Splunk Core Certified Power User

Last checked November 10, 2026 against the official Splunk exam page.

1. Question 1Correlating Events

   A security analyst wants all events from the same client IP address to form one transaction, as long as no gap between consecutive events is longer than five minutes. Which search meets this requirement?

   1. Aindex=web | stats count by clientip
   2. Bindex=web | transaction clientip maxpause=5m
   3. Cindex=web | transaction clientip startswith="login"
   4. Dindex=web | dedup clientip
   Show answer and explanationHide answer

   Correct answer: B

   The maxpause option sets the largest allowed gap between consecutive events in a transaction, so a longer gap starts a new transaction. Stats returns one count per IP without grouping events, startswith defines a start event rather than a time gap, and dedup keeps only one event per IP.

2. Question 2Filtering and Formatting Results

   An analyst needs to keep only the events in which bytes_out is greater than bytes_in. Which command should follow the initial search to do this?

   1. A| dedup bytes_out bytes_in
   2. B| search bytes_out > bytes_in
   3. C| where bytes_out > bytes_in
   4. D| table bytes_out bytes_in
   Show answer and explanationHide answer

   Correct answer: C

   The where command evaluates an expression that can compare two fields, so it keeps only the matching events. The search command matches keywords and literal field values and cannot compare two fields, dedup removes duplicate events, and table only chooses which columns to display.

3. Question 3Creating and Managing Fields

   Application logs contain lines such as 2026-11-01|10.1.4.20|GET|/index.html|200, where a pipe character separates every value and the events contain no field names. Which Field Extractor approach fits best?

   1. AUse the Delimiters method, choose the pipe as the delimiter, and name the fields in the order they appear.
   2. BCreate a tag for each column value so the search can locate every value through a shared tag label in the events.
   3. CCreate a field alias that maps each column of the raw event text to a new field name.
   4. DAdd an index-time transform to indexes.conf that writes each column of every event to its own separate indexed field.
   Show answer and explanationHide answer

   Correct answer: A

   The Delimiters method extracts fields by splitting each event on a consistent character, and you name the fields in column order. Tags label existing field values, field aliases rename fields that already exist, and indexes.conf controls index storage rather than field extraction.

4. Question 4Creating Field Aliases and Calculated Fields

   Two sourcetypes store the client address under different names: one uses src_ip and the other uses client_ip. An analyst wants searches to use src_ip for both, while the raw data and existing searches stay unchanged. Which knowledge object should be created?

   1. AAn index-time extraction that rewrites client_ip to src_ip in every event
   2. BA field alias for the second sourcetype that maps client_ip to src_ip
   3. CA tag named src_ip applied to all values of the client_ip field
   4. DAn event type whose search string contains client_ip so it is labeled src_ip
   Show answer and explanationHide answer

   Correct answer: B

   A field alias is a search-time mapping that makes an existing field available under another name and leaves the raw data untouched. An index-time change alters what is stored, a tag only labels values, and an event type classifies events by search criteria without renaming any field.

5. Question 5Creating Tags and Event Types

   A SOC team wants every host value that belongs to the production environment to carry a shared label, so analysts can search for the label instead of typing a long list of hostnames. Which feature provides this?

   1. AA calculated field that copies the host field into a new field
   2. BA field alias that renames the host field to production
   3. CA tag applied to the production host values
   4. DA dashboard panel that lists all production hostnames in a table
   Show answer and explanationHide answer

   Correct answer: C

   A tag is a label attached to specific field-value pairs, so searches can use the label instead of repeating the values. A field alias renames a field, a calculated field computes a new value, and a dashboard panel only displays results without labeling anything.