I85PREP
⌘ K
Splunk Power User study materials
Splunk Power User study resources

Splunk Power User practice questions

One question at a time. Build your Splunk Power User understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Basic Searching and Search Under the Hood

If you run a search without specifying a time range, what range does Splunk apply?

  1. All time Correct answer.
  2. Last 60 minutes
  3. Last 24 hours
  4. Today

Explanation

A new search with no explicit time range defaults to All time, so Splunk considers every event it can read. Choosing a narrower range limits the buckets and events that must be scanned, which usually speeds the search up.

Question 2Basic Searching and Search Under the Hood

An inputs.conf stanza does not specify an index for its data. Which index receives that data by default?

  1. summary
  2. main Correct answer.
  3. default
  4. _internal

Explanation

When no index is named for incoming data, Splunk writes it to the main index. The summary index is used for summary-index output and _internal holds Splunk's own operational logs.

Question 3Basic Searching and Search Under the Hood

Which command produces a results table containing only the fields you name and lets you rename those fields with AS?

  1. eval
  2. rename
  3. table Correct answer.
  4. fields

Explanation

The table command selects the listed fields, sets the column order, and supports AS to rename columns in the output. The fields command also limits fields but has no AS renaming, while rename only changes field names.

Question 4Basic Searching and Search Under the Hood

What does the dedup command do?

  1. Removes events with duplicate field values Correct answer.
  2. Counts identical events and returns totals
  3. Sorts events by _time and drops the oldest
  4. Merges events that share a transaction ID

Explanation

dedup removes events whose values in the specified field (or fields) match an earlier event, keeping one representative event. With no field named it dedups on the full raw event. It does not sort, count, or merge events.

Question 5Basic Searching and Search Under the Hood

Which syntax sorts results from the highest value of the numeric field bytes to the lowest?

  1. sort - bytes Correct answer.
  2. sort bytes direction=desc
  3. sort desc bytes
  4. sort bytes desc

Explanation

A minus sign placed before a field name in sort reverses the default ascending order, giving descending order. The sort command has no desc keyword or direction argument.

Question 6Basic Searching and Search Under the Hood

Terms typed before the first pipe character of a search are passed to which command implicitly?

  1. eval
  2. where
  3. stats
  4. search Correct answer.

Explanation

The first segment of a search string is automatically treated as the argument of the search command, even though the word search is not typed. Later segments after a pipe must name their command explicitly.

Question 7Basic Searching and Search Under the Hood

Which field always holds the original text of an event exactly as it was indexed?

  1. _raw Correct answer.
  2. _indextime
  3. sourcetype
  4. _time

Explanation

_raw contains the unparsed event text as it was read at index time, and most search-time field extraction works from it. _time is the event timestamp, _indextime is when Splunk processed the event, and sourcetype is a classification value.

Question 8Basic Searching and Search Under the Hood

Which index contains Splunk's own internal logs and metrics?

  1. main
  2. _internal Correct answer.
  3. audit
  4. summary

Explanation

The _internal index stores Splunk's operational logs and metrics, which is why index=_internal searches reveal platform behaviour. main holds user data, summary holds summary-indexed results, and audit records administrative activity.

Question 9Basic Searching and Search Under the Hood

Which search is likely to run fastest when you only want a count of status=500 events per host?

  1. index=web | stats count by host status
  2. index=web | top host status
  3. index=web status=500 | stats count by host Correct answer.
  4. index=web | stats count by host | search status=500

Explanation

Placing the status=500 filter in the base search removes non-matching events before the transforming command runs, so stats processes far fewer events. Filtering early is the main lever for search performance.

Question 10Basic Searching and Search Under the Hood

Which statement best distinguishes top from stats count by?

  1. top cannot be used with a by clause
  2. top computes values across all events while stats only computes over a subset of events
  3. top only works on numeric fields
  4. top returns the N most common values plus a percent column Correct answer.

Explanation

top returns a limited number of the most frequent values (10 by default) and adds a percent column, which makes it a quick ranking tool. stats count by returns every group with counts and no percent column.

Question 11Basic Searching and Search Under the Hood

Which command removes the host field from the results while leaving every other field intact?

