Free Splunk Power User Exam Prep

Use `chart` and `timechart` correctly for visualization-ready reporting.

Use `eval`, `search`, `where`, and `fillnull` to shape result sets and derive usable reporting fields.

Identify transactions, group events by fields and time, report on transactions, and decide when `stats` is preferable.

Perform regex and delimiter-based field extractions with the Field Extractor.

Normalize names with field aliases and derive reusable values with calculated fields.

Create tags, understand event types, and use both for reusable classification.

Create basic macros, define arguments and variables, and reuse them safely across searches.

Create GET, POST, and Search workflow actions and pass event context into the next step.

Understand the relationship between data models and Pivot, identify attributes, and create useful datasets.

Describe the CIM, identify CIM Add-On knowledge objects, and use them to normalize data.