splk-1002 Exam topics

Candidates must know the exam topics before they start of preparation. Because it will really help them in hitting the core. Our splk-1002 exam dumps will include the following topics:

1. Splunk Fundamentals

• Understand the relationship between data models and pivot

• View fired alerts

• Create a dashboard

• Use SPL search commands to perform searches:

• Review basic search commands and general search practices

• Module 6 - Search Language Fundamentals

• Describe alerts

• Run basic searches

• The stats command

• Module 9 - Datasets and the Common Information Model

• Learn basic navigation in Splunk

• Create a lookup file and create a lookup definition

• Module 10 - Creating and Using Lookups

• Identify the contents of search results

• Save search results

• Module 7 - Using Basic Transforming Commands

• Installing Splunk

• Module 4 - Basic Searching

• Use the fields sidebar

• Naming conventions

• Use the timeline

• Edit a dashboard

• Understand fields

• Getting data into Splunk

• Configure an automatic lookup

• Module 5 - Using Fields in Searches

• Describe scheduled reports

• Customizing your user settings

• Module 1 - Introduction

• Create an instant pivot from a search

• Set the time range of a search

• Examine the search pipeline

• Create reports that include visualizations such as charts

• Module 3 - Introduction to Splunk's User Interface

• Describe Pivot

• Create a pivot report

• and tables

• Add a report to a dashboard

• The top command

• Understand the uses of Splunk

• The rare command

• What are datasets?

• What is the Common Information Model (CIM)?

• Control a search job

• Use autocomplete and syntax highlighting

• Splunk components

• Refine searches

• Module 2 - What is Splunk?

• Add a pivot report to a dashboard

• Configure scheduled reports

• Save a search as a report

• Create alerts

• Specify indexes in searches

• Edit reports

• Describe lookups

• Overview of Buttercup Games Inc.

• Define Splunk Apps

• Module 12 - Using Pivot

• Select a data model object

• Use autocomplete to help build a search

• Use fields in searches

• Module 11 - Creating Scheduled Reports and Alerts

• Module 8 - Creating Reports and Dashboards

• Work with events

2. Splunk Fundamentals

• Module 6 - Correlating Events

• Module 9 - Creating Field Aliases and Calculated Fields

• Module 3 - Using Transforming Commands for Visualizations

• Search with transactions

• Use the CIM Add-On to normalize data

• Module 10 - Creating Tags and Event Types

• Create and use a basic macro

• The geom command

• Module 7 - Introduction to Knowledge Objects

• Create a data model

• Lab environment

• Create a GET workflow action

• Use a data model in pivot

• Manage knowledge objects

• Using the job inspector to view search performance

• Group events using fields

• Create a POST workflow action

• Create and format charts and timecharts

• Module 4 - Using Mapping and Single Value Commands

• Add-On

• Using the search and where commands to filter results

• Report on transactions

• Define arguments and variables for a macro

• The filnull command

• Add and use arguments with a macro

• Case sensitivity

• Perform delimiter field extractions using the FX

• Describe the relationship between data models and pivot

• Describe event types and their uses

• Describe macros

• The eval command

• Explore visualization types

• Perform regex field extractions using the Field Extractor (FX)

• Module 2 - Beyond Search Fundamentals

• Identify data model attributes

• Module 5 - Filtering and Formatting Results

• Create and use tags

• Module 1 - Introduction

• List the knowledge objects included with the Splunk CIM

• Review permissions

• Module 8 - Creating and Managing Fields

• Identify transactions

• The iplocation command

• Explore data structure requirements

• Module 14 - Using the Common Information Model (CIM) Add-On

• Identify naming conventions

• Module 12 - Creating and Using Workflow Actions

• Search fundamentals review

• Create an event type

• Group events using fields and time

• Describe, create, and use field aliases

• Describe, create and use calculated fields

• Module 11 - Creating and Using Macros

• The geostats command

• Create a Search workflow action

• Determine when to use transactions vs. stats

• Module 13 - Creating Data Models

• Describe the function of GET, POST, and Search workflow actions

• The addtotals command

• Overview of Buttercup Games Inc.

• Describe the Splunk CIM

Reference: https://www.splunk.com/en_us/training/certification-track/splunk-core-certified-power-user.html

SPLK-1002 Exam Content

The domains to check out for SPLK-1002 test along with their details are outlined below. However, this guideline is not a rigid structure of what the test has. Candidates are required to study widely so they become fully prepared. The content of SPLK-1002 can be altered without notifying them.

• Filtering as well as formatting of results (10%)
• Creation of field aliases as well as calculated fields (10%)
• Creation and management of fields (10%)
• Creation of tags as well as event types (10%)
• Correlating events (15%)
• Creation and use of workflow actions (10%)
• Creation and use of macros (10%)
• Creation of data models (10%)
• Use of the CIM (10%)
• Application of transformational commands in visualizations (5%)

In the first section, the Splunk SPLK-1002 exam will test the candidates on how they can use the chart and timechart commands. Then in the questions related to the second domain, they will also be checked on their knowledge of eval command, how well they can apply the search as well as the where command to filter outcomes, and their understanding of the fillnull command. In the third domain, the candidates will have to showcase their skills in the identification of transactions, using fields for group events, making transactions with search, making reports on the transactions, and deciding between the use of transactions and statistics according to a given scenario.

The fourth, fifth, and sixth topics of SPLK-1002 will also go be appraising the candidate's knowledge of the fields and other features. They highlight areas such as the use of the Field Extractor (FX) for performing regex field extractions and using the FX to do delimiter field extractions. The candidate will also be gauged in their knowledge of describing, creating, and utilizing field aliases as well as calculated fields. Finally, one's understanding of the creation and use of tags will be assessed, along with the knowledge of event types, their different uses, and the skills in their creation.

The test will also measure the candidate's awareness of macros, the creation as well as the use of basic macros, defining variables and arguments for macros, and adding and using those arguments. Under the eighth domain, one has to show the knowledge of diverse functions such as GET, POST as well as Search workflow actions, and demonstrate skills in their creation.

In the last two modules, the exam-takers will also be required to prove their expertise in the creation of data models and utilizing CIM. These include an understanding of the connection between pivot and data models, the creation of data models, and the ability to define the attributes. Also, the candidates have to be competent in normalizing data with the help of CIM, be familiar with the CIM Add-On knowledge objects, and the basic features of this solution.

The Splunk Core Certified Power User SPLK-1002 exam tests the candidate's fundamental comprehension of SPL searching as well as reporting commands. It also assesses one's skills in making tags along with event types, using macros, and creating workflow actions as well as data models. The test also checks if the candidate can utilize the Common Information Model to normalize data using either Splunk Enterprise or Splunk Cloud Platforms. The overall focus of the exam is on the evaluation of the applicants' understanding of the basic Splunk software and the ability to use it effectively. Finally, SPLK-1002 exam is a requirement for professionals intending to go for the Splunk Core Certified Power User certification.

For more info visit:

splk-1002 Exam Reference Splunk Exam Study Guide