Objective 3.5
Core Certified Power UserReport on transactions
Objective 3.5 sits in Correlating Events, which carries 15% of the Core Certified Power User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An analyst wants to report on how long grouped activity took. Which field does Splunk say carries that figure?
Correct.
Checked against help.splunk.com, August 2026Concept
Once a group exists, the question is usually how long it lasted rather than what it contained. The command computes that once so a report can chart it without any further arithmetic.
Why D
Splunk states that duration contains the duration of the transaction, the difference between the timestamps of the first and last events of the transaction.
Source
Splunk Docs: Identify and group events into transactions, checked August 2026duration contains the duration of the transaction (the difference between the timestamps of the first and last events of the transaction).
Now you: objective 3.5 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 2
A team wants only completed transactions in a report. Which field does Splunk say distinguishes evicted ones?
Sample question 2 of 2
An analyst sets no constraints at all on a transaction command. What does Splunk say happens to closed_txn on the output?
Full Core Certified Power User question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.