Splunk Basics
5%of exam
Core ComponentsPlatform UsesSplunk AppsUser SettingsBasic Navigation
Basic Searching
22%of exam
Basic SearchesTime RangesSearch ResultsTimelineSearch JobsSaved Results
Using Fields in Searches
20%of exam
Field BasicsField FiltersFields SidebarSelected FieldsInteresting Fields
Search Language Fundamentals
15%of exam
Search PipelineIndex FiltersTable CommandRename CommandDedup CommandSort Command
Basic Transforming Commands
15%of exam
Top CommandRare CommandStats CommandBasic StatisticsResult Tables
Reports and Dashboards
12%of exam
Save ReportsEdit ReportsStatistics TablesChart VisualizationsDashboard Panels
Creating and Using Lookups
6%of exam
Lookup FilesLookup DefinitionsAutomatic LookupsLookup CommandField Enrichment
Scheduled Reports and Alerts
5%of exam
Scheduled ReportsReport SchedulesAlert TriggersAlert ActionsFired Alerts
Quick Facts
- Exam
- Splunk Core Certified User
- Questions
- 60 multiple choice
- Assessment
- 57 minutes
- Seat time
- 60 minutes total
- Agreement
- 3 minutes
- Level
- Entry-level
- Prerequisites
- None
- Pass score
- Not published
- Price
- $130 USD per attempt
- Retake waits
- 7d, 14d, 28d, then 56d
- Delivery
- Pearson VUE
- Materials
- Closed-book
Platform Basics
- Indexer
- Indexes and stores eventsCore
- Search head
- Runs user searchesCore
- Forwarder
- Sends data onwardInput
- App
- Packaged views and knowledgeContext
- Search app
- Default search workspaceUI
- Settings
- User and object controlsUI
- Search bar
- Enter SPL searchUI
- Time picker
- Set event-time windowUI
Time Window
Earliest enters; latest leaves
Earliest inclusiveLatest exclusive@ snaps backward
Terms vs Field Filters
Terms
- Search raw event text
- Quote exact phrases
- Wildcards expand terms
Field filters
- Match extracted values
- Use field=value
- Usually more precise
Text anywhere vs named value
Search Builder
- Know data index→index=name(Start narrow)
- Know data format→sourcetype=name(Add early)
- Need exact phrase→Quoted text(Keep together)
- Need either value→OR(Uppercase)
- Need exclusion→NOT(Verify scope)
- Need field match→field=value(Prefer specific)
Base Search Syntax
- index=main
- Limit target indexFirst
- sourcetype=access_combined
- Limit data formatFast
- host=web01
- Limit event originFilter
- source=/var/log/app
- Limit input sourceFilter
- "login failed"
- Match exact phraseQuote
- fail*
- Wildcard term suffixPattern
- AND
- Require both expressionsBoolean
- OR
- Accept either expressionBoolean
- NOT
- Exclude matching expressionBoolean
AND vs OR
AND
- Both must match
- Narrows results
- Implicit between terms
OR
- Either can match
- Broadens results
- Write uppercase
Intersect vs combine
Time Picker
- Need rolling hour→earliest=-1h latest=now
- Need today→earliest=@d latest=now
- Need yesterday→earliest=-d@d latest=@d
- Need previous month→earliest=-mon@mon latest=@mon
- Need calendar boundary→Add @ snap
- Need exact duration→Omit @ snap
Time Modifiers
- earliest=-15m
- Start fifteen minutes agoRelative
- latest=now
- End at search startRelative
- earliest=@d
- Start current midnightSnap
- earliest=-d@d
- Start yesterday midnightSnap
- latest=@d
- Exclude current midnight onwardBoundary
- -24h
- Exact rolling durationDuration
- -1d@d
- Prior day boundaryCalendar
- -mon@mon
- Previous month startCalendar
- latest boundary
- Exclusive endpointRule
Results and Jobs
- Events tab
- Raw matching eventsResults
- Statistics tab
- Transforming result tableResults
- Visualization tab
- Chart transformed resultsResults
- Timeline
- Event count over timeRefine
- Pause
- Suspend running jobJob
- Stop
- End running jobJob
- Inspect job
- Review execution detailsJob
- Export
- Download current resultsSave
Field Workflow
- Field
- Searchable name-value pairConcept
- Selected fields
- Always shown sidebar fieldsSidebar
- Interesting fields
- Frequent discovered fieldsSidebar
- Field click
- View values and countsExplore
- Value include
- Add field=value filterFilter
- Value exclude
- Add field!=value filterFilter
- host
- Event origin fieldDefault
- source
- Input source fieldDefault
- sourcetype
- Data structure fieldDefault
- _time
- Event timestamp fieldDefault
Search Flow
Find | Filter | Transform | Present
Find: base searchFilter: fieldsTransform: statsPresent: table/chart
Fields vs Table
fields
- Include or exclude fields
- Shapes downstream results
- Minus removes fields
table
- Displays ordered columns
- Creates tabular output
- Usually place late
Shape fields vs display columns
Pipeline Commands
- |
- Pass results rightwardPipeline
- table host status
- Keep ordered columnsDisplay
- fields host status
- Keep named fieldsShape
- fields - _raw
- Remove named fieldShape
- rename src AS source
- Rename result fieldLabel
- dedup user
- Keep first per valueRows
- sort - count
- Descending numeric sortOrder
- sort + host
- Ascending field sortOrder
- head 10
- Keep first ten rowsRows
Stats Grouping
Function first; BY groups
count measuresBY host groupsNo BY totals
Top vs Rare
top
- Most common values
- Adds count and percent
- Descending frequency
rare
- Least common values
- Adds count and percent
- Ascending frequency
Common vs uncommon
Result Command Picker
- Need frequent values→top
- Need uncommon values→rare
- Need grouped measures→stats BY
- Need category chart→chart
