Splunk Power User study guide
Splunk Power User · Work through your exam, one topic at a time.
The Splunk Certified Power User credential - often referred to as the Splunk Core Certified Power User - is a practitioner-level certification for people who already know how to run a basic search in Splunk and want to demonstrate that they can do real work with it. It sits above entry-level search knowledge and below the administrative and architect tracks, and it is aimed at SOC analysts, IT operations engineers, application support staff, developers, and business analysts whose daily work involves interrogating machine data. The Splunk Power User study guide has 5 sections and about 1,742 words.
01Basic Searching and Search Under the Hood
When you run a search, the search head parses your string into search terms, dispatches to indexers, and each indexer scans time-ordered buckets using bloom filters and the tsidx term dictionary to find candidate events before any command runs. Because most fields are extracted at search time , only default fields exist when the search begins: host , source , sourcetype , index , time , raw , linecount , punct , and splunk server .
387 words, about 2 min02Fields, Field Extraction, and Regular Expressions
Default fields are always present. Extracted fields appear at search time from props.conf rules for the sourcetype, from automatic lookups, or from commands like rex .
342 words, about 2 min03Transforming Commands, Reports, and Dashboards
Transforming commands turn a stream of events into a results table. The workhorses are stats , chart , timechart , top , rare , and contingency .
328 words, about 2 min04Knowledge Objects: Tags, Event Types, Lookups, and Workflow Actions
Knowledge objects are reusable configurations stored in an app context with private or shared (app/global) permissions. If another user cannot see your tag or lookup, permissions are almost always the answer.
351 words, about 2 min05Data Models, Pivot, and Acceleration
A data model is a structured, hierarchical description of your data: a root event (constraints such as index and sourcetype), child objects, and fields that can be extracted, eval -based, lookup-based, or regex-based. Inspect one with datamodel Web Web search (returns the generated SPL) or datamodel Web Web flat (returns field names).
334 words, about 2 min