the fundamentals 1 is basic/first level training, so, i assume "we" need to find the answers ourselves.  i have done the fundamentals 1 around 3 yrs ago and certified as Splunk User and Power User.. last yr as they updated the certifications process, i have to redo my certifications and the fundamentals 1 i went thru the course(didnt do the labs actually). i wrote the exam and cleared it. if you have "some" knowledge of the fundamentals 1 course contents, you can clear the exam too.  the fundamentals 1 and the splunk search tutorial pdf are very similar.. i think you can find the answers/steps on the search tutorials document: https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchTutorial/WelcometotheSearchTutorial   ~ Happy Splunking ~ Karma points appreciated ! ~  ... View more