A security analyst is investigating authentication logs where the username field sometimes contains uppercase letters and sometimes lowercase. The analyst needs to group events by username, treating 'Admin' and 'admin' as the same user, and also wants to display the original username as it appeared in the log. Which search correctly accomplishes this?

... | eval normalized_user = lower(username) | stats count by normalized_user, username

... | stats count by username | eval normalized_user = lower(username)

... | eval normalized_user = upper(username) | stats count by normalized_user

... | eval normalized_user = replace(username, "[A-Z]", "[a-z]") | stats count by normalized_user

SplunkCore Certified Advanced Power User

Domain 1Objective 2

String and Conditional Functions core-certified-advanced-power-user Practice Questions (Page 1)

Part of the Advanced Search Commands domain, which makes up ~19% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

5concepts

Questions 1–5

1application · medium
A security analyst is investigating authentication logs where the username field sometimes contains uppercase letters and sometimes lowercase. The analyst needs to group events by username, treating 'Admin' and 'admin' as the same user, and also wants to display the original username as it appeared in the log. Which search correctly accomplishes this?
Select an answer first
2foundation · easy
Which Splunk conversion function converts a string value into a numeric value so that arithmetic operations can be performed on it?
Select an answer first
3foundation · easy
Which comparison function evaluates a condition and returns one value if true and another value if false?
Select an answer first
4foundation · easy
Which text function would you use to convert all characters in a string field to lowercase for case-insensitive comparisons?
Select an answer first
5foundation · easy
Which text function extracts a portion of a string based on a starting position and length?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to core-certified-advanced-power-user

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “core-certified-advanced-power-user” is a trademark of its owner, used for identification only.

String and Conditional Functions core-certified-advanced-power-user Practice Questions (Page 1)

Questions 1–5

Which Splunk conversion function converts a string value into a numeric value so that arithmetic operations can be performed on it?

Which comparison function evaluates a condition and returns one value if true and another value if false?

Which text function would you use to convert all characters in a string field to lowercase for case-insensitive comparisons?

Which text function extracts a portion of a string based on a starting position and length?

Keep studying — Advanced Search Commands