Objective 3.2
Core Certified Power UserGroup events using fields
Objective 3.2 sits in Correlating Events, which carries 15% of the Core Certified Power User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An analyst runs the transaction command with a field list. Which two fields does Splunk say it adds to the events?
Correct.
Checked against help.splunk.com, August 2026Concept
Grouping produces two facts nobody had before: how long the group lasted and how many lines it took. Both are computed by the command, so neither can be filtered on before it runs.
Why A
Splunk states that the transaction command adds two fields to the raw events, duration and eventcount, where duration is the difference between the first and last timestamps and eventcount is the number of events in the transaction.
Source
Splunk Docs: transaction command, checked August 2026Additionally, the transaction command adds two fields to the raw events, duration and eventcount . The values in the duration field show the difference between the timestamps for the first and last events in the transaction. The values in the eventcount field show the number of events in the transaction.
Now you: objective 3.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A user wants to group web events by session and client address together. What does giving the transaction command two field names do?
Sample question 2 of 3
A team asks what the transactiontype field on a grouped result holds. What does Splunk say?
Sample question 3 of 3
An analyst asks what a transaction returned at search time consists of. What does Splunk list?
Full Core Certified Power User question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.