FirstTry

Objective 2.5

Core Certified User

Use the timeline

Objective 2.5 sits in Basic Searching, which carries 22% of the Core Certified User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.

Objective title verbatim from the official objectives. Splunk exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-5Basic Searching

An analyst drags a selection across the timeline to look at one busy hour. Does Splunk run a new search when they do that?

Yes, but only over one indexThe set of indexes was fixed when the original search ran.
Yes, it reruns the same searchRerunning would send fresh work to the indexers and take as long as the first search did.
No, it filters existing resultsCorrect · your answerCorrect.
No, it exports the selectionExport writes results to a file and is reached from the Export control.

Correct.

Checked against help.splunk.com, August 2026

Concept

The timeline is drawn from results the platform already holds. Narrowing to a spike is a question about that set rather than a new request to the indexers, which is why it comes back at once.

Why C

Splunk states in a note that when you use the timeline to investigate events you are not running a new search, you are filtering the existing search results.

Source

Note: When you use the timeline to investigate events, you are not running a new search. You are filtering the existing search results.

Splunk Docs: Use the timeline to investigate events, checked August 2026
#timeline#filtering

Now you: objective 2.5 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-5Basic Searching

A user hovers over one bar of the timeline and then clicks it. What does the click do?

Sample question 2 of 3

2-5Basic Searching

A user sees 1 hour per column in the top right corner of the timeline. What does that legend tell them?

Sample question 3 of 3

2-5Basic Searching

An analyst keeps zooming into a burst of events on the timeline. What is the smallest time unit Splunk lets them reach?

Full Core Certified User question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Basic Searching