SPLK-1002 Macros, Saved Searches and CIM Practice Question
Which THREE are components of the Common Information Model (CIM) in Splunk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tags
The three components of the Common Information Model (CIM) in Splunk are Tags (A), Data Models (B), and Field Extractions (D). Tags are used to define the CIM data model's data source types and event types. Data Models provide the framework for the CIM, defining normalized fields and relationships. Field extractions are necessary to map raw data to the CIM fields. Lookup tables (C) and dashboards (E) are not part of the CIM; they may be used in conjunction with CIM but are not core components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Tags
Why this is correct
Tags are used to categorize events into CIM data model tags.
- ✓
Data models
Why this is correct
Data models define the structure and logic for CIM compliance.
- ✗
Lookup tables
Why it's wrong here
Lookup tables are not part of the CIM; they are separate knowledge objects.
- ✓
Field extractions
Why this is correct
Field extractions are used to map raw data to CIM field names.
- ✗
Dashboards
Why it's wrong here
Dashboards are visualizations, not part of the CIM definition.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.