  1. dedup host
  2. fields - host Correct answer.
  3. table host
  4. rename host AS removed

Explanation

The fields command accepts a minus sign to exclude the named fields, keeping all others. table host would keep only host, dedup reduces events, and rename keeps the field under a new name.

Question 12Basic Searching and Search Under the Hood

What does the Search Job Inspector primarily show for a completed search?

  1. Execution costs per command and the search log Correct answer.
  2. The list of indexes the user is allowed to search
  3. The users who ran searches during the day
  4. The retention settings currently applied to each bucket

Explanation

The Job Inspector reports how long each command took, how many events each processed, messages, and the search log, which makes it the tool for diagnosing slow searches. It does not manage permissions or bucket retention.

Question 13Basic Searching and Search Under the Hood

What time window does earliest=-1d@d latest=now describe?

  1. Start of this week through now
  2. Start of yesterday through now Correct answer.
  3. Exactly the previous 24 hours
  4. Midnight today through now

Explanation

The relative modifier -1d moves back one day and @d then snaps to the beginning of that day, which is midnight yesterday. Without the @d snap you would get a rolling 24 hour window.

Question 14Basic Searching and Search Under the Hood

Which command extracts a new field from the raw event text using a search-time regular expression?

  1. lookup
  2. rex Correct answer.
  3. extract
  4. eval

Explanation

rex applies a named or inline regular expression to a field (by default _raw) and writes the captured groups into new fields. eval calculates values from existing fields, and lookup enriches events from a lookup table.

Question 15Basic Searching and Search Under the Hood

How does eventstats differ from stats?

  1. It requires a by clause
  2. It adds the aggregate value to each event Correct answer.
  3. It keeps only the aggregated rows
  4. It runs only on the indexer

Explanation

stats collapses events into one row per group, while eventstats computes the same aggregate and appends it to every original event, which preserves all events for later comparison. That is why eventstats output can be filtered again with search or where.

Question 16Basic Searching and Search Under the Hood

Which command groups related events that share a field value into single units using options such as maxspan and maxpause?

  1. stats
  2. dedup
  3. transaction Correct answer.
  4. append

Explanation

transaction joins events that share a value into one result, bounded by time constraints like maxspan and maxpause. stats aggregates values but does not merge events into single multi-event records.

Question 17Basic Searching and Search Under the Hood

Newly arriving data is written into which type of bucket, which is both writable and searchable?

  1. cold
  2. hot Correct answer.
  3. warm
  4. thawed

Explanation

Hot buckets are the active write targets and can be searched while they are being written. When a hot bucket rolls it becomes a read-only warm bucket, and cold buckets are read-only on slower storage.

Question 18Basic Searching and Search Under the Hood

What is the main effect of using a search term with a leading wildcard, such as *error?

  1. It limits the search to the last 24 hours
  2. It cannot use index terms and must examine many more events Correct answer.
  3. It uses the bloom filter to skip more buckets
  4. It automatically becomes case-insensitive

Explanation

Index terms are stored in a keyword index, so a term that begins with a wildcard has no usable prefix and cannot be resolved through those terms or the bloom filters. Splunk must instead scan far more events, which makes the search slow.

Question 19Basic Searching and Search Under the Hood

Which command filters events by evaluating a boolean expression built from eval functions, such as where like(field, "%foo%")?

  1. rex
  2. eval
  3. where Correct answer.
  4. search

Explanation

where accepts an eval-style expression and keeps only events for which it evaluates to true, which allows function-based comparisons that keyword search cannot express. eval instead writes the expression result into a field on every event.

Question 20Basic Searching and Search Under the Hood

What is the default maximum time a subsearch may run before Splunk stops it?

  1. 300 seconds
  2. 10 seconds
  3. 30 seconds
  4. 60 seconds Correct answer.

Explanation

Subsearches are capped at 60 seconds by default, after which results are finalized and the outer search continues with what was returned. They are also limited in the number of results they can return.

Question 21Basic Searching and Search Under the Hood

Which search returns events where the status field is either missing or set to something other than 200?

  1. index=web status NOT 200
  2. index=web status!=200
  3. index=web NOT status=200 Correct answer.
  4. index=web status=NOT 200

Explanation

The not-equal operator requires the field to exist and be unequal, so it silently drops events that lack the field. Negating an equality with NOT keeps those events as well, because a missing field satisfies the negation.

