FirstTry

Objective 2.1

Core Certified User

Run basic searches

Objective 2.1 sits in Basic Searching, which carries 22% of the Core Certified User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.

Objective title verbatim from the official objectives. Splunk exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-1Basic Searching

An analyst types two keywords into the search bar with no operator between them. How does Splunk treat the pair of keywords?

As one exact phrase to matchPhrase matching needs quotation marks around the words.
As the first OR the secondOR would widen the result set. You get that only by typing the operator yourself.
As the first AND the secondCorrect · your answerCorrect.
As a prefix for wildcardsA wildcard search needs an asterisk, as in fail*.

Correct.

Checked against help.splunk.com, August 2026

Concept

A search bar with several bare words has to resolve to one Boolean expression before anything runs. Splunk picks the narrower reading, so extra words shrink a result set rather than widening it.

Why C

Splunk documents the AND operator as implied when you type multiple keywords, so both terms have to be present in an event for it to come back.

Source

To retrieve events that mention errors or failures, you type the keywords in your search criteria. If you use multiple keywords, you must specify Boolean operators such as AND, OR, and NOT. The AND operator is implied when you type in multiple keywords.

Splunk Docs: Basic searches and search results, checked August 2026
#boolean-operators#search-basics

Now you: objective 2.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-1Basic Searching

A user types the first few letters of a term into the Search bar and a list appears underneath. What is that list drawn from?

Sample question 2 of 3

2-1Basic Searching

An analyst wants to rerun a search they ran last week and asks whether logging out has lost it. What does Splunk say about search history?

Sample question 3 of 3

2-1Basic Searching

A user asks what a search term is actually compared against when a search runs. What does Splunk say search terms are matched against?

Full Core Certified User question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Basic Searching