Splunk Core Certified Power User

Exam format

Splunk logo

Splunk Core Certified Power User Exam Format

SPLK-1002

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The Splunk Core Certified Power User exam validates a candidate's ability to go beyond basic searching and move into the realm of data analysis and optimization. This certification proves that the professional can perform complex transformations, use advanced commands like eval and transaction, and implement organizational standards like Tags, Event Types, and the Common Information Model (CIM). It focuses heavily on the ability to turn raw data into structured, searchable, and actionable intelligence through sophisticated search-time manipulations and data model acceleration. Candidates must demonstrate proficiency in making data more usable for others via macros, aliases, and workflow actions, ensuring they are not just consumers of data, but architects of search efficiency.

65 questions
60 min
70% to pass
10 domains

Exam facts at a glance

What we know about this exam, and where the information comes from.

SpecificationValue
Questions65
Time limit60 minutes (55s per question)
Passing score70%
Domains10
LevelAssociate
Question bank here65 questions
SourceCertilum's own record — the vendor does not publish this figure

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

DomainWeightTopicsPractice Qs
Macros10%
  • Defining reusable search macros
  • Passing arguments to macros
  • Managing macro scope
7
Data Models10%
  • Building data models
  • Accelerating data models
  • Using pivot for reporting
7
Workflow Actions10%
  • Configuring workflow actions
  • Linking Splunk data to external tools
  • Customizing action visibility
7
CIM Normalization10%
  • Common Information Model concepts
  • Mapping fields to CIM
  • Standardizing data for security apps
7
Field Extractions10%
  • Search-time extractions
  • Regex-based extraction
  • Configuring field extractions
6
Tags & Event Types10%
  • Creating and managing tags
  • Defining event types
  • Using tags and event types in searches
6
Field Aliases & Calculated Fields10%
  • Creating field aliases
  • Implementing calculated fields
  • Search-time field management
6
Visualizations (chart, timechart)5%
  • Creating charts
  • Timechart command usage
  • Formatting visualization outputs
3
Correlation (stats vs transaction)15%
  • Using stats for aggregation
  • Transaction command for grouping related events
  • Performance differences between stats and transaction
10
Filtering & Formatting (eval, where, fillnull)10%
  • Using eval for field manipulation
  • where command for filtering
  • Handling null values with fillnull
6

The heaviest domain is Macros at 10%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Official Splunk price (65 questions, 60 min, Entry level, no prerequisites) via Pearson VUE; 5-registration pack for $500 USD. Splunk is migrating its certification program to Cisco certification tracking. Official exam page

More about the Splunk Core Certified Power User exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Related certifications

Explore other certifications in the same category and see how they stack up.

Frequently asked questions

Everything you need to know about the Splunk Core Certified Power User exam.