Question 22Basic Searching and Search Under the Hood

Which command reports on indexed fields using the tsidx files and does not read raw events?

  1. mstats
  2. stats
  3. tstats Correct answer.
  4. eventstats

Explanation

tstats queries the metadata stored in tsidx files for indexed fields, so it avoids reading raw events and returns results much faster than stats on large data. mstats is the equivalent command for metrics indexes.

Question 23Basic Searching and Search Under the Hood

You want dedup to keep the most recent event for each host value. Which search does that?

  1. index=main | dedup -host sortby +_time
  2. index=main | dedup host sortby -_time Correct answer.
  3. index=main | dedup host sortby _time
  4. index=main | dedup host

Explanation

dedup keeps the first event it encounters for each field value, so the retained event depends on the order at that point. sortby -_time orders the events newest first, which makes the newest event the one kept.

Question 24Basic Searching and Search Under the Hood

What lets Splunk skip entire buckets that cannot contain a search term?

  1. The timeline
  2. The transaction ledger
  3. The bloom filter stored in each bucket Correct answer.
  4. The summary index

Explanation

Each bucket carries a bloom filter that can prove a term is absent, letting the search head ignore that bucket without reading it. This bucket elimination, together with time range and index selection, is a primary reason narrow searches return quickly.

Question 25Basic Searching and Search Under the Hood

Which search returns one row per host and a separate column for each status value?

  1. index=web | chart count over host by status Correct answer.
  2. index=web | timechart count by host
  3. index=web | stats count by host status
  4. index=web | top host status

Explanation

chart count over host by status puts the values of host on the rows and the values of status into separate columns, which is the crosstab shape. stats count by host status returns one row per host-status pair instead.

Question 26Basic Searching and Search Under the Hood

When two search terms are separated only by a space in a Splunk search, which operator is applied implicitly?

  1. OR
  2. NOT
  3. AND Correct answer.
  4. XOR

Explanation

Splunk treats a space between two terms as an implicit AND, so every term must appear in the event for it to match. Writing the operator explicitly is optional but produces identical behavior. To widen results you must type OR between the terms yourself.

Question 27Basic Searching and Search Under the Hood

Which command returns only the first 10 results of a search when no argument is given?

  1. head Correct answer.
  2. sort
  3. tail
  4. top

Explanation

The head command limits results to the first N rows and defaults to 10 when no number is specified. It preserves the incoming event order rather than sorting. To keep more rows you supply a number, as in head 50.

Question 28Basic Searching and Search Under the Hood

Which search matches only events where the words connection refused appear together as a contiguous phrase?

  1. "connection refused" Correct answer.
  2. connection*refused
  3. connection OR refused
  4. connection AND refused

Explanation

Enclosing terms in double quotation marks tells Splunk to match them as a single phrase in the raw text rather than as separate tokens. Unquoted terms are joined with an implicit AND, which can match events where the words appear far apart. Quoted phrases are matched against the segmenter output for the event.

Question 29Basic Searching and Search Under the Hood

Which search mode is selected by default when you run a search in Splunk Web?

  1. Fast
  2. Verbose
  3. Debug
  4. Smart Correct answer.

Explanation

Smart mode is the default. It behaves like Fast mode for transforming searches and like Verbose mode for searches that return raw events, which balances speed against field availability. Users can switch modes from the search job settings.

Question 30Basic Searching and Search Under the Hood

A dashboard panel runs the search 'index=web earliest=-15m status=500' while the time range picker is set to Last 24 hours. Which time range does the search actually use?

  1. The overlap of the two ranges, which yields the last 15 minutes only when data exists
  2. The last 15 minutes Correct answer.
  3. A merged range that spans both settings, which yields the last 24 hours
  4. The last 24 hours, because the time range picker always overrides modifiers written into the search string

Explanation

Time modifiers placed directly in the search string take precedence over the time range picker for that search. The picker supplies a default range only when the search does not specify its own earliest or latest. Here the search string restricts results to the last 15 minutes.

Question 31Basic Searching and Search Under the Hood

Which statement correctly distinguishes the table command from the fields command?

