Splunk Core Certified Power User Study Guide¶

Independent AI-assisted resource — SOURCES + OBJECTIVES CHECKED; HUMAN REVIEW PENDING. The October 29, 2026 review opened the current official credential page and three-page blueprint, mapped all 32 objectives, and checked selected command and knowledge-object references. Direct source review is complete for the published outline; the accepted snapshot remains unchanged. All eight Splunk labs remain unexecuted because no runtime or approved endpoint was available. The checks here are original learning prompts, not exam items. Recheck the official certification page and test blueprint before scheduling.

Study guide at a glance

Start here

Report an issue with SPLUNK-CORE-POWER-USER

Blueprint checked2026-10-29

Review stateSources + objectives checked — human review pending

Guide-only active reading30 min–45 min

Prerequisites: No prerequisite exam. Build classic SPL, correlation and knowledge-object skills across32mapped objectives. Paperexamples clarify nulls,Booleanprecedence,aliases and calculatedfields; all8runtime/UI/CIMlabs remain unexecuted. Currentcourseavailability,unavailableUI/CIMsources andhumanreview pending.

Exam essentialsRead the objective map, key distinctions, and readiness checklist.

Deep understandingWork through every domain, including decisions, failure modes, and related items.

Hands-on labsBegin with Lab evidence and next-pass fixes, then use the remaining labs to produce evidence you can inspect and explain.

Official objective domains

See the objective map in this guide

The active-reading range uses 90–130 words per minute for technical material. Labs, troubleshooting, note-taking, spaced review, and prerequisite gaps add time; it is not a total preparation promise.

Current baseline: Transforming Commands for Visualizations (5%); Filtering and Formatting Results (10%); Correlating Events (15%); Creating and Managing Fields (10%); Field Aliases and Calculated Fields (10%); Tags and Event Types (10%); Macros (10%); Workflow Actions (10%); Data Models (10%); Common Information Model Add-On (10%). Related topics may appear and the blueprint may change without notice.
Exam contract — VERIFY CURRENT: entry level; 65 multiple-choice questions; 60 total minutes including three minutes for the exam agreement; USD 130 per attempt; Pearson VUE delivery. Splunk's overview routes candidate management through Cisco's Certification Tracking System.
Credential lifecycle — VERIFY CURRENT: The 2026 certification-change FAQ says coursework-based recertification ended March 1, 2026 and lists same-exam renewal in the final year or a higher-level exam in the same track. The certification overview still mentions coursework, so official pages conflict; confirm your actual path in the current tracking system. The published cycle remains three years per the current FAQ. No account was inspected.
Prerequisite contract: no prerequisite exam. Core User is a useful foundation, but it is not required by the published contract.
Upcoming change — checked October 29, 2026: Current credential page and blueprint show no retirement or replacement notice; the 2026 program FAQ identifies three other Legacy credentials and does not list Core Power User. This bounded check does not establish absence across every release channel. The blueprint tests established SPL and knowledge objects. SPL2 is adjacent context with a different syntax contract.

How to use this guide¶

Work in a Splunk-provided lab, a trial, or an approved nonproduction environment. Use representative synthetic data with at least two sourcetypes so normalization has real meaning. Build each object privately first, test its search-time dependencies, then share it only after reviewing app context and permissions.

For every objective, preserve four artifacts:

the input events and expected fields;
the SPL or knowledge-object definition;
matched, unmatched, null, duplicate, and boundary evidence;
a short explanation of search-time order, scope, permissions, and downstream effect.

About related items: A Related item: callout adds architecture, governance, performance, security, or adjacent product context. It makes the objective more useful in practice but does not imply that the extra phrase appears verbatim in the public blueprint.

