Splunk Core Certified Power User Certification Preparation
This course prepares you for the Splunk Core Certified Power User certification, which validates advanced searching and knowledge object skills in Splunk Enterprise and Splunk Cloud Platform. It runs two or three days depending on how comfortable you already are with SPL. Participants learn to correlate events, build fields and macros, and normalise data with the Common Information Model. Every topic is practised in a live Splunk environment with realistic log data.
The essentials
Publisher : Splunk
Certification : Splunk Core Certified Power User
Exam code : SPLK-1002
Duration : 2 to 3 days (14 to 21 h) depending on your starting level
Level : Intermediate
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Filter and format results with eval, where and fillnull
Correlate events with transaction and stats, and know which to use
Extract fields and create aliases and calculated fields
Create tags, event types, macros and workflow actions
Design data models and normalise data with the CIM
Program
Transforming commands for visualisations (5%)
chart
timechart
Filtering and formatting results (10%)
eval
search and where
fillnull
Correlating events (15%)
Grouping by fields and time
Searching and reporting on transactions
transaction or stats?
Fields, aliases and calculated fields (20%)
Field Extractor: regex and delimiters
Field aliases
Calculated fields
Tags, event types and macros (20%)
Creating tags and event types
Macros with arguments and variables
Workflow actions (10%)
GET, POST and Search actions
Data models and the CIM (20%)
Data models, attributes and Pivot
Knowledge objects in the CIM Add-On
Normalising data
Prerequisites
No official prerequisites for the exam
Hands-on use of basic Splunk searches (Core User level)
Comfortable with logs, timestamps and fields
Basic regular expressions are a plus
Target audience
SOC analysts using Splunk every day
Systems and network administrators
Operational and business data analysts
Candidates heading for Advanced Power User or Cybersecurity Defense Analyst
The exam
The exam has 65 multiple-choice questions to answer in 60 minutes, including three minutes to review the exam agreement. It is delivered by Pearson VUE, Splunk's testing partner. There are no prerequisites and Splunk lists the fee at USD 130 per attempt. The official blueprint sets out the ten topics tested and their weighting, which makes it the best revision checklist.
Preparation tips
Practise in a free Splunk instance with sample data.
Be able to justify transaction versus stats: it is the heaviest topic.
Use the blueprint as a line-by-line checklist.
Frequently asked questions (FAQ)
Do I need Core User before Power User?
No. Splunk sets no prerequisites for this exam. Solid hands-on skills with basic searches are still essential to keep up.
Why two or three days?
We offer two days to people already fluent in SPL, and three days to those who need to revisit the basics before tackling knowledge objects. A short call before enrolment helps pick the right format.
Is the exam difficult?
Time is tight: under a minute per question. You need to know command syntax and the purpose of each knowledge object without hesitating, so regular hands-on practice matters more than memorising slides.
Is it useful for a SOC role?
Yes. Splunk recommends this skill level before the SOC-focused Cybersecurity Defense Analyst certification.
Does the course also apply to Splunk Cloud?
Yes. The certification covers both Splunk Enterprise and Splunk Cloud Platform, where searches and knowledge objects work the same way, so what you practise in class carries over directly to either deployment.
Securevalley training — online and in-person sessions. Contact us for pricing and registration terms.
Securevalley is not a training partner of Splunk. Splunk and Splunk Core Certified Power User are trademarks of Splunk LLC.