SPLK-1002
Splunk Core Certified Power User Exam
SPLK-1002 Exam Guide: Scope, Preparation, and Scheduling Decisions
SPLK-1002 is commonly used to identify the Splunk Core Certified Power User exam. Splunk’s current certification page describes this as an entry-level credential for users of both Splunk Enterprise and Splunk Cloud, focused on stronger searching, reporting, knowledge objects, workflow actions, and data normalization. The official materials reviewed do not display the code “SPLK-1002” in their visible text, so confirm the credential name before purchasing. This guide helps you decide whether your current skills are ready, which blueprint domains deserve study time, how to build practical exercises, and whether a Pearson VUE test center or online appointment suits your circumstances.
What does SPLK-1002 validate?
The exam validates practical power-user skills beyond basic searching. Its stated coverage includes searching and reporting, workflow actions, event types, knowledge objects, data models, field aliases, calculated fields, macros, and data normalization with Splunk CIM. The certification applies to users of both Splunk Enterprise and Splunk Cloud.
The credential is currently identified in Splunk’s official materials as Splunk Core Certified Power User. Splunk describes it as an entry-level exam and positions it around strengthening searching and reporting capabilities and delivering more value as a power user.
That scope matters when choosing a study approach. This is not a sensible exam to prepare for by memorizing isolated SPL fragments. You need to recognize which knowledge object or search technique fits a requirement, understand how a result is changed by a command, and distinguish similar approaches such as transactions and stats.
The exam was previously available as Splunk Phantom Certified Admin, according to Pearson VUE’s Splunk exam information. If an older training record, voucher, or search result uses that name, compare it with the current Splunk Core Certified Power User listing before scheduling.
Who is the exam designed for?
The exam is a reasonable target for a Splunk user who can already search data and now needs to manage reusable search behavior, reporting outputs, and other knowledge objects. It can also suit a candidate building toward administration, architecture, or consulting work, but those later roles are not prerequisites for this exam.
Splunk classifies the exam as entry-level and lists no prerequisite certifications or prerequisite courses. That removes a formal gate, not the need for working familiarity. A candidate without hands-on exposure should first establish the basic search and reporting concepts that the power-user domains build upon.
Splunk’s separate Core Certified User page describes the user credential as demonstrating a strong understanding of Splunk Enterprise and Splunk Cloud basics, including searches, fields, lookups, alerts, basic statistical reports, and dashboards. Use that description as a readiness reference rather than assuming the user certification is required.
A practical decision follows: if you are still learning how searches, fields, lookups, alerts, and dashboards work, build that foundation first. If those tasks are familiar and your weakness is reusable configuration or data-model concepts, move directly to the power-user blueprint and diagnose the weaker domains.
How is the blueprint weighted?
Use the official blueprint percentages to allocate study effort, but do not treat them as a prediction of individual question wording. The blueprint assigns 15% to correlating events, including transactions, grouping events, and choosing between transactions and stats; this is the largest named domain and deserves deliberate practice.
The blueprint assigns 10% to filtering and formatting results, covering eval, search, where, and fillnull. Practice should focus on what each command changes in the result set and when one approach is more appropriate than another.
The blueprint assigns 5% to transforming commands for visualizations, including chart and timechart. This is the smallest named domain, but it is still a distinct tested area; learn the purpose and output behavior of the listed commands instead of dropping it from your plan.
The blueprint assigns 10% to creating and managing fields. It separately assigns 10% to field aliases and calculated fields, 10% to tags and event types, 10% to macros, 10% to workflow actions, and 10% to data models.
The blueprint assigns 10% to using the Common Information Model Add-on, including describing CIM, identifying its knowledge objects, and normalizing data with CIM. Treat CIM as an applied data-normalization topic, not simply a vocabulary exercise.
A useful allocation rule is to begin with the 15% correlating-events domain, then cover the six 10% domains that involve reusable objects, fields, actions, models, and CIM. Finish with filtering and formatting and the 5% transforming-commands domain, while revisiting every area through mixed practice. The percentages identify official domains; they do not establish a passing score.
Which skills should you practise first?
Start with the decision-heavy subjects: event correlation, field behavior, and knowledge-object selection. These topics require you to interpret a requirement and choose a suitable Splunk feature, which is more demanding than recalling a command name without context.
For correlating events, create small searches that let you inspect grouped events and compare a transaction-oriented approach with stats. Record what relationship you are trying to preserve, what fields identify the relationship, and what output you actually need. The point is to explain the choice, not merely reproduce syntax.