  1. table and fields are interchangeable, because both permanently drop the raw event data from the results
  2. table keeps every event intact and only highlights the listed fields, while fields flattens the results so that each event becomes a row of a statistics table
  3. table outputs only the listed fields in a column layout, while fields keeps whole events and merely limits which fields are shown Correct answer.
  4. table sorts the results by the listed fields, while fields removes those fields from each event

Explanation

The table command converts results into a tabular output containing only the fields you list. The fields command keeps the events themselves and simply includes or excludes fields, which makes it a lighter-weight operation when you still want raw events. Neither command sorts the results.

Question 32Basic Searching and Search Under the Hood

Which stats function returns the number of distinct values of a field?

  1. values
  2. count
  3. dc Correct answer.
  4. sum

Explanation

The dc function counts distinct values of a field, for example dc(clientip) for unique visitors. The count function counts occurrences of events or of a field being present, including repeats. Distinct counts cannot be derived from a plain count when duplicates exist.

Question 33Basic Searching and Search Under the Hood

Which eval function returns the first of its arguments that is not null?

  1. if
  2. case
  3. nullif
  4. coalesce Correct answer.

Explanation

The coalesce function evaluates its arguments left to right and returns the first non-null value, which is useful for filling gaps between alternative fields. It accepts any number of arguments. The if and case functions choose between values based on conditions rather than on null status.

Question 34Basic Searching and Search Under the Hood

Which search orders results by the count field from highest to lowest?

  1. index=web | stats count by host | sort - count Correct answer.
  2. index=web | stats count by host | sort count
  3. index=web | stats count by host | sort + count
  4. index=web | stats count by host | sort count desc

Explanation

The sort command reverses direction when a field name is preceded by a minus sign, so sort - count gives descending order. A plus sign or no sign gives ascending order. The sort command does not accept the desc keyword used by SQL.

Question 35Basic Searching and Search Under the Hood

In a distributed deployment, which component receives the search, sends it to the indexers, and merges their results?

  1. The license manager
  2. The indexer cluster manager node
  3. The search head Correct answer.
  4. The universal forwarder

Explanation

The search head is responsible for parsing and distributing the search and for merging the partial results returned by indexers. Indexers perform the raw-event retrieval and much of the per-bucket work. Forwarders only collect and send data to indexers.

Question 36Basic Searching and Search Under the Hood

Which command appends the fields returned by a subsearch as new columns on the current results?

  1. appendcols Correct answer.
  2. format
  3. join
  4. append

Explanation

The appendcols command runs a subsearch and attaches its output fields as additional columns to the existing rows, matching them by position rather than by a shared key. The append command adds the subsearch output as extra rows instead. Use join when you need matching on a common field.

Question 37Basic Searching and Search Under the Hood

You have a CSV file of host-to-owner mappings. Which command adds an owner field to each event by matching on the host field?

  1. lookup Correct answer.
  2. join
  3. inputlookup
  4. outputlookup

Explanation

The lookup command enriches events with fields from a lookup table such as a CSV, matching on one or more fields by default. The table must already be defined or referenced as a lookup definition. inputlookup and outputlookup work with the lookup table as a data source or destination and do not enrich event results.

Question 38Basic Searching and Search Under the Hood

By default, how many results can a subsearch return before Splunk truncates its output?

  1. 10,500 Correct answer.
  2. 1,000
  3. 50,000
  4. Unlimited

Explanation

Subsearch results are capped at 10,500 rows by default, and Splunk adds a message to the job when this limit is reached. The cap exists because subsearch output is rewritten into the parent search string, so unbounded output would make the search unmanageable. Large subsearches should usually be restructured or replaced with lookup or stats-based approaches.

Question 39Basic Searching and Search Under the Hood

What happens when a hot bucket reaches its maximum size?

  1. It is deleted to free space
  2. It is rolled to warm and a new hot bucket is created Correct answer.
  3. It is converted into a frozen bucket and removed from the index immediately
  4. Its events are re-indexed into the default index and the bucket file is removed

Explanation

A hot bucket is the writable, searchable bucket that receives new data. When it grows past its size limit it is rolled: it becomes a warm bucket and a fresh hot bucket is opened for incoming events. Warm buckets remain searchable but are no longer written to.

Question 40Basic Searching and Search Under the Hood

Which command adds a cumulative running total to each event, keeping every event in the results, without collapsing them into a single row?