Blueprint map¶

Domain	Weight	Evidence to produce
Transforming Commands for Visualizations	5%	Correct chart and timechart result shapes
Filtering and Formatting Results	10%	Typed eval fields and equivalent/different search/where filters with null handling
Correlating Events	15%	Transaction definition and a justified stats alternative
Creating and Managing Fields	10%	Tested regex- and delimiter-based Field Extractor definitions
Field Aliases and Calculated Fields	10%	Non-destructive normalization plus calculated search-time fields
Tags and Event Types	10%	Reusable categorization whose searches and dependencies are valid
Macros	10%	Basic and argumented macros with validated expansion and safe permissions
Workflow Actions	10%	Lab-only GET, POST, and Search actions with field substitution controls
Data Models	10%	Dataset hierarchy and Pivot evidence with correct constraints/fields
Common Information Model Add-On	10%	Two-source normalization to published CIM tags/fields plus validation

1. Transforming commands for visualizations — 5%¶

chart aggregates values over categorical dimensions. One split-by field commonly becomes series/columns and another the x-axis categories; verify the produced table before selecting a visual. timechart aggregates into _time buckets and expects time-aware events. Use span deliberately and understand that time range and bucket width change both readability and aggregation.

index=web earliest=-24h
| chart count over status by host

index=web earliest=-24h
| timechart span=30m count by status

High-cardinality split fields can create many series and an “OTHER” grouping depending on command options. Missing/null split values may disappear or group unexpectedly. Do not infer absence of activity from a chart until inspecting the underlying table, time zone, series limits, and search completeness.

Related item: Visualization is downstream of aggregation. Labels, units, axes, truncation, time zones, and category limits can mislead even when the SPL is syntactically correct.

2. Filtering and formatting results — 10%¶

eval creates or changes fields using expressions and functions. Know arithmetic, string concatenation, conditional if/case, conversion, comparison, and null-aware functions at a practical level. Splunk values can be strings, numbers, Booleans within evaluation, and multivalue fields; verify type assumptions rather than trusting appearance.

search uses search syntax and is convenient for matching field values and Boolean terms. where evaluates an expression and supports field-to-field comparisons and functions. Both filter pipeline results, but quoting, nulls, and expression semantics differ.

... | eval latency_s=duration_ms/1000
    | where latency_s > threshold_s
    | fillnull value="unknown" owner

The fillnull reference 10.4 distinguishes explicit field lists from filling all fields. Its argument description and example 3 say an explicitly named missing field is created. Its all-fields examples show that a field containing only null() is not filled, even after an eval or table mentions it. Do not teach “create it with eval” as a universal fix: assigning another null does not supply a real value. Test both forms in your deployment; no SPL execution is claimed here. Do not replace unknown with zero unless zero is semantically correct.

The predicate reference 10.4 documents different precedence: search evaluates OR before AND; where and eval evaluate AND before OR. Use parentheses when translating an expression. For tier="prod" AND status=500 OR urgent=1, an urgent nonproduction event is excluded by the first grouping, but included by the second. This is a logical prediction under the stated values, not an observed engine result.

3. Correlating events — 15%¶

A transaction groups related events into one result, usually by shared field values and optionally time/start/end constraints. Understand maxspan, maxpause, startswith, endswith, ordering, eventcount, duration, and multivalue output conceptually. Test overlapping identifiers, missing boundaries, reuse of IDs, out-of-order/late events, and incomplete sessions.

index=auth earliest=-4h
| transaction session_id startswith="login_start" endswith="logout" maxspan=2h
| table session_id eventcount duration closed_txn

transaction can be memory-intensive and retains raw event relationships. stats is usually preferable when grouping and aggregate fields answer the question:

index=auth earliest=-4h
| stats earliest(_time) AS first latest(_time) AS last count AS eventcount values(action) AS actions by session_id
| eval duration=last-first

Choose transaction when event ordering/boundaries and combined raw-event context are essential; choose stats for scalable grouping/aggregation. A similar row does not prove identical semantics—document handling of incomplete groups, multivalue order, and boundaries.

The transaction reference 10.4 requires descending chronological input for maxspan and maxpause. Check order again after upstream transformations. closed_txn reflects transaction closure/eviction rules; it is not proof of a successful business session. Preserve incomplete and evicted cases in your investigation plan. Runtime memory limits and output were not tested here.

Original paper counterexample: Suppose one identifier is reused for sessions at 09:00–09:02 and 09:10–09:12. Grouping all four events only by that identifier yields a 12-minute first-to-last span, although the two intended sessions total four minutes. Those are different questions. Identify an appropriate session key or boundary policy before claiming that a stats rewrite is equivalent to transaction; neither output has been executed in this review.

