Splunk Core Certified Advanced Power User

Last checked November 10, 2026 against the official Splunk exam page.

1. Question 1Using Acceleration Options: Reports, Summary Indexing, Data Models and tsidx

   A team runs the same transforming report every day over 90 days of data and wants the dashboard results to load faster. They want Splunk to build and maintain the summaries automatically, without a separate summary index. Which option fits?

   1. AReport acceleration, which builds summaries for one report
   2. BSummary indexing, which stores results in a separate index
   3. CData model acceleration, which summarizes data model objects
   4. DNo acceleration, which reruns the full search on each load
   Show answer and explanationHide answer

   Correct answer: A

   Report acceleration lets Splunk build and maintain summaries for an eligible transforming report automatically, which matches the requirement. Summary indexing writes results to a separate index, data model acceleration serves data model objects rather than one report, and rerunning the full search gives no speedup.

2. Question 2Using Search Efficiently and Search Tuning

   A search needs the number of HTTP 500 responses per host across a month of web data. Which search is the most efficient way to produce this count?

   1. Aindex=web status=500 | stats count by host
   2. Bindex=web | stats count by host, status | search status=500
   3. Cindex=web | dedup host | stats count by host | search status=500
   4. Dindex=web | fields host status | stats count by host
   Show answer and explanationHide answer

   Correct answer: A

   Putting the status filter in the base search lets Splunk discard non-500 events before the transforming command runs, which is the most efficient ordering. Filtering after stats or dedup processes every event first, and the field-list version never filters at all, so it counts every response.

3. Question 3Working with Multivalued Fields

   Which two statements about makemv and mvexpand are correct? (Choose two.)

   1. Amakemv turns a delimited string in one field into a multivalue field
   2. Bmvexpand creates one result row for each value of a multivalue field
   3. Cmvexpand joins all values of a multivalue field into one string
   4. Dmakemv requires the input field to already be multivalue before it runs
   5. Emvexpand works on plain single-value text fields without any preparation
   Show answer and explanationHide answer

   Correct answer: A, B

   makemv splits a delimited string into the values of a multivalue field, and mvexpand turns each value into its own result row. Joining values into a string is the job of mvjoin, makemv accepts plain strings rather than requiring multivalue input, and mvexpand needs a multivalue field to act on.

4. Question 4Manipulating and Filtering Data

   An analyst wants to count events in buckets 100 units wide for a numeric response_time field. Which search fragment produces these counts?

   1. Abin span=100 response_time | stats count by response_time
   2. Bfillnull value=0 response_time | stats count by response_time
   3. Cmvexpand response_time | stats count by response_time
   4. Dxyseries response_time count
   Show answer and explanationHide answer

   Correct answer: A

   bin with a span argument groups numeric values into fixed-width ranges, so stats can count events per range. fillnull only replaces missing values, mvexpand splits multivalue fields into rows, and xyseries pivots a table and needs separate x, y and value fields.

5. Question 5Using Advanced Transactions

   A transaction search groups events by session_id. The analyst also wants sessions that never reached their end event to appear in the results, with closed_txn set to 0 so they can be identified. Which transaction option accomplishes this?

   1. Adedup session_id before transaction, which removes repeated events
   2. Bkeepevicted=false, which drops incomplete transactions from results
   3. Cstartswith=action="login", which only defines the first event
   4. Dkeepevicted=true, which keeps incomplete transactions in the results
   Show answer and explanationHide answer

   Correct answer: D

   keepevicted=true makes the transaction command output incomplete transactions, which carry closed_txn=0. The default, keepevicted=false, drops them, startswith only defines where a transaction begins, and dedup removes repeated events rather than keeping incomplete sessions.