ExamFinch.com My Study

Cheat sheet

Splunk Core Certified User Cheat Sheet

Practice this exam

Splunk Basics

  • 5% of exam
  • Core Components Platform Uses Splunk Apps User Settings Basic Navigation

Basic Searching

  • 22% of exam
  • Basic Searches Time Ranges Search Results Timeline Search Jobs Saved Results

Using Fields in Searches

  • 20% of exam
  • Field Basics Field Filters Fields Sidebar Selected Fields Interesting Fields

Search Language Fundamentals

  • 15% of exam
  • Search Pipeline Index Filters Table Command Rename Command Dedup Command Sort Command

Basic Transforming Commands

  • 15% of exam
  • Top Command Rare Command Stats Command Basic Statistics Result Tables

Reports and Dashboards

  • 12% of exam
  • Save Reports Edit Reports Statistics Tables Chart Visualizations Dashboard Panels

Creating and Using Lookups

  • 6% of exam
  • Lookup Files Lookup Definitions Automatic Lookups Lookup Command Field Enrichment

Scheduled Reports and Alerts

  • 5% of exam
  • Scheduled Reports Report Schedules Alert Triggers Alert Actions Fired Alerts

Quick Facts

  • Exam Splunk Core Certified User
  • Questions 60 multiple choice
  • Assessment 57 minutes
  • Seat time 60 minutes total
  • Agreement 3 minutes
  • Level Entry-level
  • Prerequisites None
  • Pass score Not published
  • Price $130 USD per attempt
  • Retake waits 7d, 14d, 28d, then 56d
  • Delivery Pearson VUE
  • Materials Closed-book

Platform Basics BA

  • Indexer Indexes and stores events Core
  • Search head Runs user searches Core
  • Forwarder Sends data onward Input
  • App Packaged views and knowledge Context
  • Search app Default search workspace UI
  • Settings User and object controls UI
  • Search bar Enter SPL search UI
  • Time picker Set event-time window UI

Time Window SE

  • Earliest enters; latest leaves
  • Earliest inclusive Latest exclusive @ snaps backward

Terms vs Field Filters SE

Terms

  • Search raw event text
  • Quote exact phrases
  • Wildcards expand terms

Field filters

  • Match extracted values
  • Use field=value
  • Usually more precise
  • Text anywhere vs named value

Search Builder SE

  • Know data index → index=name ( Start narrow )
  • Know data format → sourcetype=name ( Add early )
  • Need exact phrase → Quoted text ( Keep together )
  • Need either value → OR ( Uppercase )
  • Need exclusion → NOT ( Verify scope )
  • Need field match → field=value ( Prefer specific )

Base Search Syntax SE

  • index=main Limit target index First
  • sourcetype=access_combined Limit data format Fast
  • host=web01 Limit event origin Filter
  • source=/var/log/app Limit input source Filter
  • "login failed" Match exact phrase Quote
  • fail* Wildcard term suffix Pattern
  • AND Require both expressions Boolean
  • OR Accept either expression Boolean
  • NOT Exclude matching expression Boolean

AND vs OR SE

AND

  • Both must match
  • Narrows results
  • Implicit between terms

OR

  • Either can match
  • Broadens results
  • Write uppercase
  • Intersect vs combine

Time Picker SE

  • Need rolling hour → earliest=-1h latest=now
  • Need today → earliest=@d latest=now
  • Need yesterday → earliest=-d@d latest=@d
  • Need previous month → earliest=-mon@mon latest=@mon
  • Need calendar boundary → Add @ snap
  • Need exact duration → Omit @ snap

Time Modifiers SE

  • earliest=-15m Start fifteen minutes ago Relative
  • latest=now End at search start Relative
  • earliest=@d Start current midnight Snap
  • earliest=-d@d Start yesterday midnight Snap
  • latest=@d Exclude current midnight onward Boundary
  • 24h Exact rolling duration Duration
  • 1d@d Prior day boundary Calendar
  • mon@mon Previous month start Calendar
  • latest boundary Exclusive endpoint Rule

Results and Jobs SE

  • Events tab Raw matching events Results
  • Statistics tab Transforming result table Results
  • Visualization tab Chart transformed results Results
  • Timeline Event count over time Refine
  • Pause Suspend running job Job
  • Stop End running job Job
  • Inspect job Review execution details Job
  • Export Download current results Save

Field Workflow FI

  • Field Searchable name-value pair Concept
  • Selected fields Always shown sidebar fields Sidebar
  • Interesting fields Frequent discovered fields Sidebar
  • Field click View values and counts Explore
  • Value include Add field=value filter Filter
  • Value exclude Add field!=value filter Filter
  • host Event origin field Default
  • source Input source field Default
  • sourcetype Data structure field Default
  • _time Event timestamp field Default

Search Flow LA

  • Find | Filter | Transform | Present
  • Find: base search Filter: fields Transform: stats Present: table/chart

Fields vs Table LA

fields

  • Include or exclude fields
  • Shapes downstream results
  • Minus removes fields

table

  • Displays ordered columns
  • Creates tabular output
  • Usually place late
  • Shape fields vs display columns

Pipeline Commands LA

  • | Pass results rightward Pipeline
  • table host status Keep ordered columns Display
  • fields host status Keep named fields Shape
  • fields - _raw Remove named field Shape
  • rename src AS source Rename result field Label
  • dedup user Keep first per value Rows
  • sort - count Descending numeric sort Order
  • sort + host Ascending field sort Order
  • head 10 Keep first ten rows Rows

Stats Grouping TR

  • Function first; BY groups
  • count measures BY host groups No BY totals

Top vs Rare TR

top

  • Most common values
  • Adds count and percent
  • Descending frequency

rare

  • Least common values
  • Adds count and percent
  • Ascending frequency
  • Common vs uncommon

