Study guide
Splunk Power User study guide
Read a lesson, then practice the ideas you want to remember.
Lessons
- CIM Knowledge Objects, Data Models & Schemas
- Normalizing & Validating Data with the CIM A
- The Splunk Common Information Model & Normal
- Configuring transaction Constraints: maxspan
- Analyzing Transaction Output Fields: duratio
- transaction vs. stats: Performance & Archite
- Understanding Transactions & Event Grouping
- Field Extraction Management, Permissions & S
- Delimiter-Based Extractions with Field Extra
- Regular Expression Extractions with Field Ex
- Creating Basic Search Macros & Backtick Synt
- Macro Arguments, Validation & Evaluation Fun
- Macro Scoping, Permissions & Troubleshooting
- Creating GET and POST Workflow Actions — Free Study Guide 2026
- Creating Search Workflow Actions & Dynamic S
- Workflow Action Architecture & Field/Event C
- Accelerating Data Models & TSIDX Acceleratio
- Creating and Structuring Datasets & Hierarch
- Data Model Architecture & The Pivot Tool
- Aliases vs. Calculated Fields in the Search
- Creating and Configuring Calculated Fields
- Creating and Using Field Aliases — Free Study Guide 2026
- The eval Command & Core Evaluation Functions
- Filtering Data: search vs. where Commands
- Handling Missing Data with fillnull — Free Study Guide 2026
- Exam Facts, Logistics & Test-Taking Strategy
- Splunk Knowledge Objects & Search Pipeline A
- Combining Tags and Event Types for Data Clas
- Creating and Managing Tags — Free Study Guide 2026
- Creating and Using Event Types — Free Study Guide 2026
- The chart Command & Multi-Dimensional Aggreg
- The timechart Command & Time-Series Visualiz
- Transforming Options: limit, useother, usenu