• 65 questions

Splunk Power User Practice Test

Questions for the Splunk Core Certified Power User exam, each answer linked to the Splunk documentation page behind it.

In the Select Fields step you highlight a value and must name the field. Which name is accepted?

Pick an answer, then press Check answer. Then you see Correct or Not quite, with the reason. Keys: A to D pick, Enter checks.

Print covers the next 65 questions. Share this set copies a link to the same questions in the same order.

Exam mode: 65 questions, 60 minutes.

More options

Unofficial practice questions, not affiliated with Splunk. Bank checked October 9, 2026.

Next step Another IT certification? Pick it

All 65 questions

Transforming commands for visualizations 3

  • A search ends with | chart count OVER host BY status. What does each column after the first one hold? Search Reference, chart, Using row-split and column-split fields
  • A timechart command carries both bins=50 and span=1h. Which one decides the size of the time buckets? Search Reference, timechart, bins and span arguments
  • | timechart count BY host limit=5 runs over events from eight hosts. With the other options left at their defaults, what happens to the three lowest-scoring hosts? Search Reference, timechart, limit

Filtering and formatting results 7

  • A results table has empty cells in several columns. What does | fillnull with no arguments do? Search Reference, fillnull, Optional arguments
  • An eval expression must read the field named server-1. How is the field name written so the hyphen is not read as a minus sign? Search Reference, eval, Usage
  • Every event already has a field named status. What does | eval status="checked" do? Search Reference, eval, Description
  • In one eval command you want to set kb first and then use kb to set mb. How are the two expressions written? Search Reference, eval, Description
  • Which where command keeps the events whose host value starts with web? Search Reference, where, Using a wildcard with the where command
  • With no parentheses, how does the search command group the terms in error OR warn AND host=web1? Search Reference, search, Boolean expressions
  • You need only the events in which the field src_ip holds the same value as the field dest_ip. Which search does that? Search Reference, where, Usage
Show all 65 questions (55 more)

Correlating events 10

  • A search ends with | transaction host. One result has no host value at all. Can it join a transaction whose other results have host=db01? Search Manual, Identify and group events into transactions, Transaction search options
  • A user's events run for 25 minutes and the search is | transaction user maxspan=10m. What happens to the events past the limit? Search Reference, transaction, maxspan
  • Each session has its own unique ID, and you only need the length of each session. Which command does the manual say is usually the better choice? Search Manual, About transactions, Using stats instead of transaction
  • The first event of a transaction is stamped 10:00:05 and the last 10:00:47. Three more events sit between them. What is the value of duration? Search Manual, About transactions, Transaction search example
  • In | transaction clientip maxspan=10m maxpause=30s, what does maxpause=30s limit? Search Reference, transaction, maxpause
  • Order numbers are reused, but every order's last event holds the text SHIPPED. Which search keeps each order apart? Search Manual, About transactions, Using stats instead of transaction
  • Which two fields does the transaction command add to the events it groups? Search Reference, transaction, Description
  • Why does | where duration>60 have to come after the transaction command and not before it? Search Manual, About transactions, Transaction search example
  • With no maxevents argument, what is the largest number of events one transaction can hold? Search Reference, transaction, maxevents
  • You run transaction with keepevicted=true. Which field value marks a transaction that was evicted and never closed? Search Reference, transaction, keepevicted

Creating and managing fields 6

  • A regular-expression extraction pulls a few wrong values. In which step do you hand those values back as counterexamples? Knowledge Manager Manual, Field Extractor: Select Fields step
  • At the Rename Fields step you pick Pipe as the delimiter. What does the field extractor call the fields it finds before you rename any? Knowledge Manager Manual, Field Extractor: Rename Fields step
  • Commas separate the values in your events, but the second value is a user name in some events and an action in others. What does the manual advise? Knowledge Manager Manual, Field Extractor: Select Method step
  • In the Select Fields step you highlight a value and must name the field. Which name is accepted? Knowledge Manager Manual, Field Extractor: Select Fields step
  • You expand an event in the search results and choose Event Actions, then Extract Fields. At which step does the field extractor open? Knowledge Manager Manual, Build field extractions with the field extractor, Access the field extractor from a specific event
  • Your events come from a .csv file: every value sits in the same position and commas separate the values. Which field extractor method fits? Knowledge Manager Manual, Field Extractor: Select Method step