Result Command Picker TR

  • Need frequent values → top
  • Need uncommon values → rare
  • Need grouped measures → stats BY
  • Need category chart → chart
  • Need time series → timechart

Transforming Commands TR

  • top user Most common values Count+percent
  • rare user Least common values Count+percent
  • stats count Count matching events Aggregate
  • stats count BY host Count per host Group
  • sum(bytes) Total numeric values Function
  • avg(duration) Average numeric values Function
  • dc(user) Distinct value count Function
  • values(action) Distinct field values Function
  • min(bytes) Smallest numeric value Function
  • max(bytes) Largest numeric value Function

Stats vs Timechart TR

stats

  • General aggregations
  • Optional BY grouping
  • No automatic time axis

timechart

  • Time-based aggregation
  • Automatic _time buckets
  • Optional split series
  • Any groups vs time buckets

Saved Objects RE

  • Report repeats; dashboard displays; alert reacts
  • Report: one search Dashboard: many panels Alert: conditional action

Report vs Dashboard RE

Report

  • One saved search
  • Table or visualization
  • Reusable directly

Dashboard

  • Collection of panels
  • Multiple views together
  • Layout is editable
  • One search vs many panels

Saved Object Picker RE

  • Reuse one search → Report
  • Combine visual panels → Dashboard
  • Run every interval → Scheduled report
  • Fire on condition → Alert
  • Enrich search fields → Lookup
  • Enrich automatically → Automatic lookup

Charts and Timecharts RE

  • chart count BY status Category aggregation Chart
  • chart count OVER host Host on x-axis Chart
  • chart count OVER host BY status Category plus split series Chart
  • timechart count Counts across time Time
  • timechart span=1h count Hourly count buckets Time
  • timechart count BY status Time series per status Time
  • Visualization Requires transformed results Display

Reports RE

  • Report Saved search for reuse Object
  • Save As Report Persist current search Create
  • Search string Defines report results Edit
  • Time range Defines report window Edit
  • Statistics report Displays result table Table
  • Chart report Displays visualization Visual
  • Permissions Control report visibility Share

Dashboards RE

  • Dashboard Collection of visual panels Object
  • Panel Single dashboard visualization Unit
  • Add to dashboard Place report panel Create
  • New dashboard Create panel container Create
  • Edit dashboard Change panels and layout Edit
  • Panel source Report supplies results Data

Core Saved Objects RE

  • Ad hoc search Temporary search work Unsaved
  • Report Reusable saved search Saved
  • Dashboard Panels in one view Saved
  • Lookup definition Named enrichment settings Saved
  • Automatic lookup Configured search enrichment Saved
  • Scheduled report Report with recurring run Saved
  • Alert Search with trigger Saved

Lookup vs Inputlookup LO

lookup

  • Enrich existing events
  • Matches key fields
  • Adds output fields

inputlookup

  • Generates lookup rows
  • Starts from lookup
  • No event stream required
  • Enrich events vs read table

Lookup Workflow LO

  • Lookup file External enrichment table Data
  • Lookup definition Named lookup configuration Object
  • Match field Joins event and lookup Key
  • Output field Adds lookup value Enrich
  • lookup assets ip Match lookup ip field Command
  • OUTPUT owner Add owner field Command
  • OUTPUTNEW owner Preserve existing owner Command
  • Automatic lookup Enrich matching searches automatically Config
  • inputlookup assets.csv Read lookup as results Generate

Scheduled Report vs Alert SC

Scheduled report

  • Runs every schedule
  • Actions each run
  • Recurring delivery

Alert

  • Evaluates trigger condition
  • Fires when condition matches
  • Records triggered alerts
  • Run always vs trigger condition

Schedules and Alerts SC

  • Scheduled report Runs every configured interval Schedule
  • Schedule Defines run frequency When
  • Time range Window each run searches Window
  • Alert Search plus trigger condition Detect
  • Trigger condition Decides alert firing If
  • Alert action Runs after trigger Then
  • Per-result Trigger for each result Mode
  • Number of results Trigger by result count Condition
  • Triggered Alerts View fired alert records History

Common Traps

Blueprint scope

  • Use eight official domains ≠ Do not import Power User objectives

Retake escalation

  • First failure: wait 7 days ≠ Later waits: 14/28/56 days

Seat vs assessment

  • Assessment is 57 minutes ≠ Agreement adds 3 minutes

Latest boundary

  • Earliest is inclusive ≠ Latest is exclusive

Snap vs duration

  • @ rounds backward ≠ No @ keeps duration

Boolean casing

  • Write AND OR NOT uppercase ≠ Parentheses control grouping

Stats changes results

  • Transforms events into table ≠ Raw events no longer shown

Dedup ordering

  • Keeps first encountered value ≠ Sort first when priority matters

Report vs alert

  • Schedule runs the report ≠ Condition fires the alert

Lookup direction

  • Match keys must align ≠ OUTPUT adds enrichment fields

Last Minute

  • 1. 22% searching; 20% fields
  • 2. Start narrow with index
  • 3. Uppercase Boolean operators
  • 4. Earliest inclusive; latest exclusive
  • 5. @ snaps backward
  • 6. Pipe sends results rightward
  • 7. top common; rare uncommon
  • 8. stats functions precede BY
  • 9. timechart buckets by _time
  • 10. lookup enriches event rows
  • 11. Report saves one search
  • 12. Dashboard holds multiple panels
  • 13. Alert requires trigger condition
  • 14. Retakes: 7/14/28/56-day waits
  • 15. Stay within Core blueprint

Splunk Core Certified User

  • Practice Questions 219 questions Study Guide 36 topics Cheat Sheet 108 facts Flashcards 50 cards Free CE Podcast