Objective 3.1
Core Certified UserUnderstand fields
Objective 3.1 sits in Using Fields in Searches, which carries 20% of the Core Certified User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
You look at an indexed event and find user_name=fred sitting inside the raw text. What form does a field take in event data?
Correct.
Checked against help.splunk.com, August 2026Concept
Machine data has no schema of its own, so the platform imposes one by naming pieces of each event. A named piece with a value is what a search can compare against, and everything built on top depends on that pairing.
Why C
Splunk describes fields as appearing in event data as searchable name-value pairings such as user_name=fred or ip_address=192.168.1.1, and calls them the building blocks of searches, reports and data models.
Source
Splunk Docs: About fields, checked August 2026Fields appear in event data as searchable name-value pairings such as user_name=fred or ip_address=192.168.1.1. Fields are the building blocks of Splunk searches, reports, and data models. When you run a search on your event data, Splunk software looks for fields in that data.
Now you: objective 3.1 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An analyst runs status=404 rather than searching for 404 on its own. What does Splunk say the field search does not return?
Sample question 2 of 3
A brand new sourcetype arrives on your deployment with no configuration behind it, yet three fields sit on every event. Which set is extracted at index time?
Sample question 3 of 3
A field you never configured appears in the sidebar after a search, while host and sourcetype were on the event already. When does field extraction happen?
Full Core Certified User question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.