Free Splunk Core Certified User practice test: 30 questions with answers

earliest and latest are time modifiers that set the start and end of the search window, and -1h means one hour before the current time. The other options use names such as window, time, since and until, which are not Splunk time modifiers.

NOT excludes events that match the term that follows it, so the 200 responses are removed. Adding status=200 with an implicit AND or with OR keeps the 200 events, and a where clause after the search keeps only events where status is 200.

Selecting the timeline bars over the spike narrows the time range to that section, so only the events in the spike are shown. Search mode changes how much work Splunk does, sort reorders results without limiting the time range, and the Job inspector shows execution details rather than filtering events.

The Events tab offers a Raw format that displays the original text of each event. The Statistics tab summarizes results, the Patterns tab groups similar events, and the Job inspector shows how the search ran, so none of those shows the original text.

Every event has default fields such as host, source, sourcetype, index and _time. customer_id, response_time and bytes_sent appear only when the event data contains them or when someone has configured an extraction for them.

user and action are field names, with alice and login as their values, so they can be searched by name, for example user=alice. Sourcetypes and indexes are separate metadata, and the words are not simply plain text with no field meaning.

The asterisk wildcard matches any sequence of characters, so status=4* matches values that begin with 4. status=*4 matches values that end with 4, status=4 requires an exact match, and status=4xx searches for the literal text 4xx.

host=web01 and host="web01" both compare the host field with the value web01, and the quotes are optional for simple values. host:web01 is not Splunk field syntax, while the last two options search for the words web01 and host as keywords rather than as a field.

Each command in the pipeline receives the output of the command before it, so sort orders the status-and-count table that stats produced. The raw events are reduced by stats before sort runs, and the index list and index-time fields are not inputs to sort.

The index= term restricts the search to a single index. sourcetype and source filter on different metadata, and security AND index is a keyword search for those words in event text, not an index restriction.

table displays only the named fields as columns, and fields keeps only the named fields, or removes them when a minus sign is used. dedup removes duplicate events, sort only changes the order, and rename changes a field name without limiting the other fields.

Filtering by index, time range and search terms at the start limits how many events the rest of the pipeline must handle. Removing the time range widens the search, moving table earlier does not reduce the events, and extra stats commands before filtering add work.

top lists the most common values of a field and adds count and percent columns by default. rare lists the least common values, stats dc(host) returns only the number of distinct hosts, and dedup removes duplicate events rather than summarizing values.

rare returns the least frequent values of a field, which is useful for spotting unusual items. top returns the most frequent values, sort only reorders results, and table displays the field without counting its values.

stats with a by clause groups the events by each distinct host value and returns one row per host with its count. It does not return raw events or a single total, and timechart is the command that produces a time-based chart.

top summarizes a field into its most frequent values and rare into its least frequent ones. Neither command filters for missing values, removes duplicate events, or returns raw events, because both produce summary tables.

Saving the search as a report stores the search so teammates can open it later and see its results. Exporting events gives them data but not the reusable search, an event type only tags matching events, and a text copy still has to be pasted into the search bar by someone.

timechart is a transforming command that counts events into hourly time buckets, and the line chart then plots those counts over time. table and fields return unaggregated events and dedup keeps one event per host, so none of them gives hourly counts.

A dashboard can hold several panels, and each panel can be based on a saved report, so the reports appear together on one page. Alerts send notifications, lookups enrich events with reference values, and event types label matching events, so none of them builds a combined page.

Editing the saved report keeps its existing schedule and sharing settings while the time range is updated. Deleting and recreating it loses those settings, exporting results does not change the report, and copying it to another app and removing the original changes where the report lives.

A lookup matches a value in search results against a table, often a CSV file, and adds the matching columns to each event. A scheduled search, a summary index and a static text panel do not enrich events from a reference table.

The lookup command matches each event's employee_id against hr_lookup and outputs the department column. inputlookup returns the lookup table itself, outputlookup writes results to a lookup, and table only displays fields without adding department from the lookup.

The CSV file has to be uploaded or placed where Splunk can read it, and a lookup definition gives it a name that searches can refer to. A scheduled report, a dedicated index and a dashboard panel are not required for a lookup to work in searches.

An automatic lookup applies a lookup definition to matching events in searches without a lookup command each time. A scheduled search runs on a timer instead of applying to every search, outputlookup writes results to a lookup file, and a field alias only renames a field.

A universal forwarder is a lightweight agent that sends data to Splunk with minimal resource use and no parsing. An indexer stores and makes events searchable, a search head is where users run searches, and a license manager tracks license usage, so none of those is installed on each server to forward logs.

A search head accepts search requests from users, sends them to the indexers, and presents the combined results. Indexers store and manage the indexed data, forwarders collect and send data, and the license manager tracks license usage, so those roles do not describe a search head.

An app is a package of searches, dashboards, configuration files and other components that can be installed and managed as a unit. An index bucket is a storage unit for indexed data, a lookup table holds reference values, and a search job is a single executed search.

A scheduled report runs its search on a recurring schedule and can send the results by email. A dashboard panel refreshes only when viewed, an event type labels matching events, and the Job inspector shows execution details without scheduling anything.

An alert runs a search on a schedule or in real time and triggers actions, such as email or a webhook, when results meet its trigger condition. A static report runs only when opened, an event type only labels matching events, and a lookup definition only maps a name to a lookup file.

A real-time alert evaluates its conditions continuously as events arrive, so it can react within seconds. A scheduled alert checks results only at its scheduled runs, a saved report has no trigger, and an event type only labels events.