Splunk Core Power User deep review — September 30, 2026

The guide maps 32 objectives in ten groups (2/3/6/2/2/3/4/4/3/3), reviews 40 original answers and documents all eight unexecuted labs. This is a best-effort public-source review with explicit follow-ups.

Confirmed scope and repairs

The complete indexed credential page and three-page blueprint retain 65 questions, 60 minutes including three agreement minutes, no prerequisite exams and the classic SPL/knowledge-object scope. The credential page lists USD 130/Pearson VUE. No account or booking was tested. Page-break artifacts in the parsed PDF are not extra objectives. The historical September 2 normalized snapshot remains unchanged because direct retrieval and the objective monitor failed DNS. Manual confirmation is recorded separately from a successful automated hash.

The fillnull 10.2 reference, substantive lines 500–678, distinguishes explicitly named fields from all-field filling. The guide now explains that difference and removes the blanket suggestion that assigning null with eval fixes an absent field. The predicate reference 10.4, lines 499–690, supports the search/where precedence distinction. An original urgent-event example demonstrates why parentheses matter.

Selected transaction 10.4 lines 500–699 support descending-time input and distinguish closure/eviction from business success. A reused-session identifier illustrates a 12-minute group span versus four minutes across two intended sessions. It is paper arithmetic, not an executed transaction/statistics comparison.

Selected props.conf 10.4.3 lines 1886–1983 clarify alias destination collisions and AS/ASNEW behavior. Selected calculated-fields 10.2 lines 499–565 explain independent expressions and later-operation restrictions. The guide adds a hypothetical unit-conversion dependency example. Other portions of those long references were not reviewed.

Learning evidence and execution limits

The earlier September 30 complete parsed reading of the 2024 curated course sheet remains dated evidence, not a new successful retrieval or current price/access guarantee. New parsed Lantern and YouTube responses exactly match the earlier Core User text; raw HTML hashes differ, and the evidence records parsed-text equality only. Lantern's linked articles were not reviewed. YouTube returned a 176-character shell. The full 3919-character Pluralsight response exposed navigation and an unrendered template, not actual Splunk courses. O'Reilly and Udemy searches were blocked. Guide hours are author planning budgets; no course/video/book completion is claimed.

There are 19 direct receipts:3 successful, 14 DNS errors and 2 blocked. DNS failure does not establish dead URLs. The existing UI/CIM reference bodies could not be freshly read. No Splunk runtime or approved endpoint was available; all eight labs remain unexecuted. The guide gives the product/version, input, query/configuration, expected/observed output and failure evidence needed for community reproductions. No software, service, account, workflow action, upload or configuration change was made.

More research is needed on runtime behavior, unavailable UI/CIM sources, current training, fresh objective retrieval and independent human content/accessibility review. Useful supported corrections are published with those limitations. Repository tests, strict build, repository/site/catalog consistency and whitespace results are recorded after the gates finish in ADLC_Docs/operations/2026-09-30-splunk-core-power-user-deep-review.json.