No matching guide sections
Change the search or section filter.
Study Guide preview
Unlock Pro for every Splunk Core Certified User flashcard-note lesson.
Preview the beginning of Section 1. Pro includes the complete Study Guide by section, plus Course Notes, guided course access, and Pro downloads.
Unlock with Pro
Opens the Splunk Core Certified User Practice Test purchase options.
Section 1
Splunk components
Preview
Preview: Splunk Basics (5%)
Preview includes- 2 of 2 lesson topics
- 1 overview segment
- 2 core concepts
- 2 exam tips
Lesson Topics
- Search head role in distributed search
- Forwarder role in data collection
Overview
Know the user-facing and data-moving roles of core Splunk Enterprise components well enough to choose the component from the job it performs.
Core Concepts
- A search head distributes searches to indexers (search peers) and consolidates their results.
- A universal forwarder collects and forwards data to remote indexers and normally does not index the data itself.
Exam Tips
- Key on the verbs in the scenario: search/merge -> search head; store/index -> indexer; lightweight send -> universal forwarder.
- Do not choose the component with the most features; choose the component whose documented role exactly matches the requirement.
Section 1 continues in Pro.Unlock Pro to read the full Splunk components lesson plus every remaining Splunk Core Certified User Study Guide section.
Unlock with Pro
Section 2
Understand the uses of Splunk
Pro
Understand the uses of Splunk unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 3
Define Splunk apps
Pro
Define Splunk apps unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 4
Customizing user settings
Pro
Customizing user settings unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 5
Basic navigation in Splunk
Pro
Basic navigation in Splunk unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 6
Run basic searches
Pro
Run basic searches unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 7
Set the time range of a search
Pro
Set the time range of a search unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 8
Identify the contents of search results
Pro
Identify the contents of search results unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 9
Refine searches
Pro
Refine searches unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 10
Use the timeline
Pro
Use the timeline unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 11
Work with events
Pro
Work with events unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 12
Control a search job
Pro
Control a search job unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 13
Save search results
Pro
Save search results unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 14
Understand fields
Pro
Understand fields unlocks with Pro.Unlock Pro to read the full 14 topics flashcard-note study guide for this section.
Unlock with Pro
Section 15
Use fields in searches
Pro
Use fields in searches unlocks with Pro.Unlock Pro to read the full 14 topics flashcard-note study guide for this section.
Unlock with Pro
Section 17
Review basic search commands and general search practices
Pro
Review basic search commands and general search practices unlocks with Pro.Unlock Pro to read the full 7 topics flashcard-note study guide for this section.
Unlock with Pro
Section 18
Examine the search pipeline
Pro
Examine the search pipeline unlocks with Pro.Unlock Pro to read the full 7 topics flashcard-note study guide for this section.
Unlock with Pro
Section 19
Specify indexes in searches
Pro
Specify indexes in searches unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 20
Use tables, rename, fields, dedup, and sort
Pro
Use tables, rename, fields, dedup, and sort unlocks with Pro.Unlock Pro to read the full 10 topics flashcard-note study guide for this section.
Unlock with Pro
Section 21
The top command
Pro
The top command unlocks with Pro.Unlock Pro to read the full 10 topics flashcard-note study guide for this section.
Unlock with Pro
Section 22
The rare command
Pro
The rare command unlocks with Pro.Unlock Pro to read the full 10 topics flashcard-note study guide for this section.
Unlock with Pro
Section 23
The stats command
Pro
The stats command unlocks with Pro.Unlock Pro to read the full 8 topics flashcard-note study guide for this section.
Unlock with Pro
Section 24
Save a search as a report
Pro
Save a search as a report unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 25
Edit reports
Pro
Edit reports unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 26
Create reports that display statistics (tables)
Pro
Create reports that display statistics (tables) unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 27
Create reports that display visualizations (charts)
Pro
Create reports that display visualizations (charts) unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 28
Create a dashboard
Pro
Create a dashboard unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 29
Add a report to a dashboard
Pro
Add a report to a dashboard unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 30
Edit a dashboard
Pro
Edit a dashboard unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 31
Describe lookups
Pro
Describe lookups unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 32
Examine a lookup file example
Pro
Examine a lookup file example unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 33
Create a lookup file and create a lookup definition
Pro
Create a lookup file and create a lookup definition unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 34
Configure an automatic lookup
Pro
Configure an automatic lookup unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 35
Use the lookup in searches
Pro
Use the lookup in searches unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 36
Describe scheduled reports
Pro
Describe scheduled reports unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 37
Configure scheduled reports
Pro
Configure scheduled reports unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 38
Describe alerts
Pro
Describe alerts unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 39
Create alerts
Pro
Create alerts unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro
Section 40
View fired alerts
Pro
View fired alerts unlocks with Pro.Unlock Pro to read the full 2 topics flashcard-note study guide for this section.
Unlock with Pro