Free Splunk Core Certified Power User Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Splunk Core Certified Power User Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A sales search runs chart sum(sales) BY product quarter. The events contain product A and B, quarters Q1 and Q2, and sales totals A/Q1=5, A/Q2=7, B/Q1=2, and B/Q2=9. Which result table is produced?

   1. A.Rows A and B; Q1 values 5, 2; Q2 values 7, 9Correct answer: A
   2. B.Rows A and B; Q1 values 5, 7; Q2 values 2, 9
   3. C.Rows A and B; Q1 values 7, 9; Q2 values 5, 2
   4. D.Rows A and B; Q1 values 2, 5; Q2 values 9, 7

   Explanation: The chart reference says, "each column represents a distinct value of the column-split field." The row-split product labels the rows, while quarter labels the series. Summing the specified values gives Q1 values 5 and 2 and Q2 values 7 and 9.

   Reference: Splunk Enterprise Search Reference: chart — Usage, Using row-split and column-split fields

2. 2A result has the numeric field cost=10. After an analyst runs eval cost=cost+5, what value does cost have in that result?

   1. A.15Correct answer: A
   2. B.10
   3. C.5
   4. D.105

   Explanation: The eval reference says "the results of the eval expression overwrite the values in that field." Here the arithmetic result 10+5 replaces the existing cost with 15.

   Reference: Splunk Enterprise Search Reference: eval — Description

3. 3Four events in one transaction have timestamps 09:09, 09:05, 09:02, and 09:00 on the same day. Which time does the resulting transaction inherit?

   1. A.09:00Correct answer: A
   2. B.09:02
   3. C.09:05
   4. D.09:09

   Explanation: The transaction reference says transactions include "the time and date fields of the earliest member." Of the four supplied member times, 09:00 is earliest.

   Reference: Splunk Enterprise Search Reference: transaction — Description

4. 4A sample event contains status=503 clientip=192.0.2.1. An analyst uses the regex Field Extractor to define the status field. Which span should be highlighted for the field extraction?

   1. A.503Correct answer: A
   2. B.status=503
   3. C.status
   4. D.50

   Explanation: The Select Fields instructions say to "highlight values in the sample event that you want the field extractor to extract as fields." The status value is 503, excluding its key and separator.

   Reference: Field Extractor: Select Fields step — Select Fields step

5. 5An event contains src=alpha and does not already contain client. An analyst aliases src as client. Which pair of field values remains available for searching?

   1. A.src=alpha, client=alphaCorrect answer: A
   2. B.src=alpha, client=null
   3. C.src=null, client=alpha
   4. D.src=alpha, client=src

   Explanation: The documentation says, "An alias does not replace or remove the original field name." The alias client provides the same value alpha while src remains available.

   Reference: Create field aliases in Splunk Web — Introduction

6. 6An analyst wants to search for the tag critical regardless of which field carries the tagged value. Which search term should be used?

   1. A.tag=criticalCorrect answer: A
   2. B.tag::host=critical
   3. C.eventtype=critical
   4. D.host=critical

   Explanation: The tag documentation says, "To search for a tag associated with a value in any field" use tag=<tagname>. The field-specific form instead restricts the field.

   Reference: Tag field-value pairs in Search — Search for tagged field values

7. 7An analyst designs a reusable macro definition that consists solely of a search term rather than an entire SPL command. Which definition illustrates that use?

   1. A.status=200Correct answer: A
   2. B.stats count by host
   3. C.eval status=200
   4. D.where status=200

   Explanation: The macro guide states, "Search macros can be any part of a search, such as an eval statement or search term and do not need to be a complete command." The first definition is a search term on its own.

   Reference: Use search macros in searches — Introduction

8. 8A knowledge manager is comparing workflow action types. Which assignment matches the examples in the workflow overview?

   1. A.GET: WHOIS lookup; POST: issue creation; Search: secondary Splunk searchCorrect answer: A
   2. B.GET: secondary Splunk search; POST: issue creation; Search: WHOIS lookup
   3. C.GET: issue creation; POST: WHOIS lookup; Search: secondary Splunk search
   4. D.GET: WHOIS lookup; POST: secondary Splunk search; Search: issue creation

   Explanation: The overview gives GET as a way to "run domain name queries against external WHOIS databases", POST for "creating entries in external issue management systems", and Search for "secondary searches that use specific field values from an event".

   Reference: About workflow actions in Splunk Web — Define workflow actions using Splunk Web, GET workflow actions

9. 9A Pivot dataset has visible fields latency and count and hidden fields trace_id and region. Which pair is available to the user as Pivot fields?

   1. A.latency and countCorrect answer: A
   2. B.latency and trace_id
   3. C.count and region
   4. D.trace_id and region

   Explanation: The guide says, "the unhidden fields you define for that dataset comprise the list of fields that you choose from in Pivot." Only latency and count are visible in this dataset.

   Reference: About data models — Data models generate searches

10. 10A team maps equivalent login events from two vendors to a shared CIM representation. Which pair of field-name and tag assignments follows the CIM's normalization principle?

    1. A.Vendor 1: user, authentication; Vendor 2: user, authenticationCorrect answer: A
    2. B.Vendor 1: user, authentication; Vendor 2: account, authentication
    3. C.Vendor 1: user, authentication; Vendor 2: user, network
    4. D.Vendor 1: user, authentication; Vendor 2: account, network

    Explanation: The overview describes normalization as "using the same field names and event tags for equivalent events from different sources or vendors." The first mapping preserves both for equivalent events.

    Reference: Overview of the Splunk Common Information Model — Why the CIM exists