Free Splunk Core Certified Advanced Power User practice test: 30 questions with answers

Report acceleration lets Splunk build and maintain summaries for an eligible transforming report automatically, which matches the requirement. Summary indexing writes results to a separate index, data model acceleration serves data model objects rather than one report, and rerunning the full search gives no speedup.

tstats reads the tsidx files that index fields, so it can count results without scanning raw event text, which is much faster for indexed fields. stats needs the raw events, timechart is for time-bucketed output, and dedup removes repeated events rather than counting them.

Summary indexing writes precomputed results into a separate summary index that has its own retention, so aggregates survive after raw events expire. Report and data model acceleration summaries are tied to the report or data model, and job caching keeps results only briefly.

Putting the status filter in the base search lets Splunk discard non-500 events before the transforming command runs, which is the most efficient ordering. Filtering after stats or dedup processes every event first, and the field-list version never filters at all, so it counts every response.

The job inspector shows execution costs and timing for a search job, which helps locate the slow part. The lookup definition editor, Field Extractor and data model editor each manage a different knowledge object and show no runtime breakdown of a search.

Specifying the index and a narrow time range limits the data that is read, filtering before transforming commands reduces the events they process, and the fields command limits what moves through the pipeline. Leading wildcards prevent efficient term lookups, and sorting before filtering handles every event for no benefit.

makemv splits a delimited string into the values of a multivalue field, and mvexpand turns each value into its own result row. Joining values into a string is the job of mvjoin, makemv accepts plain strings rather than requiring multivalue input, and mvexpand needs a multivalue field to act on.

mvcount returns the number of values in a multivalue field, which is what is needed. mvindex with -1 returns the last value, mvjoin combines the values into one string, and len returns the number of characters in a string rather than the number of values.

mvexpand turns each role value into its own event, so stats can count each role separately. mvcombine does the opposite and merges rows into multivalue fields, makemv works on delimited strings that are not yet multivalue, and fillnull only replaces empty values.

bin with a span argument groups numeric values into fixed-width ranges, so stats can count events per range. fillnull only replaces missing values, mvexpand splits multivalue fields into rows, and xyseries pivots a table and needs separate x, y and value fields.

xyseries takes an x field for the rows, a y field whose values become columns, and a value field, which produces the wide layout required. untable does the reverse, table only selects columns without reshaping, and fieldformat changes display formatting only.

foreach runs the enclosed eval once for each field matched by the wildcard, and <<FIELD>> stands for the current field name. eval does not accept wildcards, addtotals creates a new total rather than changing each field, and mvexpand splits multivalue fields into rows.

keepevicted=true makes the transaction command output incomplete transactions, which carry closed_txn=0. The default, keepevicted=false, drops them, startswith only defines where a transaction begins, and dedup removes repeated events rather than keeping incomplete sessions.

stats returns one summary row per session_id with the start, end and count, and avoids carrying whole event groups through the search, so it is the efficient choice. transaction returns the grouped events themselves, eventstats keeps every event, and streamstats gives running values rather than one summary row per session.

startswith and endswith take search strings or expressions that identify the first and last events of each transaction. maxpause and maxevents only set limits on gaps and event counts, fields and table control display, and dedup and sort do not define transaction boundaries.

stats aggregates events into one row per host, and dc() returns a distinct count of user values. values() returns the list of unique values instead of a count, timechart groups results by _time rather than by host, and eventstats keeps every event and adds the totals to each one.

fieldsummary computes per-field statistics such as count, distinct count and top values across all or selected fields in one command. fieldformat only changes display formatting, fillnull replaces empty values, and fields only selects which fields remain in the results.

streamstats computes running aggregates across events in the order they are processed, so each event receives the total so far for its host. stats returns one summary row per host, eventstats adds the overall total for the whole group rather than a running value, and chart builds a pivot table instead of a per-event field.

The if() function returns the second argument when the condition is true and the third otherwise, which gives the required labels. tostring() of a comparison returns the text true or false, coalesce() returns the first non-null value so it never produces error, and round() returns a number rather than a label.

makeresults creates events at search time without reading any index, and by default it returns one row stamped with the current time. inputlookup reads a lookup file, tstats reads indexed summaries, and metadata lists index-level values, so none of them creates test rows on demand.

KV Store lookups keep records in a collection that apps can update one row at a time through the REST API. A CSV lookup must be rewritten as a whole file, an external lookup runs a script at search time, and a geospatial lookup matches coordinates to polygons rather than serving keyed rows.

A geospatial lookup tests whether a point falls inside a polygon in a KMZ or KML file, which is what zone labeling needs. Exact-match and KV Store lookups compare values for equality, so a point almost never equals a boundary value, and an external lookup would need custom code instead of the polygon definitions.

The Output results to lookup alert action writes the rows from each triggered run into a lookup, so they can be reviewed later. Send email only notifies recipients, Run a script launches a custom program, and Add to triggered alerts records the firing without saving the result rows.

The webhook alert action sends an HTTP POST with the alert details to a URL the team specifies, which is how external tools receive triggers. Log event writes an entry to a Splunk index, Send email notifies people by mail, and Output results to lookup stores rows in a file rather than calling an external service.

rex applies a regular expression at search time inside the search itself, so it suits a one-off extraction. erex builds an expression from examples the analyst supplies, Field Extractor creates a saved extraction that persists beyond this search, and spath parses JSON or XML rather than running a regex over raw text.

A leading .* makes the regex engine scan the whole event for every candidate match, while a literal anchor lets it skip non-matching events quickly. Moving rex after stats would extract from aggregated rows that no longer hold _raw, erex is not a speed fix, and verbose mode adds work rather than reducing it.

spath extracts values from JSON or XML by path, and its input, path and output arguments name the source field, the nested location and the new field. xmlkv only handles XML, multikv splits tabular text into events, and mvexpand works on fields that are already multivalue.

multikv parses a table embedded in an event, uses the header line for field names, and emits one event per row. spath is for JSON or XML, makemv handles delimited values inside one field, and rex needs a hand-written pattern for each field rather than reading a header row.

Splunk supports nested macros, so the inner call is expanded as part of the outer one and the full search runs. The other options describe behavior that does not exist: the inner call is not ignored, no separate app is needed, and macros are allowed to call other macros.

The search bar's Expand shortcuts option (Ctrl+Shift+E) previews the search with macros and their arguments substituted before it runs. The job inspector reports on a job after it runs, the Field Extractor preview shows extraction results, and the lookup definition editor lists lookup columns.