Objective 2.2
Core Certified UserSet the time range of a search
Objective 2.2 sits in Basic Searching, which carries 22% of the Core Certified User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An engineer asks how event timestamps are held once data is indexed, whatever format the raw events used. What does Splunk store in the _time field?
Correct.
Checked against help.splunk.com, August 2026Concept
Events arrive with times written a dozen different ways. Converting all of them to one numeric standard at index time is what lets events from different systems be correlated and put on one timeline.
Why B
Splunk states that regardless of how time is specified in your events, timestamps are converted to UNIX time and stored in the _time field when your data is indexed.
Source
Splunk Docs: About searching with time, checked August 2026Regardless of how time is specified in your events, timestamps are converted to UNIX time and stored in the _time field when your data is indexed. If your data does not have timestamps, the time at which your data is indexed is used as the timestamp for your events.
Now you: objective 2.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A team ingests a data source whose events carry no timestamp of their own. What time does Splunk give those events?
Sample question 2 of 3
A user notices that a new search already has a time range applied before they change anything. Why does Splunk apply a default range?
Sample question 3 of 3
An analyst without administrator rights tries to run a real-time search and asks why the option is unavailable. What does Splunk require?
Full Core Certified User question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.