4. Creating and managing fields — 10%¶

The Field Extractor (FX) creates search-time extractions from returned events. Regex mode suits irregular/unstructured text: select representative samples, highlight values, inspect the generated named-capture expression, and test positive/negative cases. Delimiter mode suits consistent structured rows with headers and a common delimiter.

Define the source type/host/source/app scope carefully. Use meaningful field names and avoid collision with established fields. Representative testing must include missing columns, quoted delimiters, alternate messages, malformed rows, and values at beginning/end. Permissions determine who receives the extraction.

The generated extraction is a starting point, not proof. Greedy expressions can capture too much; a delimiter extraction can fail when quoting/escaping changes. Build field extractions with the Field Extractor is the current UI reference.

Related item: Prefer a supported technology add-on and correct sourcetype before building local duplicate extractions. Parallel field definitions create schema drift and search-time cost.

5. Field aliases and calculated fields — 10%¶

A field alias gives an existing extracted field an additional name. It does not rename or remove the original. This supports normalization when different sources use src_ip, client_ip, or another vendor name for the same concept. It cannot depend on a field created later in search-time processing.

Preserving the original field does not guarantee preserving the alias destination. The selected props.conf 10.4.3 FIELDALIAS contract distinguishes AS from ASNEW: AS can replace an existing destination, and removes that destination when the source has no value; ASNEW preserves an existing destination. Test both source-missing and destination-present cases. Avoid mapping two fields onto one alias within the same scope; an explicit calculated expression can state the desired precedence.

A calculated field uses an eval expression automatically at search time for a selected source/host/sourcetype. Use it for a stable derived value such as normalized units or a category. Handle nulls/types and avoid expensive/opaque expressions applied to broad datasets.

Calculated fields in one stanza are evaluated independently, rather than as sequential pipeline steps. In an original hypothetical event with raw_ms=2400, defining EVAL-seconds=raw_ms/1000 and EVAL-minutes=seconds/60 does not make the second definition consume the first definition's new value. Derive both from the available input, or use deliberate sequential pipeline commands. The calculated-fields reference 10.4 also excludes dependencies on later lookups, event types and tags. No configuration was installed or executed.

Search-time order matters: automatic key-value extraction precedes field aliases; aliases precede calculated fields; lookups, event types, and tags have later dependencies. The current tags and aliases documentation documents these boundaries.

6. Tags and event types — 10%¶

A tag labels a field-value pair (including an event type) so searches can group equivalent meanings. Search with tag=name or tag-qualified forms as appropriate. Tags are search-time knowledge and depend on the field/value existing first. Use governed names and avoid massive tagging where lookups are a better scale mechanism.

An event type is a named search that classifies matching events, supporting tags, reports, dashboards, and other reuse. Give it a selective, valid base search; event-type definitions have search restrictions and cannot depend on tags that are applied later. Assign priority and permissions deliberately. Test both matching and near-miss events.

Related item: Tags categorize values; event types categorize events through a search; aliases normalize field names. Choosing the wrong object can make dependencies circular or maintenance unnecessarily broad.

7. Macros — 10%¶

A search macro is reusable SPL text invoked with backticks. A basic macro can standardize a source constraint or expression. Argumented macros substitute named variables such as $field$ ; the macro name includes its argument count in management context.

`recent_errors(web,24h)`

Inspect the expanded search to debug. Validate arguments when possible, quote according to intended type, and never assume a macro argument is safe merely because it came from another dashboard/search. Recursive/circular expansion and hidden broad searches are operational risks. App context and permissions affect resolution.

Use macros for stable reusable fragments, not to hide incomprehensible searches. Document arguments, expected fields, output, owner, and compatibility.

8. Workflow actions — 10%¶

Workflow actions turn a field/event into a contextual next step:

GET opens or requests a URL with values in a query string.
POST sends values in a request body.
Search launches another Splunk search populated with selected field values.

