Study guide
2.4 User Settings & Basic Navigation
Splunk Core Certified User Study Guide Exam
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts & Logistics 1.2 Study Strategy & Learning Path
2 Splunk Basics
2.1 Splunk Components 2.2 Uses of Splunk 2.3 Splunk Apps 2.4 User Settings & Basic Navigation
3 Basic Searching
3.1 Running Basic Searches 3.2 Setting Time Ranges 3.3 Contents of Search Results 3.4 Refining Searches 3.5 Using the Timeline 3.6 Working with Events 3.7 Controlling Search Jobs 3.8 Saving Search Results
4 Using Fields in Searches
4.1 Understanding Fields 4.2 Using Fields in Searches 4.3 The Fields Sidebar
5 Search Language Fundamentals
5.1 Basic Search Commands & Practices 5.2 The Search Pipeline 5.3 Specifying Indexes in Searches 5.4 table, rename, fields, dedup, and sort
6 Using Basic Transforming Commands
6.1 The top Command 6.2 The rare Command 6.3 The stats Command
7 Creating Reports and Dashboards
7.1 Saving and Editing Reports 7.2 Statistical Table Reports 7.3 Chart Visualization Reports 7.4 Creating Dashboards and Adding Reports 7.5 Editing Dashboards
8 Creating and Using Lookups
8.1 Lookup Concepts and File Examples 8.2 Creating Lookup Files and Definitions 8.3 Configuring Automatic Lookups 8.4 Using Lookups in Searches
9 Creating Scheduled Reports and Alerts
9.1 Scheduled Reports 9.2 Describing and Creating Alerts 9.3 Viewing Fired Alerts
2.4 User Settings & Basic Navigation
Key Takeaways Explain This Topic AI
User preferences commonly include full name, email, time zone, default application, and related account options under your account/settings menus.
Setting the correct time zone prevents misread event times and confusion with the time range picker.
The app bar switches apps; Settings is the configuration hub (what you can change depends on permissions).
Search & Reporting layout centers on the search bar, time range picker, timeline/events, fields sidebar, and job controls.
Last updated: August 2026
Topics 1.4 & 1.5 — Preferences and navigation
Domain 1 closes with two practical skills: customize user settings and navigate Splunk Web without getting lost. These are easy points on the exam if you have clicked through a live instance once or twice.
1.4 Customizing user settings
Your account preferences control how Splunk presents time, which app opens by default, and basic profile information. Exact menu labels can vary slightly by Splunk version, but the concepts are stable:
- Preference area Why it matters for Users
- Full name / email Identifies you on shared objects and notifications
- Time zone Controls how event timestamps and time ranges display for you
- Default app Chooses which app loads after login (often Search & Reporting)
- Other locale/UI options Language or UI behaviors where available
- Time zone — high-value detail
Machine data is stored with timestamps. Your time zone preference affects how those times appear and how relative ranges like "Last 24 hours" align to your local clock. If your time zone is wrong, you may think events are "missing" when they are simply outside the window you intended.
Exam trap: Assuming time zone is only an Admin indexer setting. Indexers store data; Users still configure their display/preference time zone .
Default application
If you constantly switch back to Search & Reporting after login, set it as your default app . If your organization wants you landing on a custom SOC app, set that instead. Default app is a productivity setting, not a security control by itself.
Permissions reality check
Some Settings pages are visible but not editable for restricted Users. Exam questions usually test whether you know where preferences live and what they change, not how to escalate privileges.
1.5 Basic navigation in Splunk
Learn the chrome of Splunk Web:
App bar
The app bar (application menu) lists apps you can access. Switching apps changes navigation menus, available dashboards, and sometimes the home view. Always glance at the current app name before panicking that a report "disappeared."
Settings
Settings is the gear/menu area for configuration categories (Knowledge, Data, Distributed environment, and more — depending on product and permissions). As a User, you may use Settings for limited tasks allowed by your role (for example, certain knowledge objects later in the blueprint such as lookups, when permitted). Do not confuse Settings with the search bar.
Search & Reporting layout (memorize the regions)
When you open Search & Reporting, orient yourself to these regions:
Search bar — type SPL and keywords here.
Time range picker — set earliest/latest (Presets, Relative, Real-time, Date Range, Date & Time Range, Advanced).
Timeline — visual distribution of events over time for non-transforming searches; useful to spot spikes and drag-select windows.
Events / Statistics / Visualization — tabs that appear based on whether your search returns raw events or transformed results.
Fields sidebar — Selected fields and Interesting fields; click fields to filter or explore values (Domains 3.x deepen this).
Job menu / controls — pause, stop, share, inspect, or manage the search job (Domain 2.7).
- UI element User action
- Search bar Enter search string
- Time range picker Bound the temporal scope
- Timeline Explore event density over time
- Fields sidebar Discover and apply fields
- Job controls Manage running/finished searches
- App bar Switch workspace
- Settings Open configuration areas you can access
- Navigation scenarios
Scenario A — Wrong times: Events look three hours off. Check your user time zone preference before blaming the data source.
Scenario B — Can't find Search: You landed in a custom app. Use the app bar to open Search & Reporting .
Scenario C — Looking for Alerts configuration later: You will return to alerting workflows in Domain 8; for now, know that navigation starts from the Search app and related menus once a search is worth scheduling.
Scenario D — Settings overwhelm: On the exam, match the task to the area: personal preferences vs app switching vs running a search. Do not pick "Settings → indexing → create index" for a User personalization question.
How 1.4 and 1.5 support the rest of the exam
Correct time zone + confident time range picker use prevents Domain 2 timing mistakes.
Knowing Search & Reporting layout accelerates Domains 2–6 because every search skill sits inside that UI.
App bar awareness prevents false "feature missing" conclusions when objects live in another app.
Study drill (10 minutes in a lab)
Open your account preferences; note time zone and default app.
Switch apps via the app bar, then return to Search & Reporting.
Run index=_internal | head 10 with Last 15 minutes; identify search bar, time picker, events, fields sidebar.
Open Settings and scan category names without changing Admin-only items.
If you can narrate those four steps without screenshots, Domain 1 navigation is exam-ready.
Domain 1 wrap-up
You can now: identify components (1.1), state Splunk's uses (1.2), define apps/add-ons and Search & Reporting (1.3), and personalize/navigate the UI (1.4–1.5). That is the entire 5% Basics domain — small weight, foundational vocabulary. Next chapters expand into Basic Searching (22%) , where these UI skills become muscle memory under time pressure.