For filtering and formatting, vary the position and purpose of eval, search, where, and fillnull in controlled exercises. Ask whether a condition should filter events or search results, whether a field must be calculated, and how null values affect the final output.
For transforming commands, use chart and timechart to produce different visual views from a known result set. Check which fields become dimensions, which become measures, and how time changes the shape of the output. Keep this work separate from ordinary filtering so you can identify visualization errors quickly.
For fields and knowledge objects, build a comparison sheet in your own words: field creation and management, aliases, calculated fields, tags, event types, macros, workflow actions, and data models. For each item, write its purpose, the problem it solves, and an example of when it should not be selected.
For CIM, practise identifying the relevant knowledge objects and explaining how normalization makes data usable against a common model. Do not rely on a label-only definition. Your study note should connect CIM to the task of making differently sourced data conform to shared field and data-model expectations.
Which official courses can structure preparation?
Splunk’s recommended preparation sequence provides a useful starting framework: Working with Time, Statistical Processing, Comparing Values, Result Modification, Correlation Analysis, Creating Knowledge Objects, Creating Field Extractions, and Data Models. Use the courses to close specific blueprint gaps rather than completing them passively in an arbitrary order.
A candidate who struggles with search logic should begin with Working with Time, Statistical Processing, Comparing Values, and Result Modification. These topics support the reporting, filtering, formatting, and comparison work that feeds later correlation exercises.
Correlation Analysis should follow once the underlying result-handling concepts are comfortable. Then study Creating Knowledge Objects and Creating Field Extractions alongside the blueprint domains for fields, aliases, calculated fields, tags, event types, macros, and workflow actions.
Place Data Models and CIM study after you understand how fields and knowledge objects shape search behavior. That sequence makes normalization easier to reason about because you can connect the model to the fields and objects used by searches.
Courses alone are not a readiness test. After each course, write a short explanation of the feature, perform a small practical exercise, and note one confusing alternative. If you cannot explain why your chosen approach fits the requirement, keep the topic in your review queue.
How should you build a practical lab?
A small, repeatable lab is more useful than a large collection of disconnected notes. Organize exercises around the blueprint domains and use representative event data that lets you test fields, time, grouping, reporting, and reusable objects. The goal is to practise decisions with legitimate learning material, not to reproduce live exam content.
Begin with a baseline search and save the original result or write down its expected shape. Apply one change at a time: a filter, calculated field, null-value treatment, visualization transformation, or grouping method. Compare the output after each change and record the reason for the difference.
Create a field-focused exercise that distinguishes an existing field from an alias, a calculated field, and a field extraction. Then create a second exercise involving tags or event types. Your notes should answer what becomes reusable, where it is applied, and how it changes the way a search is written.
Create a macro exercise in which a repeated search expression is replaced with a reusable definition. Create a workflow-action exercise that connects a search result to an operational action. These exercises should help you recognize the purpose and implications of each object, not just where to click.
For data models and CIM, use a simple normalization scenario. Identify the source fields, map them to the relevant normalized concepts, and explain what a downstream search can assume after normalization. If your lab cannot support a feature, use official course material and documentation available through Splunk rather than inventing an implementation result.
Keep a troubleshooting log. For every failed search or unexpected result, record the input, the change made, the observed behavior, and the corrected reasoning. Reviewing these explanations is often more valuable than rereading a definition because it exposes assumptions you made about command order or object scope.
What mistakes commonly waste preparation time?
The most damaging mistake is studying the command list without learning the requirement each command serves. A memorized fragment does not show whether you understand filtering, result modification, visualization, event correlation, or reusable knowledge objects. Tie every command or object to an observable problem and output.
Do not spend the entire plan on basic searching. The official blueprint gives substantial attention to fields, aliases and calculated fields, tags and event types, macros, workflow actions, data models, CIM, and event correlation. A comfortable searcher can still have large gaps in those configuration-oriented areas.
Do not collapse similar concepts into one note. Field aliases are not the same study topic as calculated fields; tags and event types serve different recognition tasks; data models and CIM are related but not interchangeable. Keep separate definitions, examples, and “choose this when” explanations.
Do not use a practice score as proof of readiness unless you can explain each answer. When reviewing, classify the error: misunderstood the requirement, confused two features, misread a result, forgot a limitation, or made a simple reading mistake. Each category calls for a different remedy.