Define label, scope, required fields/event types, destination/search, app context, and visibility. Field-token substitution requires encoding and validation. GET leaks values into URLs/history/logs; POST is not automatically secure; both require HTTPS, destination trust, authorization, anti-forgery behavior, and data-minimization review. Use a lab endpoint—never trigger a real ticket, containment, or business action while practicing.

A Search workflow action should preserve quoting, time context, index access, and least privilege. Test missing fields and hostile/special characters.

9. Data models — 10%¶

A data model organizes one or more datasets (historically called objects in some interfaces/material) into a hierarchy with constraints and fields/attributes. Root datasets can be based on events, searches, or transactions; child datasets inherit and narrow parent constraints. Fields can be auto-extracted, inherited, calculated, or lookup-derived depending on model design.

Pivot uses data models so users can create tables/charts without writing all SPL directly. A model only exposes what its constraints and fields define. Create a small model, set app/permissions, add a child, test counts against equivalent SPL, and build a Pivot. Data model acceleration is important later-track context; do not enable it casually without retention/capacity/governance decisions.

See Design data models.

10. Common Information Model Add-On — 10%¶

Splunk CIM is a shared semantic model delivered as an add-on with preconfigured data models, documentation, validation tooling, and common field/tag expectations. It normalizes equivalent events from different vendors at search time while leaving raw data unchanged. Apps such as Enterprise Security depend on correctly normalized fields and tags.

Normalization usually combines technology-add-on extractions, field aliases, calculated fields, lookups, event types, and tags. Do not map based only on similar names: confirm the data model/dataset constraint, required/recommended fields, data type, allowed meaning, tag requirements, units, and null behavior. Validate two different sources through the same CIM-based search/Pivot.

The live CIM overview describes the shared-model purpose; version-specific release notes should be checked before implementation. CIM is unrelated to the DMTF CIM.

Related item: The OCSF CIM add-on is a newer compatibility layer for OCSF-formatted security events. It does not erase the blueprint requirement to understand the established Splunk CIM and its data-model contract.

Integrated scenarios¶

Scenario 1: Cross-source authentication model¶

Extract fields from delimited and unstructured authentication sources, alias vendor fields to common names, calculate outcome/duration, create success/failure event types and tags, then map both sources to the appropriate CIM dataset. Validate raw, normalized, model, and Pivot counts.

Scenario 2: Session correlation decision¶

Build transaction and stats versions of a session search. Add incomplete, overlapping, reused-ID, and delayed events; compare output semantics and resource evidence. Produce chart/timechart visualizations and justify the selected implementation.

Scenario 3: Governed analyst workflow¶

Create an argumented macro for a bounded base search, a Search workflow action to pivot on a user, and lab-only GET/POST actions to an echo endpoint. Test expansion, escaping, missing values, app permissions, data disclosure, and auditability.

Hands-on labs¶

Chart/timechart matrix: vary split fields, nulls, category limits, span, time range, and time zone; validate every graph against its table.
Eval/filter/null workbook: build typed derived fields and compare search versus where across strings, numbers, nulls, multivalue fields, and field-to-field comparisons.
Correlation comparison: implement transaction and stats against complete/incomplete/overlapping sessions; record correctness, schema, ordering, and resource behavior.
Field Extractor validation: create regex and delimiter extractions from representative samples; test malformed/near-miss cases and inspect generated definitions/scope.
Search-time object chain: create aliases, calculated fields, event types, and tags with a documented dependency order; prove each object on two sources.
Macro safety: create no-argument and argumented macros, inspect expansion, test quotes/special characters, and verify app/permission resolution.
Workflow action lab: create GET, POST, and Search actions against nonproduction targets; test token encoding, missing fields, sensitive values, and authorization assumptions.
Data model/CIM project: build a dataset hierarchy and Pivot, then normalize two vendor-shaped sources to one CIM dataset and validate equivalent counts/fields.

Lab evidence and next-pass fixes¶

All eight proposed labs remain unexecuted in this September 30 review. No Splunk runtime or approved endpoint was available. The numeric and logical examples above are paper predictions. Source review does not establish that a saved knowledge object, macro, workflow action, Pivot or CIM mapping works in a deployment.