Field aliases and calculated fields 7

  • A calculated field is named bytes, and an extracted field named bytes already exists. Which value does a search show? Knowledge Manager Manual, About calculated fields, Preventing overrides of existing fields
  • dst is an alias of src and Overwrite field values is selected. An event holds dst but no src. What does the search head do? Knowledge Manager Manual, Create field aliases in Splunk Web, Preserve existing field values
  • One props.conf stanza holds EVAL-kb = kb * 3 and EVAL-total = kb * 3. An event arrives with kb=5. What are kb and total at search time? Knowledge Manager Manual, About calculated fields, Calculated fields independence
  • Which of these can the eval expression of a calculated field reference? Knowledge Manager Manual, About calculated fields, Restrictions
  • Which of these does the manual allow for field aliases? Knowledge Manager Manual, Create field aliases in Splunk Web
  • Why can you not create a field alias for a calculated field? Knowledge Manager Manual, Create field aliases in Splunk Web, Where field aliases fit in the search-time sequence of operations
  • You give the field uid the alias user. What happens to uid? Knowledge Manager Manual, Create field aliases in Splunk Web

Tags and event types 6

  • An event matches event type A (Priority 2, Color Purple) and event type B (Priority 6, Color Orange). Which color does the event show? Knowledge Manager Manual, About event type priorities, Priority determines which event type color displays for an event
  • One event matches the event types web_error and payment_error. What does its eventtype field hold? Knowledge Manager Manual, About event types, How event types work
  • The tag core is attached to values of both the host field and the site field. Which search returns only the events tagged core through host? Knowledge Manager Manual, Tag field-value pairs in Search, Search for tagged field values
  • What does a tag attach to? Knowledge Manager Manual, About tags and aliases, Tags
  • Which search can be saved as an event type? Knowledge Manager Manual, About event types, Important event type definition restrictions
  • Why can the search string that defines an event type not reference a tag? Knowledge Manager Manual, About event types, Restrictions

Macros 7

  • A macro has an argument named limit. How does the argument appear inside the macro Definition? Knowledge Manager Manual, Define search macros in Settings, Design a search macro definition
  • A macro named latest_by_host should run tstats as the first command of a search. Where does the leading pipe go? Knowledge Manager Manual, Define search macros in Settings, Pipe characters and generating commands in macro definitions
  • A macro's Validation expression is isnum($rate$). When does the person running the search see the Validation error message? Knowledge Manager Manual, Define search macros in Settings, Validate search macro arguments
  • A search macro is named web_errors. How is it written inside a search? Knowledge Manager Manual, Use search macros in searches, Insert search macros into search strings
  • On Windows or Linux, which keyboard shortcut in the Search bar shows a search with all of its macros expanded, without running it? Knowledge Manager Manual, Use search macros in searches, Preview search macros in search strings
  • What does Splunk do with the macro reference in the search term "app`env`log"? Knowledge Manager Manual, Use search macros in searches, Insert search macros into search strings
  • You define a macro called ratecalc that takes two arguments. What do you enter as its Name? Knowledge Manager Manual, Define search macros in Settings, Steps

Workflow actions 6

  • A POST workflow action must send a field value to an outside issue tracker. How is each item it sends defined? Knowledge Manager Manual, Set up a POST workflow action
  • A Search workflow action is saved with Earliest time and Latest time left blank. Over what time range does its search run? Knowledge Manager Manual, Set up a search workflow action
  • A workflow action is saved with Apply only to the following fields left blank. In which field menus does it appear? Knowledge Manager Manual, Set up a GET workflow action, Define a GET workflow action
  • The field link holds a complete web address, and a GET workflow action should open it as it stands. What stops Splunk from escaping the value? Knowledge Manager Manual, Set up a GET workflow action, Use the $! prefix to prevent escape of URL or HTTP form field values
  • In the URI of a GET workflow action, how do you place the value of the field domain? Knowledge Manager Manual, Set up a GET workflow action, Define a GET workflow action
  • Which kind of workflow action builds an HTML link that passes a field value to an outside site, such as a WHOIS lookup? Knowledge Manager Manual, About workflow actions in Splunk Web, Define workflow actions using Splunk Web

