Splunk Power User study plan

Diagram the three phases a search job passes through (search head parse/dispatch, indexer, search head merge) and state which phase each of five given commands executes in.

Run the same query in fast, smart, and verbose mode and record the differences in returned fields and runtime.

Rewrite five inefficient searches by tightening the time range, replacing leading wildcards, and adding indexed-field filters first.

Use the Job Inspector to read scanCount, runTime, and searchProviders for a slow search and name the dominant cost.

Build three subsearches and one OR-based alternative for the same result, then compare their runtimes.

Distinguish default, indexed, and custom fields by inspecting the same event with the fields command and the interesting-fields sidebar.

Use fieldsummary and the field picker to shortlist which fields are worth extracting from a new sourcetype.

Write rex expressions with named capture groups that extract three previously unextracted values from raw event text.

Validate each new extraction with erex and confirm the match rate across at least 100 events.

Explain the difference between search-time extraction via rex and knowledge-object field extractions, and pick the right one for a repeated need.

Construct at least ten regular expressions from scratch covering character classes, quantifiers, alternation, anchors, and non-capturing groups.

Use sed mode in rex to substitute values in place and explain when sed mode is preferable to a plain capture.

Handle multivalue fields with mvexpand, nomv, and mvcount in three searches that depend on splitting correctly.

Use coalesce to merge two sparse fields into one reliable field and demonstrate the fallback order with sample output.

Diagnose three broken regexes (greedy overreach, unescaped metacharacter, missing anchor) and state the minimal fix for each.

Convert five event-level searches into transforming pipelines that return only aggregated rows.

Use stats with multiple by-clauses and compare the output shape against eventstats and streamstats for the same data.

Build a timechart with a span that produces a readable number of columns and adjust it when the span is wrong.

Replace a slow wildcard filter with a field-extraction-plus-where filter and measure the runtime difference.

Assemble a dashboard with at least four panels drawn from your saved reports and confirm each panel loads independently.

Add a form input whose token filters every panel, and prove the token reaches each panel's search.

Use appendcols or append deliberately in one panel and justify why a join was not used.

Apply a chart overlay or split-by to one panel and verify the field ordering is correct.

Trim each panel's base search to the minimum fields and time range it needs.

Define two event types from saved searches and apply them so they appear in the event-type field on matching events.

Design a tag taxonomy of at least six tags and apply them to three field-value pairs, then search by tag to prove reuse.

Build a CSV lookup, upload it, and wire it as an automatic lookup that enriches events without an explicit lookup command.

Create two workflow actions, one GET and one POST, and pass a field token into the URI.

Document the permission and app context each new knowledge object lives in.

Build a data model with a root event dataset and at least two child datasets constrained by different filters.

Add a calculated field to the data model and confirm it is usable in Pivot without a rex at search time.

Turn on acceleration for the data model and verify the acceleration summary shows a completed backfill.

Build a Pivot with three split-by rows and one column split, then compare its result to the equivalent stats search.

Explain when acceleration is skipped and identify one constraint that would prevent it.

Take a timed 60-question practice exam spanning all five domains and score each domain separately.

Re-run every earlier deliverable without notes and repair anything that fails.

Rewrite your weakest ten missed questions as corrected flashcards with the reasoning, not just the answer.

Rebuild one dashboard panel and one data model from memory to confirm retention.