- Need time series→timechart
Transforming Commands
- top user
- Most common valuesCount+percent
- rare user
- Least common valuesCount+percent
- stats count
- Count matching eventsAggregate
- stats count BY host
- Count per hostGroup
- sum(bytes)
- Total numeric valuesFunction
- avg(duration)
- Average numeric valuesFunction
- dc(user)
- Distinct value countFunction
- values(action)
- Distinct field valuesFunction
- min(bytes)
- Smallest numeric valueFunction
- max(bytes)
- Largest numeric valueFunction
Stats vs Timechart
stats
- General aggregations
- Optional BY grouping
- No automatic time axis
timechart
- Time-based aggregation
- Automatic _time buckets
- Optional split series
Any groups vs time buckets
Saved Objects
Report repeats; dashboard displays; alert reacts
Report: one searchDashboard: many panelsAlert: conditional action
Report vs Dashboard
Report
- One saved search
- Table or visualization
- Reusable directly
Dashboard
- Collection of panels
- Multiple views together
- Layout is editable
One search vs many panels
Saved Object Picker
- Reuse one search→Report
- Combine visual panels→Dashboard
- Run every interval→Scheduled report
- Fire on condition→Alert
- Enrich search fields→Lookup
- Enrich automatically→Automatic lookup
Charts and Timecharts
- chart count BY status
- Category aggregationChart
- chart count OVER host
- Host on x-axisChart
- chart count OVER host BY status
- Category plus split seriesChart
- timechart count
- Counts across timeTime
- timechart span=1h count
- Hourly count bucketsTime
- timechart count BY status
- Time series per statusTime
- Visualization
- Requires transformed resultsDisplay
Reports
- Report
- Saved search for reuseObject
- Save As Report
- Persist current searchCreate
- Search string
- Defines report resultsEdit
- Time range
- Defines report windowEdit
- Statistics report
- Displays result tableTable
- Chart report
- Displays visualizationVisual
- Permissions
- Control report visibilityShare
Dashboards
- Dashboard
- Collection of visual panelsObject
- Panel
- Single dashboard visualizationUnit
- Add to dashboard
- Place report panelCreate
- New dashboard
- Create panel containerCreate
- Edit dashboard
- Change panels and layoutEdit
- Panel source
- Report supplies resultsData
Core Saved Objects
- Ad hoc search
- Temporary search workUnsaved
- Report
- Reusable saved searchSaved
- Dashboard
- Panels in one viewSaved
- Lookup definition
- Named enrichment settingsSaved
- Automatic lookup
- Configured search enrichmentSaved
- Scheduled report
- Report with recurring runSaved
- Alert
- Search with triggerSaved
Lookup vs Inputlookup
lookup
- Enrich existing events
- Matches key fields
- Adds output fields
inputlookup
- Generates lookup rows
- Starts from lookup
- No event stream required
Enrich events vs read table
Lookup Workflow
- Lookup file
- External enrichment tableData
- Lookup definition
- Named lookup configurationObject
- Match field
- Joins event and lookupKey
- Output field
- Adds lookup valueEnrich
- lookup assets ip
- Match lookup ip fieldCommand
- OUTPUT owner
- Add owner fieldCommand
- OUTPUTNEW owner
- Preserve existing ownerCommand
- Automatic lookup
- Enrich matching searches automaticallyConfig
- inputlookup assets.csv
- Read lookup as resultsGenerate
Scheduled Report vs Alert
Scheduled report
- Runs every schedule
- Actions each run
- Recurring delivery
Alert
- Evaluates trigger condition
- Fires when condition matches
- Records triggered alerts
Run always vs trigger condition
Schedules and Alerts
- Scheduled report
- Runs every configured intervalSchedule
- Schedule
- Defines run frequencyWhen
- Time range
- Window each run searchesWindow
- Alert
- Search plus trigger conditionDetect
- Trigger condition
- Decides alert firingIf
- Alert action
- Runs after triggerThen
- Per-result
- Trigger for each resultMode
- Number of results
- Trigger by result countCondition
- Triggered Alerts
- View fired alert recordsHistory
Common Traps
Blueprint scope
Use eight official domains ≠ Do not import Power User objectives
Retake escalation
First failure: wait 7 days ≠ Later waits: 14/28/56 days
Seat vs assessment
Assessment is 57 minutes ≠ Agreement adds 3 minutes
Latest boundary
Earliest is inclusive ≠ Latest is exclusive
Snap vs duration
@ rounds backward ≠ No @ keeps duration
Boolean casing
Write AND OR NOT uppercase ≠ Parentheses control grouping
Stats changes results
Transforms events into table ≠ Raw events no longer shown
Dedup ordering
Keeps first encountered value ≠ Sort first when priority matters
Report vs alert
Schedule runs the report ≠ Condition fires the alert
Lookup direction
Match keys must align ≠ OUTPUT adds enrichment fields
Last Minute
- 1.22% searching; 20% fields
- 2.Start narrow with index
- 3.Uppercase Boolean operators
- 4.Earliest inclusive; latest exclusive
- 5.@ snaps backward
- 6.Pipe sends results rightward
- 7.top common; rare uncommon
- 8.stats functions precede BY
- 9.timechart buckets by _time
- 10.lookup enriches event rows
- 11.Report saves one search
- 12.Dashboard holds multiple panels
- 13.Alert requires trigger condition
- 14.Retakes: 7/14/28/56-day waits
- 15.Stay within Core blueprint
Buy on AmazonSame family resources
Explore More Splunk Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.