Data models 7

  • A field is marked Required for a dataset. What does that do? Knowledge Manager Manual, About data models, Fields can be required or optional for a dataset
  • A root event dataset has the constraint index=web. Its child dataset adds status=500. Which events does the child represent? Knowledge Manager Manual, About data models, Dataset constraints
  • How do data models relate to Pivot? Knowledge Manager Manual, About data models
  • To which datasets can you add a new auto-extracted field? Knowledge Manager Manual, About data models, Dataset field types
  • Which dataset field type adds latitude, longitude, country and city to events that hold a valid IP address? Knowledge Manager Manual, About data models, Dataset field types
  • Which three kinds of dataset can sit at the top level of a data model as root datasets? Knowledge Manager Manual, About data models, Datasets
  • You open a new, empty data model and want its first dataset to be a root transaction dataset. Why does that not work? Knowledge Manager Manual, About data models, Root datasets and data model dataset types

Common Information Model (CIM) Add-On 6

  • A data model expects vendor and product fields, but neither value appears anywhere in your events. What does the manual tell you to use? Common Information Model Add-on Manual, Use the CIM to normalize data at search time, 5. Make your fields CIM-compliant
  • A new source logs users signing in and out of an application. Which CIM data model do those events map to? Common Information Model Add-on Manual, Use the CIM to normalize data at search time, 2. Examine your data in the context of the CIM
  • At which point is data made to conform to the CIM? Common Information Model Add-on Manual, Use the CIM to normalize data at search time, 1. Get your data in
  • How do the tags a CIM data model expects get onto your events? Common Information Model Add-on Manual, Use the CIM to normalize data at search time, 3. Configure CIM-compliant event tags
  • In what form does Splunk ship the Common Information Model? Common Information Model Add-on Manual, Overview of the Splunk Common Information Model
  • Your events carry the field http_referer, and the CIM Web data model expects http_referrer. Which knowledge object maps one name to the other? Common Information Model Add-on Manual, Use the CIM to normalize data at search time, 5. Make your fields CIM-compliant

How this list was compiled: Own questions, written to the ten sections and weights of the test blueprint that Splunk publishes for the Splunk Core Certified Power User exam at https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-power-user.pdf, linked from the certification page https://www.splunk.com/en_us/training/certification-track/splunk-core-certified-power-user.html (both read 2026-10-09). Facts were read on 2026-10-09 in Splunk's public documentation: the Search Reference, the Search Manual and the Knowledge Manager Manual for Splunk Enterprise 10.6 at help.splunk.com, and the Common Information Model Add-on Manual at docs.splunk.com. Each question names the manual page and section it was written from and links to it. Licence: Own work. Every question, wrong choice, search string and explanation was written for this site from the public documentation named in each question. Nothing is copied or reworded from a Splunk exam, a sample or released question, a course quiz or another practice product.

How it works

An unofficial Splunk Power User practice test: 65 of our own questions, sorted by the ten sections of Splunk's blueprint for the Splunk Core Certified Power User exam. This site is not affiliated with Splunk, and nothing here is taken from the real exam.

Read the full guide

What the Power User exam asks

Splunk's test blueprint, read on October 9, 2026, weights ten sections: transforming commands for visualizations 5%, correlating events 15%, and 10% each for filtering and formatting results, creating and managing fields, field aliases and calculated fields, tags and event types, macros, workflow actions, data models, and the Common Information Model add-on.

Which Splunk version, and what is left out

Every answer rests on a page of Splunk's public documentation for Splunk Enterprise 10.6 or of the CIM add-on manual. A default or a menu name can differ in another version. The sparkline options, the Pivot Editor's screens and data model acceleration are not asked.

  • The search command evaluates OR before AND. The eval and where commands evaluate AND before OR, so the same line can group two ways.
  • transaction adds duration and eventcount. When one unique ID marks each group, the Search Manual says stats usually performs better.
  • Field aliases are applied before calculated fields, lookups, event types and tags, so none of those four can be given an alias.

Questions and answers

How many questions are on the Splunk Core Certified Power User exam?

65 multiple choice questions, by Splunk's certification page. The blueprint allows 60 minutes, 3 of them for reviewing the exam agreement. Exam mode here sets all 65 of our questions against a 60-minute clock.

What is the passing score for the Splunk Power User exam?

Neither Splunk's certification page nor its blueprint gives one. A result on this page shows your percent right in each blueprint section and no pass or fail.

Does the Splunk Power User exam have prerequisites?

Splunk's certification page lists none and calls the exam entry level. The blueprint says this certification has no prerequisite exam.

Is this Splunk Power User practice test free?

Yes. Every question, every explanation with its documentation link and the timed exam mode are free, with no sign-up.

More tests

Show 7 more

Browse Safety and Trades