Splunk Core Certified User

Last checked November 10, 2026 against the official Splunk exam page.

1. Question 1Basic Searching

   An analyst wants a search to cover only the last hour, typed directly into the search string instead of using the time range picker. Which search term does this?

   1. Aearliest=-1h latest=now
   2. Btime=-1h until=now
   3. Csince=-1h until=now
   4. Dwindow=last_1_hour latest=now
   Show answer and explanationHide answer

   Correct answer: A

   earliest and latest are time modifiers that set the start and end of the search window, and -1h means one hour before the current time. The other options use names such as window, time, since and until, which are not Splunk time modifiers.

2. Question 2Using Fields in Searches

   Which of these is a default field that Splunk assigns to every event?

   1. Acustomer_id
   2. Bresponse_time
   3. Csourcetype
   4. Dbytes_sent
   Show answer and explanationHide answer

   Correct answer: C

   Every event has default fields such as host, source, sourcetype, index and _time. customer_id, response_time and bytes_sent appear only when the event data contains them or when someone has configured an extraction for them.

3. Question 3Search Language Fundamentals

   In the search index=web sourcetype=access_combined | stats count by status | sort -count, what does the sort command work on?

   1. AThe table of status values and counts that the stats command produced
   2. BThe list of all indexes and sourcetypes the user is allowed to search
   3. CThe fields that were extracted at index time from the forwarder's input
   4. DThe raw events from the web index exactly as they were before stats ran
   Show answer and explanationHide answer

   Correct answer: A

   Each command in the pipeline receives the output of the command before it, so sort orders the status-and-count table that stats produced. The raw events are reduced by stats before sort runs, and the index list and index-time fields are not inputs to sort.

4. Question 4Using Basic Transforming Commands

   An analyst wants to see the most frequent values of the host field, along with the count and percent for each value. Which command should be used?

   1. A| rare host
   2. B| stats dc(host)
   3. C| top host
   4. D| dedup host
   Show answer and explanationHide answer

   Correct answer: C

   top lists the most common values of a field and adds count and percent columns by default. rare lists the least common values, stats dc(host) returns only the number of distinct hosts, and dedup removes duplicate events rather than summarizing values.

5. Question 5Creating Reports and Dashboards

   A user has built a search that produces a statistics table, and teammates need to open that table later without retyping the search. What should the user do?

   1. AExport the events to a JSON file
   2. BSave the search as a report
   3. CCopy the search into a text file
   4. DSave the search as an event type
   Show answer and explanationHide answer

   Correct answer: B

   Saving the search as a report stores the search so teammates can open it later and see its results. Exporting events gives them data but not the reusable search, an event type only tags matching events, and a text copy still has to be pasted into the search bar by someone.