  1. streamstats Correct answer.
  2. transaction
  3. eventstats
  4. stats

Explanation

streamstats computes aggregates incrementally as events stream through and writes the running value onto each event, so the event count is preserved. eventstats also keeps events but computes a single non-cumulative value over the whole result set. stats reduces the result set to one row per group.

Question 41Fields, Field Extraction, and Regular Expressions

Which set of fields does Splunk automatically add to every event, regardless of sourcetype?

  1. user, action, and status
  2. timestamp, message, and severity
  3. host, source, and sourcetype Correct answer.
  4. src, dest, and port

Explanation

Splunk assigns host, source, and sourcetype to events as they are indexed, so these metadata fields are available for every event. Fields such as user or status exist only when they are extracted or explicitly added.

Question 42Fields, Field Extraction, and Regular Expressions

Which command narrows search results to only the fields you name and is preferred over table when you do not need column formatting?

  1. eval
  2. rename
  3. fields Correct answer.
  4. dedup

Explanation

The fields command includes or excludes fields and is optimized for that purpose. Use table only when you also need to control column order or tabular formatting.

Question 43Fields, Field Extraction, and Regular Expressions

Which command returns results as a table with columns in the exact order listed in the command?

  1. stats
  2. sort
  3. fields
  4. table Correct answer.

Explanation

The table command returns a table whose columns follow the order in which the fields are listed. The fields command also selects fields but does not apply table column formatting.

Question 44Fields, Field Extraction, and Regular Expressions

Which rex expression extracts a value into a field named user?

  1. rex "(?<user>\w+)" Correct answer.
  2. rex "(<user>\w+)"
  3. rex "(?P<user>\w+)"
  4. rex "($user\w+)"

Explanation

Named capture groups in Splunk regular expressions use the syntax (?<name>pattern). The group name is placed in angle brackets immediately after a question mark.

Question 45Fields, Field Extraction, and Regular Expressions

Which command renames the field clientip to src_ip?

  1. eval src_ip=clientip
  2. rename clientip AS src_ip Correct answer.
  3. rename src_ip=clientip
  4. fields clientip AS src_ip

Explanation

The rename command uses the syntax rename <old> AS <new>. It changes the field name without recalculating values.

Question 46Fields, Field Extraction, and Regular Expressions

A field created with the rex command during a search is available:

  1. only to members of the admin role
  2. only after the search is saved as a report
  3. only within that search's results Correct answer.
  4. to all users after the search completes

Explanation

Fields created by rex exist only in the results of the current search. To make an extraction persistent, you must define it in configuration or save it as part of a knowledge object.

Question 47Fields, Field Extraction, and Regular Expressions

Which command creates a new field by calculating a value from existing fields?

  1. sort
  2. table
  3. eval Correct answer.
  4. dedup

Explanation

The eval command calculates values and adds a new field to each result. It is the standard command for creating calculated fields.

Question 48Fields, Field Extraction, and Regular Expressions

When no field argument is given, the rex command applies its pattern to which field?

  1. _raw Correct answer.
  2. host
  3. _time
  4. sourcetype

Explanation

rex searches the _raw field by default. Use the field argument to apply the pattern to a different field.

Question 49Fields, Field Extraction, and Regular Expressions

An event contains user=alice;role=admin;dept=ops. Which command extracts these pairs using a semicolon between pairs and an equals sign between each key and value?

  1. extract pairdelim="=" kvdelim=";"
  2. rex pairdelim=";" kvdelim="="
  3. extract pairdelim=";" kvdelim="=" Correct answer.
  4. extract kvdelim=";" delim="="

Explanation

The extract command uses pairdelim for the delimiter between key-value pairs and kvdelim for the delimiter between a key and its value. Here pairs are separated by semicolons and keys from values by equals signs.

Question 50Fields, Field Extraction, and Regular Expressions

Which statement describes the fieldformat command?

  1. It changes the underlying value of a field for later commands.
  2. It changes how a field value is displayed without changing the value used by subsequent commands. Correct answer.
  3. It renames a field and removes the original field.
  4. It permanently extracts a new field at index time.

Explanation

fieldformat changes only the display representation of a value; subsequent commands still see the original value. Use eval when the calculated value itself must change.