FirstTry

Objective 2.1

Core Certified User

Run basic searches

Objective 2.1 sits in Basic Searching, which carries 22% of the Core Certified User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.

Objective title verbatim from the official objectives. Splunk exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-1Basic Searching

An analyst types two keywords into the search bar with no operator between them. How does Splunk treat the pair of keywords?

As the first AND the secondCorrect · your answerCorrect.
As the first OR the secondOR would widen the result set. You get that only by typing the operator yourself.
As one exact phrase to matchPhrase matching needs quotation marks around the words.
As a prefix for wildcardsA wildcard search needs an asterisk, as in fail*.

Correct.

Checked against help.splunk.com, August 2026

Concept

A search bar with several bare words has to resolve to one Boolean expression before anything runs. Splunk picks the narrower reading, so extra words shrink a result set rather than widening it.

Why A

Splunk documents the AND operator as implied when you type multiple keywords, so both terms have to be present in an event for it to come back.

Source

To retrieve events that mention errors or failures, you type the keywords in your search criteria. If you use multiple keywords, you must specify Boolean operators such as AND, OR, and NOT. The AND operator is implied when you type in multiple keywords.

Splunk Docs: Basic searches and search results, checked August 2026
#boolean-operators#search-basics

Now you: objective 2.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-1Basic Searching

A user types the first few letters of a term into the Search bar and a list appears underneath. What is that list drawn from?

Sample question 2 of 3

2-1Basic Searching

An analyst wants to rerun a search from last week and worries that signing out on Friday threw it away. What becomes of your search history?

Sample question 3 of 3

2-1Basic Searching

You type failed password into the search bar and get events back from three sourcetypes. What are those search terms matched against?

Full Core Certified User question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Basic Searching