Splunk SPLK-1002 - Core Certified Power User - Advanced SPL Knowledge Objects CIM Data Models Pivot

The `tstats` command queries accelerated data models and has specific syntax: `| tstats [stat_function] FROM datamodel=<name> [WHERE <conditions>] [BY <fields>]`. All field references must use the full `datamodel.dataset.field` notation (e.g., `All_Traffic.src_ip`). Option B correctly uses lowercase `from` and `where` with proper `All_Traffic.action` field notation and `by All_Traffic.src_ip` grouping. Option A uses `nodename=` which is not valid syntax (would be `where nodename=All_Traffic`). Option C places `tstats` after a regular search pipe (incorrect — `tstats` is a generating command that starts pipelines). Option D uses `stats` instead of `tstats`.

`streamstats` is a powerful command that calculates running (streaming) statistics for each event in sequence, respecting time order and grouping. For brute force detection: `index=auth | streamstats count(eval(action="failure")) as fail_count by user reset_on_change=false | where action="success" AND fail_count >= 10` — this maintains a running failure count per user and when a success event occurs with ≥10 prior failures, it flags the brute force. `streamstats` is event-ordered and can look back over time windows. `eventstats` adds aggregate statistics to each event without grouping events together. `appendcols` adds columns from a separate search. `inputlookup` reads from a lookup file.

Post-Process Searches allow multiple dashboard panels to share a single base search. The base search runs once and its results are cached. Each panel then applies a lightweight post-process search (typically transforming commands like `stats`, `chart`, `timechart`) against the cached base results without re-querying the index. This significantly reduces search load when multiple panels need different views of the same underlying data. Configuration in Splunk XML dashboards: define a `<search id="base_search">` and then reference it in panels with `<searchPostProcess>`. Option A creates scheduled report caches but doesn't share live search results across panels. Option D is not a real Splunk feature.

Splunk Search Macros allow creation of reusable SPL snippets that can accept arguments. Syntax: (1) Name the macro with argument count in parentheses: `percentile_calc(1)`, (2) Define the macro body using `$argument_name$` syntax: `perc95($field$)`, (3) Call the macro in searches using backticks: `` | stats `percentile_calc(response_ms)` by endpoint ``. The `(1)` indicates the macro accepts one argument. Arguments are referenced as `$1$` (positional) or named. Macros are expanded in-place before the search executes. Saved searches store complete searches, not reusable components. This is a key Power User capability.

Splunk's default keyword search in the initial search clause matches against event keywords extracted from `_raw`. For specific field searching, use `field=value` syntax. For wildcard field-value searches, use `field=*pattern*` (e.g., `url=*suspicious*`). The `| search` command in a pipeline can filter using `field=value`, wildcards, AND/OR operators. There is no command that simultaneously searches "all fields" for a value — you must specify the field or use keyword search against `_raw`. `fieldsummary` provides statistics about fields (cardinality, coverage) but doesn't search field values. The key point is understanding the distinction between searching `_raw` vs. specific extracted fields.