Labs	Evidence a reproduction should retain
1–3: charts, filters and correlation	Product/build, synthetic rows, exact SPL/time range, result table, null cases and incomplete/reused sessions
4–5: extraction and object dependencies	Generated definition, scope, negative cases, alias collision policy and observed operation order
6–7: macros and workflow actions	Expanded search, argument cases, permissions and a nonproduction destination; distinguish definition from execution
8: data models and CIM	Installed CIM version, selected dataset, constraints, fields/tags/units, and raw/model/Pivot count comparisons

More research needed — next pass: refresh unavailable UI/CIM pages, reproduce explicit-field versus all-field null handling, execute all eight labs and verify current training offerings. Report failures with the exact version, input and expected/observed output. No workflow action was sent, and no course, protected exam material or authenticated account was accessed. Independent human content/accessibility review remains pending.

Original readiness checks¶

When should chart be preferred to timechart?
What must timechart have to create time buckets?
Why inspect the result table before choosing a visualization?
What does eval produce?
When is where more natural than search?
Why might fillnull fail to expose an all-null field?
What does transaction produce?
Name two transaction time/boundary controls.
When is stats normally preferable to transaction?
Why can stats and transaction rows that look alike still differ semantically?
When should the FX regex method be used?
When should delimiter extraction be used?
What must an extraction test set contain?
Does a field alias delete the original field?
What creates a calculated field?
Why does search-time operation order matter?
What does a tag label?
What does an event type classify?
Why cannot an event type safely depend on a later-applied tag?
When is a lookup better than thousands of tags?
How is a macro invoked?
What should an argumented macro document?
Why inspect macro expansion?
Which workflow action puts values in a URL?
Why is POST not inherently safe?
What should a Search workflow action preserve?
What does app context affect for knowledge objects?
What is a data model?
What does a child dataset inherit?
How does Pivot use a data model?
Why compare Pivot counts with SPL?
What does CIM normalize?
Does CIM rewrite raw indexed data?
Which knowledge-object types can contribute to normalization?
Why is matching a field name insufficient for CIM compliance?
What is the largest weighted domain?
How many questions and minutes are published?
Is Core User a prerequisite exam?
What newer language is related but not a substitute for this blueprint's SPL?
What must be rechecked before purchase?

Answer key¶

For category-based rather than time-bucketed aggregation.
_time-aware results and a chosen time range/bucketing policy.
The graph inherits omissions, limits, null handling, and shape from the table.
Derived or modified fields on result rows.
For evaluated expressions, functions, and field-to-field comparisons.
The all-fields form may not recognize a field that is null everywhere. The explicit field-list form is documented to create named absent fields. An eval assigning only null() is not a general remedy; reproduce both forms.
One grouped result with combined event context and metadata such as duration/event count.
Any two of maxspan, maxpause, startswith, and endswith.
When scalable grouping/aggregates answer the question without raw-event transaction semantics.
Incomplete groups, ordering, multivalue representation, and boundaries can differ. The reused-identifier worksheet gives a 12-minute group span versus four minutes across two intended sessions; similarity of columns does not establish equivalent grouping.
For unstructured text with a stable pattern.
For consistently delimited structured records.
Representative positives plus missing, malformed, alternate, and near-miss negatives.
No; it adds another searchable name. The destination can nevertheless be overwritten with AS; ASNEW preserves an existing destination. Test collisions and missing sources.
An automatically applied eval expression for the selected source scope.
An object cannot reliably depend on a field/tag produced later. Calculated fields in one stanza also cannot be chained by assuming one receives another's freshly computed value.
A field-value pair or event type.
Events matching a named search definition.
Tags are processed after event types, creating an invalid dependency direction.
For large or frequently governed/reference-driven classifications.
With its name/arguments inside backticks.
Argument types/quoting, required fields, expansion, result schema, owner, scope, and errors.
To debug and detect unsafe, broad, or incorrect substituted SPL.
GET.
It still requires TLS, trusted destination, authorization, request-integrity, and data review.
Correct quoting, time context, index constraints, app, and permissions.
Visibility, resolution, ownership, and sharing.
A hierarchy of constrained datasets and fields representing a domain.
Parent constraints and fields, then narrows/adds its own definition.
It supplies curated datasets/fields for table/chart construction.
To validate that model constraints and fields represent the intended events.
Equivalent semantic fields/tags across different source formats/vendors.
No; it is principally search-time schema.
Extractions, aliases, calculated fields, lookups, event types, tags, and data models.
Dataset constraints, tags, meaning, type, units, and required fields must also match.
Correlating Events at 15%.
65 questions and 60 total minutes including the agreement.
No; there are no prerequisite exams.
SPL2.
Current page/blueprint, price, duration, delivery, identity, retake, and renewal policies.

