It's no longer as simple as it used to be.  Gone are the days when one or two courses prepared you for an exam.  Now, it may take several courses to get the same material, but all of them are optional until you get to the Admin level. You can find what material will be covered on the Power User exam at https://www.splunk.com/en_us/pdfs/training/splunk-core-certified-power-user-track.pdf and https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-power-user.pdf then decide which courses you need to fill gaps in your knowledge.  See the courses available by certification level at https://www.splunk.com/en_us/training/course-catalog.html?sort=Newest&filters=filterGroup2SplunkCoreCertifiedPowerUser ... View more

I think you'll find you'll get more help from these forums if you show you've made some effort to solve the problem before posting.  Tell what query you've tried and how it didn't meet expectations. SQL users new to SPL should see Splunk's SPL for SQL Users manual at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk IMO, any requirement that calls for "all available log sources" hasn't been thought through enough.  It's a rare use case that needs every source; most will need specific sources. We need to know more about the "report that shows Changes to System Sec Config events".  Splunk tracks its own config changes in the _configtracker index, but that information does not include user info.  If you refer to configs for other systems then please identify those systems.  Of course, those systems must be reporting info to Splunk. The first step to creating a report is to create a search for the data that goes into that report.  Once that is producing the desired results, click on the "Save as" menu and select Report.  That is where you select the report format and schedule it. The expiration time of a search/report must be set manually from the Jobs dashboard (Activity->Jobs).  IIRC, the maximum TTL is seven days.  The 30-day expiration date is too long and may use up the users' disk quota. You can use the IN operator in the search command to filter message IDs and users.  SQL patterns are available using the like function within where and eval commands.  Use the table command to select fields for display and the stats command to group results. index=foo VendorMsgID IN (4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4736, 4737, 4740, 4754, 4755, 4756, 4757, 4758, 4759, 4783, 4784, 4785, 4786, 4787, 4788, 4789, 4791, 631) AND NOT User IN (xxx, system, xxx, xxxx, xxxxx) AND User_Impacted != (res group name) | where NOT (match(Host_Impacted, "%sc%") OR match(Host_Impacted, "%sd%") OR match(Host_Impacted, "^sc.+") OR match(Host_Impacted, "^sd.+")) | table User, _time, Event, Group, oHost, Host_Impacted, oLogin, VendorMsgID, Domain Impacted) | stats values(*) as * by User   ... View more

Yes, it's possible, but don't do that.  It tells Splunk to open every bucket with data from the last seven days and read all of the events from that time.  It will be slow and wasteful of resources.  Use tstats, instead. ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

The License Manager can show license usage over time.  It can group the usage by index or sourcetype to help you find where the usage is coming from. Sudden spikes can be normal periodic increases, but often are caused by a new data source or existing source that changed verbosity (turned on DEBUG logging, for instance). ... View more

The first query I gave you should have worked, but the logic you just suggested should work, too.  This query marks servers from the index as "indexed" and those from the lookup file as "lookup".  After combining the results by server name, it keeps only the servers found in the index. index=abc host=def_inven | eval inven="indexed" | append [ | inputlookup mylookup.csv | eval inven="lookup" ] | stats values(*) as * by server | where (mvcount(inven)=1 AND isnotnull(mvfind(inven,"indexed")))   ... View more

Curly braces on the LHS of an eval says to use the contents of the field as the new field name. See if this example query helps explain | makeresults | eval base="file_watch" | eval {base}= base.".exe" | eval {base}exe=base.".exe"   ... View more

This is the point where you show the search(es) you ran, their results, and tell how those results miss expectations.  Does the lookup file contain data that can be used to search the index?  If not, can it be modified or can the search modify a lookup field into something that's in the index? ... View more

Use a subsearch to exclude the lookup file from the index results. index=abc host=def_inven NOT [ | inputlookup something | fields <a field from the lookup that identifies a server> | rename <field> as <some field name in Dataset A> ] ... View more

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it. https://www.duanewaddle.com/proving-a-negative/ ... View more

That message appears when a query uses a token that has no value.  Check all tokens in the dashboard to make sure they are defined before the query executes.  Perhaps there is a spelling error somewhere. ... View more

Try using the concatenation operator to include the field from the first regex in the second. index=cs | rex "Type=(?<type>[a-z]+)" | rex field=AResponse.BResponse.Message mode=sed "s/Ref number+\w+\sfailed on num:*+/" . type . " failed on num: /g" ... View more

Does the account running Splunk have permission to delete the files?  Are there any messages in splunkd.log about the files? ... View more

Use the where command to filter out results with empty fields. | where isnotnull(user_agent) AND user_agent!="" ... View more

The datetime_udp.xml file doesn't exist on the indexer(s).  Double-check the add-on.  Consider re-installing it.  If it's still a problem, contact Splunk Cloud support or the add-on vendor. ... View more

You can have either SAML or LDAP authentication, but not both.  Splunk authentication is always available. To force Splunk authentication, go to http://<your Splunk URL>/en-us/account/login?loginType=Splunk.  The "en-us" part can be replaced with your own locale specifier. ... View more

Splunk requires a hierarchical file system.  You can, however, move your frozen data to an object store, if you wish. ... View more