thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Splunk · Cybersecurity · Associate

Splunk Core Certified Power User exam guide

Exam SPLK-1002

Splunk Core Certified Power User validates advanced searching and knowledge objects: field extractions, aliases, calculated fields, event types, tags, macros, workflow actions and data models (CIM). It is commonly requested for SOC and Splunk content engineering roles.

Questions65
Time limit60 minutes
Passing scoreSee official page
Exam fee$130 USD
Valid for3 years
DeliveryPearson VUE test center or online proctored

Format: Multiple choice. Fee note: Per attempt.

Who it's for

Splunk users who build searches, knowledge objects and dashboards for others.

What the exam covers

The vendor does not publish a domain breakdown for this exam. Check the official exam page for the current objectives.

Eligibility & prerequisites

Required: None

Recommended: Splunk Fundamentals-level knowledge; Core Certified User is recommended.

Keeping it active

Splunk certifications are valid 3 years; recertify by passing the current exam or a higher-level exam in the same track.

Skills & careers

Skills it validates

  • Transforming and statistical commands
  • Field extractions, aliases and calculated fields
  • Event types, tags and macros
  • Workflow actions
  • Data models and the CIM
  • Normalizing data

Job roles

SOC AnalystSplunk DeveloperSecurity EngineerDetection EngineerIT Operations Analyst

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Review SPLK-1001 content and the SPLK-1002 blueprint.
  2. Week 2: Knowledge objects in a Splunk trial.
  3. Week 3: Data models, CIM and macros.
  4. Week 4: Practice questions.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know how CIM data models are accelerated and used.
  • Understand field extraction methods.
  • Practice macros with arguments.
  • Read questions for knowledge-object permissions.

Key terms for this exam

All 23 terms Study with thinQcards™

Frequently asked questions

How much is SPLK-1002?

$130 USD.

How many questions?

65 in 60 minutes.

Prerequisites?

None formally.

How long is it valid?

3 years.

What next?

Splunk Enterprise Certified Admin or Splunk Cloud admin certifications.

Official page: www.splunk.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.