Objective 3.2
Core Certified UserUse fields in searches
Objective 3.2 sits in Using Fields in Searches, which carries 20% of the Core Certified User exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A user is writing their first field search. What syntax does Splunk give for searching a field?
Correct.
Checked against help.splunk.com, August 2026Concept
The comparison a field search makes is equality between a name and a value, and the syntax says so directly. Getting this shape into muscle memory is what separates searching the whole event text from searching one attribute of it.
Why A
Splunk states that when you search for fields you use the syntax field_name = field_value, and adds that field names are case sensitive while field values are not.
Source
Splunk Docs: Use fields to search, checked August 2026When you search for fields, you use the syntax field_name = field_value . Field names are case sensitive, but field values are not. You can use wildcards in field values. Quotation marks are required when the field values include spaces.
Now you: objective 3.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An analyst searches sourcetype=ACCESS_COMBINED and gets nothing, then tries the lower case value and it works. What does Splunk say about case?
Sample question 2 of 3
A user needs to match a field value that contains spaces. What does Splunk require in that search?
Sample question 3 of 3
An analyst wants only web access log events and runs sourcetype=access_* on the tutorial data. What does that search retrieve?
Full Core Certified User question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.