Avoid exam dumps, leaked questions, and memorization claims. They do not provide a reliable or appropriate substitute for learning the measured skills, and using unauthorized material can violate exam rules. Prepare with the blueprint, Splunk’s listed learning resources, and your own legitimate practice.
What is a workable study roadmap?
A staged roadmap should move from diagnosis to focused learning, then to integrated practice and scheduling. Set a target date only after checking your availability, lab access, and delivery choice. The roadmap below is a planning method rather than an official Splunk timetable.
First, take an honest inventory against every blueprint domain. Mark each area as familiar, partly understood, or untested. Include a written explanation and a practical task for each domain. A topic is not “familiar” merely because its name looks recognizable.
Next, study the foundation and high-decision areas. Work through the time, statistical processing, comparison, and result-modification material, then practise correlation analysis. At the same time, begin a separate knowledge-object notebook so reusable-object topics do not get postponed until the end.
Then cover fields, field aliases, calculated fields, tags, event types, macros, workflow actions, and data models. After each topic, complete a small lab task and compare it with at least one plausible alternative. Add CIM and normalization once you can describe the field and object relationships involved.
In the integration stage, alternate domains instead of studying one topic in isolation. For example, start with a search, modify or calculate fields, normalize or classify the data, correlate events, and present the results. This exposes transitions between concepts that single-topic drills can hide.
Finally, perform timed mixed review using only legitimate practice material. Keep an error register and revisit the underlying skill rather than memorizing the answer. Schedule when your performance is consistently explainable across the blueprint, not simply when one practice session feels easy.
The practical next action is to download or open the official blueprint, create the domain checklist, and schedule the first lab session. If the checklist reveals that basic Splunk searching is still unfamiliar, use the Core Certified User scope as a foundation before treating yourself as ready for the power-user exam.
What are the exam format and scheduling facts?
Splunk lists the exam as 65 multiple-choice questions with a total exam length of 60 minutes, including time to review the certification agreement. The listed price is $130 USD per exam attempt. Verify the current appointment information and fee in the official scheduling flow before committing, because availability and account details are handled there.
Splunk states that Pearson VUE delivers the exam. Pearson provides two delivery methods: a proctored appointment at a Pearson VUE Authorized Test Center or a self-administered online proctored exam. The same Pearson account is used to schedule or purchase either type.
Appointments must be made at least 24 hours in advance and are based on availability. Pearson’s rescheduling policy requires contact with Pearson or online access to your Pearson account at least 48 hours before the appointment. Exams cannot be rescheduled less than 48 hours before the appointment.
The same 48-hour rule applies to cancellation: Pearson says you must cancel at least 48 hours before the appointment, and exams cannot be cancelled less than 48 hours before it. Failure to cancel or reschedule in time, or failure to appear, results in forfeiture of the exam fee.
To schedule, use the Splunk links on the Pearson VUE page, sign in to your web account, choose the appointment route, and submit the fee or enter a voucher code. Check the exact exam title carefully, especially if you began with the SPLK-1002 code rather than the current visible credential name.
A separate agreement step also matters. Pearson states that candidates in a testing center receive 3 minutes to read and sign Splunk’s Non-Disclosure Agreement. Candidates who do not agree within the 3 minutes are excused from the exam room and forfeit the entire examination fee. Read the agreement instructions before appointment day so this step does not surprise you.
Should you choose a test center or OnVUE?
Choose the delivery method you can control reliably. A test center removes the need to prepare your own room and computer environment, while OnVUE requires you to meet technology, identity, network, and workspace requirements. Compare those operational demands before paying rather than treating online delivery as automatically easier.
For OnVUE, Pearson lists minimum requirements including Windows 10 or macOS 14 or higher, a working webcam, microphone, and speaker, no headphones or headsets, one display screen, a stable internet connection with at least 6 Mbps download and 2 Mbps upload, and the ability to close other applications.
Pearson also prohibits virtual machines, beta operating systems, mobile phones, tablets, headphones, earbuds, styluses, watches, secondary or touchscreen displays, VPNs, corporate networks, and public or shared networks. Some programs may allow specific exceptions, so check the Splunk exam’s applicable policies rather than assuming an exception.
The testing space must be quiet, free of distractions, and empty of other people. Pearson says the desk may contain only the testing computer, pre-approved items or comfort aids, and a beverage in an unmarked container. Books, notes, paper, writing tools, electronics, and other listed items must be removed.