Final readiness checklist¶

Places to learn¶

October 29, 2026 source update¶

The current PDF still has 65 multiple-choice questions and ten weighted domains, with no objective-map change found. Splunk's program overview now points to Cisco's Certification Tracking System; Pearson VUE remains the delivery partner on the exam page. The 2026 change FAQ does not list Core Power User among the credentials made Legacy, but retires coursework recertification from March 1, 2026. The general overview still describes coursework, creating a live official-source conflict; check the tracking system before acting. Add the current 2026 Power User track PDF, which organizes Working with Time, Statistical Processing, Comparing Values, Result Modification, Correlation Analysis, Knowledge Objects, Field Extractions and Data Models. The free-course catalog has selected related courses, but access and lab entitlement vary by course; no interior was accessed. Current Splunk Enterprise 10.4 release notes, Search Manual 10.4, and fillnull reference support versioned product study, not claims of local execution.

This is not a complete list, and it is not meant to be consumed in full. Pick one primary path, use product/CIM documentation to resolve exact behavior, and spend at least as much time creating and testing knowledge objects as watching. Commercial resources are supplementary; reconcile them with the current blueprint and product/CIM versions.

Hour ranges are author planning budgets, not measured completion times. The linked course sheet is from 2024; the earlier September 30 parsed reading supports its historical course list, not current access or prices. This pass's Pluralsight search response was a page shell with an unrendered template, and YouTube returned only a short shell. No specific course or video was reviewed. O'Reilly and Udemy searches were blocked. Lantern's parsed landing text matched the earlier reading, but its linked articles were not reviewed. Existing 10.4 UI and CIM reference bodies were unavailable for a fresh reading; retain their version labels and verify against the installed product.

Resource	Access	Estimated time	Best use
Official Power User blueprint	Free canonical scope	1–2 hr mapping/final review	Weights and objective contract
Official Power User page	Free	20–40 min before booking	Current status, price, delivery, policies
Official platform curated-learning map	Mixed free/paid; 2024 duration sheet, verify live catalog	About 25–35 hr across named blueprint courses, depending on paid Correlation/Knowledge modules	Working with Time, Statistical Processing, Comparing Values, Result Modification, Correlation, Knowledge Objects, Extractions, Data Models
Splunk Knowledge Management Manual 10.4	Free current product docs	12–20 hr selected topics plus lab work	Authoritative object behavior and search-time order
Splunk CIM documentation	Free; choose version compatible with your deployment	6–12 hr for overview, one data model, normalization, validation	Actual schema rather than memorized field lists
Splunk Search Manual 10.4	Free	8–12 hr correlation/transforming/optimization topics	SPL foundations and command choice
Splunk How-To YouTube channel	Free official videos; UI/catalog varies	4–8 hr selected videos plus recreation	Visual object-creation walkthroughs
Splunk Lantern	Free official/community-reviewed use cases	6–10 hr selected search/CIM patterns	Applied examples after fundamentals
Pluralsight Splunk learning search	Subscription; catalog changes and may not align by exam	Select 8–15 hr after matching each course to blueprint	Alternate explanations, not blueprint authority
O'Reilly Splunk search	Subscription; many books/courses use older UI/product releases	Select 8–15 hr, then verify every object in current docs	Deeper SPL/knowledge-management context
Udemy Power User search	Paid marketplace; offerings change	Select 8–15 hr only after verifying update date, blueprint, labs, and provenance	Optional alternate path

No exact current MeasureUp or Whizlabs Power User practice product was verified. Reject live/recalled/guaranteed-pass questions; use the public blueprint, official docs, and hands-on behavior as truth.