Expected SPLK-1002 Exam Topics, as suggested by Splunk :

• Module 1: Using Transforming Commands for Visualizations/ Use the Chart Command/ Use the Timechart Command
• Module 2: Filtering and Formatting Results/ The Eval Command/ Use the Search and where Commands to Filter Results/ The Fillnull Command
• Module 3: Correlating Events/ Identify Transactions/ Group Events Using Fields/ Group Events Using Fields and Time
• Module 4: Search with Transactions/ Report on Transactions/ Determine When to Use Transactions vs. Stats
• Module 5: Creating and Managing Fields/ Perform Regex Field Extractions Using the Field Extractor/ Perform Delimiter Field Extractions Using the FX
• Module 6: Creating Field Aliases and Calculated Fields/ Describe, Create, and Use Field Aliases/ Describe, Create, and Use Calculated Fields
• Module 7: Creating Tags and Event Types/ Create and Use Tags/ Describe Event Types and Their Uses/ Create an Event Type
• Module 8: Creating and Using Macros/ Describe Macros/ Create and Use a Basic Macro/ Define Arguments and Variables for a Macro/ Add and Use Arguments with a Macro
• Module 9: Creating and Using Workflow Actions/ Describe the Function of GET, POST, and Search Workflow Actions/ Create a GET Workflow Action, a POST Workflow Action, a Search Workflow Action
• Module 10: Creating Data Models/ Describe the Relationship Between Data Models and Pivot/ Identify Data Model Attributes/ Create a Data Model
• Module 11: Using the Common Information Model/ List the Knowledge Objects Included with the Splunk CIM Add-On/ Use the CIM Add-On to Normalize data