Run Pearson’s system test on the same device and network you plan to use for the exam. Restart the computer, prevent other network users from streaming or making large downloads, and solve any system issue before scheduling if possible. Candidates who do not meet online requirements can have the exam cancelled and the fee forfeited.
Begin OnVUE check-in 30 minutes before the appointment. The check-in includes technology checks, photos of you and your ID, and a 360° room scan. If a requirement is not met, Pearson says you cannot test and your fee will be forfeited.
On exam day, do not record or share the screen, allow another person to take the exam, leave webcam view except during an approved break, speak or read aloud unless instructed, or access a phone unless explicitly permitted. A violation can revoke the exam and forfeit the fee.
What should you verify before booking?
Verify the credential name, delivery option, identity document, and appointment policy before submitting payment. This short check prevents avoidable administrative failures that study quality cannot fix.
Confirm that the booking identifies the Splunk Core Certified Power User exam. Splunk’s current official page does not visibly display “SPLK-1002,” although the code may be used in catalogue contexts. If the scheduling page presents a different title, stop and reconcile the listing through the official Splunk or Pearson VUE pages.
Confirm that your government-issued photo ID is valid and that the name matches the exam booking. Pearson lists accepted examples such as an international passport, plastic driver’s license, national, state, provincial, or EU ID card, and certain other approved documents. Expired, digital, damaged, copied, and privately issued IDs are prohibited.
If you are under 18, Pearson requires your own valid ID and a parent or guardian present during check-in to show identification and give consent. Review the complete OnVUE identity rules if you intend to test online.
Check your appointment’s local time, the cancellation and rescheduling deadlines, and the selected delivery method. For online testing, complete the system test and prepare the room before appointment day. For a test center, use Pearson’s official locator and confirm the appointment details in your account.
Do not leave scheduling until the last moment. Pearson requires appointments at least 24 hours in advance, and a missed or late change can forfeit the fee. If your work, travel, equipment, or study plan is uncertain, resolve that uncertainty before booking.
What happens if you need a retake?
Treat a retake as a diagnostic opportunity, not as permission to repeat the same plan. Pearson’s policy says a candidate who does not pass on the first attempt must wait 7 days to retake the exam. After a second unsuccessful attempt, the candidate must wait 14 days.
Pearson’s listed subsequent retake schedule is: third attempt after 4 weeks or 28 days, fourth attempt after 8 weeks or 56 days, and fifth attempt after 8 weeks or 56 days. Retakes beyond the 5th attempt are considered case by case.
Use the waiting period to reconstruct your error pattern. Revisit the blueprint domains connected to misunderstood requirements, then perform fresh exercises that require choosing among similar features. Avoid simply rereading the same notes or seeking remembered questions.
The policy also shows why appointment discipline matters. A failed appearance or an untimely cancellation or reschedule can forfeit the exam fee independently of your technical readiness. Keep confirmation details and policy deadlines in your calendar, and change the appointment only through the official Pearson process.
What should you do next?
Open the official blueprint and turn its domains into a checklist. Identify your weakest two areas, reserve lab time for them, and select the corresponding Splunk preparation courses. Then verify the current credential listing and Pearson VUE appointment rules before deciding whether to book.
A sensible immediate sequence is: assess search and reporting fundamentals; practise correlating events; work through fields and knowledge objects; study data models and CIM; integrate the domains in mixed exercises; and review delivery requirements. Keep an error log throughout so each study session answers a specific weakness.
Do not schedule solely because the exam is labelled entry-level or because you have completed a course. Schedule when you can explain the purpose and trade-offs of the measured features, complete practical exercises without relying on copied answers, and meet the chosen delivery method’s identity and environment requirements.
Use official Splunk and Pearson VUE pages for the final credential name, fee, appointment availability, policies, and delivery checks. Those details can change; the official scheduling record should control your final decision.
Conclusion
SPLK-1002 preparation is best treated as a skills-and-decision problem: understand the current Splunk Core Certified Power User scope, follow the blueprint, practise the feature choices behind searches and knowledge objects, and verify the operational requirements before booking. The exam has no prerequisite certification or course, but readiness still depends on being able to apply the measured skills across Splunk Enterprise or Splunk Cloud contexts. Start with the blueprint checklist, build a focused lab, review errors by domain, and schedule only after your delivery setup and appointment obligations are clear.