Splunk Core Certified Power User Exam Survival Guide

Window: Global | 60 Q / 60 min | Search, fields, transforms, reports

Must-do topics

• SPL basics: search, time modifiers, stats, eval, where, sort, table
• Fields & knowledge objects: field extractions (rex/kv), lookups, tags/aliases
• Transforms: stats, chart, timechart, eventstats, streamstats, transaction
• Reports/dashboards: saving searches, alerts, scheduled reports, tokens
• Data onboarding: sourcetype, line-breaking, timestamps (high level)

Top traps (avoid)

• Using where before eval generates field; order matters
• Confusing stats vs eventstats vs streamstats use-cases
• Heavy transaction use when stats/dedup suffice
• Bad time modifiers → wrong window (earliest, latest, @d, -24h@h)

Time split

• 1 min/Q; answer recall first, then tricky SPL sequences

Last-48h checklist

• SPL one-pager: top 30 commands + examples
• Field extraction via rex (named groups) & props/transforms basics
• Lookup workflow (upload → automatic lookup → output vs inputlookup)

Quick facts

• stats count by field vs timechart span=1h count
• eval creates/updates field; where filters existing fields
• eventstats adds aggregate back to each event; streamstats computes cumulatives
• Time shortcuts: earliest=-7d@d latest=@d

Speed tactics

• Build SPL step-by-step; run with small head to validate
• Prefer stats+by over transaction unless sessionization required
• Save common searches; think in pipes and fields

Day-of mini-plan

• Warm-up: write 3 SPL queries (count by host, top 10, hourly trend)
• Keep calm; read options for subtle SPL ordering clues