SPLK-1004: Splunk Core Certified Advanced Power User

The default Splunk 'power' role is granted capabilities to edit all shared knowledge objects — including saved searches and alerts — and to configure alert actions such as logging an event when an alert fires, whereas the default 'user' role is restricted to creating, running, and editing only the searches and objects that user owns. The 'can_delete' role exists solely to grant the delete-by-keyword capability used with the search command and carries no alerting capabilities. Because configuring the Log Event alert action requires the broader alert-editing capability that Splunk assigns by default to the power role (and by inheritance to admin), power is the role specifically intended to have this permission.

Report acceleration applies to reports based on qualifying transforming searches. Commands preceding the first transforming command must be streamable, and Splunk creates the acceleration summary only when the hot bucket covered by the summary range contains at least 100,000 events. The search command is streamable, so a search followed by a transforming command meets these requirements.

In Splunk, a macro that expands to a generating command must be invoked with a leading pipe character. Generating commands must start the search pipeline, so the pipe is placed before the macro reference rather than in the macro definition.

Splunk’s typeof function returns a string representation of a value’s type. Its documented example returns Number, String, Bool, and Invalid, so Number, String, and Bool are valid results.

The edit_alerts capability authorizes a user to create and manage alert definitions and their actions. The TCP and UDP capabilities apply to network inputs, and edit_search_server applies to search-server configuration rather than alert creation.