Splunk Core Certified User Course Notes

Know what Splunk does, which component performs each core role, how apps organize the user experience and knowledge objects, and where user preferences and navigation live. For this domain, distinguish platform function, app context, and role-based access.

• Choosing a deployment server when the scenario says 'distribute searches' or 'consolidate results.'

• Translate nouns into jobs: search head = search coordination, indexer = store/search data, forwarder = send data.

This is the heaviest domain. Be fluent with base-search Boolean behavior, field-value constraints, rolling versus snapped time ranges, search-result views, the timeline, event controls, job management, and export rules.

• Using `OR` when both terms are required.

• Read time words literally: 'previous 60 minutes' = rolling; 'since the start of the hour/day' = snapped boundary.

Fields are searchable name-value pairs extracted or calculated from events. Know how field presence, multivalue data, field-value predicates, the Fields sidebar, and field-manipulation commands affect what remains available downstream.

• Assuming a field must exist in every returned event.

• Ask three questions: Does the requirement change the event set, the field value, or only the presentation?

Understand how SPL flows through a pipeline and how the core commands in the blueprint affect data. Scope searches early, know Splunk search Boolean precedence, and predict what fields/results exist after each command.

• Thinking the pipe merges a subsearch rather than passing results sequentially.

• After every pipe, mentally ask: 'What rows and fields exist now?'

Master exactly what `top`, `rare`, and `stats` produce. These commands answer different statistical questions and transform event-level data into summarized result rows.

• Using `rare` for most-common values.

• Underline the question word: most = top; least = rare; aggregate/group = stats.

Know the lifecycle from a useful search to a saved report and then to a dashboard visualization. Focus on result structure, saved-object reuse, Dashboard Studio identifiers/layouts, editing, and permissions.

• Assuming every raw-event search can immediately drive every chart.

• Separate three layers: search result shape, saved report object, dashboard presentation.

Lookups enrich search results by matching an event field to external reference data. Know the difference between the lookup data, lookup definition, matching key, output fields, explicit `lookup` command, and automatic lookup configuration.

• Using the output columns as the matching key.

• Draw the join mentally: event key -> lookup key -> output columns.

Scheduled reports deliver saved-search results on a schedule; alerts evaluate search results against trigger conditions and can launch actions. Know scheduling, trigger conditions, throttling, actions, permissions, and how to review fired alerts.

• Calling every scheduled saved search an alert.

• Ask: 'Should something happen only when a condition is true?' If yes, think alert; if not, scheduled report.