Splunk Core Certified Power User

Which Splunk command is designed specifically to build a chart over time without manually binning the timestamp field first?

• Astats
• Bchart
• Ctimechart
• Dtable

A user wants the count of events by sourcetype for a pie chart. Which command is the best fit?

• Atimechart count by sourcetype
• Bchart count over sourcetype
• Ctransaction sourcetype
• Dtable sourcetype count

Which statement best distinguishes transforming commands from non-transforming commands in Splunk?

• ATransforming commands replace raw events with statistical or tabular results.
• BTransforming commands can run only after `timechart`.
• CNon-transforming commands always run faster than transforming commands.
• DTransforming commands are used only in dashboards, not in searches.

Which search produces a line chart of failed logins per hour by host?

• Aindex=auth action=failure | chart count over host by _time
• Bindex=auth action=failure | stats count by _time host
• Cindex=auth action=failure | timechart span=1h count by host
• Dindex=auth action=failure | table _time host count

A search should show the top five HTTP status codes by event count. Which command is the most direct answer?

• Atop limit=5 status
• Btimechart count by status limit=5
• Ctransaction status
• Dlookup status_codes.csv status

When a report needs side-by-side bars comparing count by action for each host, which command pattern is usually most appropriate?

• Achart count over host by action
• Btimechart count by action
• Cstats values(action) by host
• Ddedup host action

Which search is most appropriate when you want daily totals even if the raw events arrive at irregular times throughout the day?

• Aindex=web | timechart span=1d count
• Bindex=web | chart count over _time
• Cindex=web | table _time count
• Dindex=web | eval day=strftime(_time, "%F")

A report is showing too many series because one field contains dozens of values. Which change most directly limits the number of displayed series in a chart command?

• AUse `head 10` before `chart`
• BUse `limit=` in the transforming command
• CReplace `chart` with `table`
• DAdd `search *` after the command

Which result shape is most likely from `... | chart count over department by severity`?

• AOne row per event with a severity field added
• BOne row per department with separate columns for each severity
• COne row per severity with raw events nested below it
• DA single numeric field named `count` with no categories

You need a visualization-ready search for average duration by endpoint, but only the 10 busiest endpoints should appear. Which SPL is the best starting point?

• A... | table endpoint duration | head 10
• B... | stats avg(duration) by endpoint | sort - count | head 10
• C... | stats count avg(duration) by endpoint | sort - count | head 10
• D... | timechart avg(duration) by endpoint | limit=10

Which command creates or updates a field by evaluating an expression at search time?

• Aeval
• Bfillnull
• Clookup
• Ddedup

What does `fillnull value="unknown" user` do in a search?

• ADeletes events where `user` is null
• BReplaces null values in `user` with `unknown`
• CCreates a new event type called `unknown`
• DRenames the `user` field to `unknown`

Which expression returns "high" when `bytes` is greater than 1000 and "normal" otherwise?

• Aif(bytes>1000,"high","normal")
• Bcase(bytes>1000,"high","normal")
• Cfillnull(bytes,"high","normal")
• Dwhere bytes>1000 then "high" else "normal"

After creating a calculated field named `status_label`, which command is best for keeping only events where that field equals `error`?

• Atable status_label | where status_label="error"
• Bwhere status_label="error"
• Cfillnull value="error" status_label
• Drename status_label as error

Which function is most appropriate for returning the first non-null value from `src_ip`, `client_ip`, and `ip`?

• Acoalesce(src_ip, client_ip, ip)
• Bmvappend(src_ip, client_ip, ip)
• Cround(src_ip, client_ip, ip)
• Dsubstr(src_ip, client_ip, ip)

A user wants to create a field called `mb` from `bytes` divided by 1024 twice. Which command should they use?

• Aeval mb=bytes/1024/1024
• Bfillnull mb=bytes/1024/1024
• Cwhere mb=bytes/1024/1024
• Dlookup mb=bytes/1024/1024

What is the best reason to use `case()` instead of `if()` in an `eval` expression?

• A`case()` runs only on indexed fields
• B`case()` supports multiple condition-result pairs
• C`case()` automatically fills nulls
• D`case()` can be used only in dashboards

Why would a report author use `fillnull value=0 errors` before charting the `errors` field?

• ATo convert the field into a multivalue field
• BTo ensure missing values appear as zero instead of blank in later reporting
• CTo force Splunk to index the field permanently
• DTo remove any events where `errors` equals zero