questions
Identify transactions5 concepts · 2 pagesOpen →Group events using fields1 concepts · 1 pagesOpen →Group events using fields and time3 concepts · 4 pagesOpen →Search with transactions6 concepts · 4 pagesOpen →Report on transactions6 concepts · 4 pagesOpen →Determine when to use transactions vs. stats7 concepts · 4 pagesOpen →
4Creating and Managing Fields28 questions
5Creating Field Aliases and Calculated Fields18 questions
6Creating Tags and Event Types40 questions
7Creating and Using Macros48 questions
8Creating and Using Workflow Actions74 questions
9Creating Data Models48 questions
10Using the Common Information Model (CIM) Add-On76 questions
Not a table of contents
Every line on this map already opens
In front of every objective the practice pages are already there, free and without an account. This is one objective, opened.
Use the chart command3 pagesOpen →
Free in front of it
12 questions on this objective, five to a page. Every range above is a real page, open now, with no account.
Reading the map is not the same as knowing the ground
The curriculum tells you what is on the exam. Proving you know it is a different job — and it is the one the closed-book run does.
Free questions
494 questions. No account, no card.
The whole bank is open. 5 questions to a page, every answer explained, and a discussion thread on each one.
494questions
110pages
32objectives
Freealways
Browse by domain
Every objective, and every page range, is a link — so you can pick up exactly where you left off.
1Using Transforming Commands for Visualizations31 questions
2Filtering and Formatting Results48 questions
3Correlating Events83 questions
4Creating and Managing Fields28 questions
5Creating Field Aliases and Calculated Fields18 questions
6Creating Tags and Event Types40 questions
7Creating and Using Macros48 questions
8Creating and Using Workflow Actions74 questions
9Creating Data Models48 questions
10Using the Common Information Model (CIM) Add-On76 questions
What a practice page gives you
1Five to a page
Short enough to finish, long enough to matter.
2Every answer explained
Not only which one is right — why the others are wrong.
3A discussion on each
Ask, answer, and vote. Every question has its own thread.
A question, and the idea behind it
Every question comes from a concept
These are not trivia. Each one is written against a concept in the book, so when you get one wrong there is somewhere to go and find out why.
The visual book
See it once. Carry it into the exam.
The pages shown here come from our AI-900 book — an example of how each concept is written in plain language and, where the idea needs one, drawn as a full page you can take in at a glance.
189concepts
494free questions
Why a picture, and not another paragraph
Three reasons, and each one is a real finding rather than a slogan.
You can see it againThe whole idea at onceWhere it starts, what happens in the middle, what comes out, and the mistake to avoid.
Multimedia principle · MayerThe look-alikes sit togetherThe pairs the exam tests are drawn side by side, so the difference is seen, not told.
Dual coding · PaivioWhat one page is made of
You are never asked to read a poster here — only to see how one is built. After that, every other page is legible at a glance.
1A numbered strip on top
The idea as a sequence, followed with a finger before a word is read.
2Panels for the parts
What it is, how the machine learns it, when it is the right tool.
3The trap, framed
The distinction the exam tests, given its own box instead of buried in prose.
4One line at the bottom
The sentence to carry into the exam room.
Open book, on purpose
Answer it with the picture beside you
This is the part that teaches. The illustration and the written explanation stay where they are while you work, so a scenario stops being a memory test and becomes something you can simply look at.
It teaches · it does not count
A smartphone uses AI to unlock when the owner looks at the camera. Which AI capability is being used?
AImage classification
BFacial recognition
COptical character recognition
DObject detection
Look at the five steps. Detect finds a face, align straightens it, encode turns it into numbers, search compares it with a stored face, and decide answers one question: is this the same person? Classification would only say “a face”. Detection would only draw a box. Neither decides whose.
Then the page shuts, and it starts counting
The same questions come back with the book closed — that run is the one that counts. After it, your coach picks one thing for tonight, sized to the time you have, and brings pages back before you lose them.
Testing effect · Roediger & Karpicke 2006 · spacing effect · Cepeda et al. 2006
Official resources
Straight from Splunk
Where the exam is defined, scheduled and scored.
3official links
189concepts mapped
The source
Splunk’s own pages
We link to them rather than repeat them, so nothing here goes stale behind them.
Checked against the source
Every objective on the official Splunk outline already has questions here
We build from the official skills outline, not from a summary of it — 32 objectives, 189 concepts written under them, and free questions against every one. When Splunk changes the outline, this page changes with it.
32objectives on the outline→189concepts written→494free questions
An official page tells you what will be asked. It cannot tell you what you will get right.
That is the only question worth answering the night before, and no link answers it. You answer it by taking the questions with the book closed, and seeing what comes back.