Skip to main content

SPLK-1001 Real Exam Questions

Splunk Core Certified User

244 questions available · Page 1 of 25

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Single choice

When is an alert triggered?

  1. A

    When Splunk encounters a syntax error in a search

  2. B

    When a trigger action meets the predefined conditions

  3. C

    When an event in a search matches up with a data model

  4. D

    When results of a search meet a specifically defined condition

Show answer and explanation

Correct answer: D

Question 2 Single choice

When looking at a dashboard panel that is based on a report, which of the following is true?

  1. A

    You can modify the search string in the panel, and you can change and configure the visualization.

  2. B

    You can modify the search string in the panel, but you cannot change and configure the visualization.

  3. C

    You cannot modify the search string in the panel, but you can change and configure the visualization.

  4. D

    You cannot modify the search string in the panel, and you cannot change and configure the visualization.

Show answer and explanation

Correct answer: C

Explanation

When looking at a dashboard panel that is based on a report, you cannot modify the search string in the panel, but you can change and configure the visualization. This is because the dashboard panel inherits the search string from the report, and any changes to the search string will affect the report as well.
However, you can customize the visualization settings for the dashboard panel without affecting the report.
References:
Splunk Core User Certification Exam Study Guide, page 37.

Question 3 Single choice

When using the top command in the following search, which of the following will be true about the results?

index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f
countfield=status_code_count

  1. A

    The search will fail. The proper top command format is top limit=3 instead of top 3.

  2. B

    The top three most common values in statusCode will be displayed for each user.

  3. C

    Only the top three overall most common values in statusCode will be displayed.

  4. D

    The percentage field will be displayed in the results.

Show answer and explanation

Correct answer: B

Explanation

The top command returns the most common values of a field and their count. By using the by clause, you can group the results by another field. In this case, the top command will return the top three most common values in statusCode for each user. The showperc=f option will suppress the percentage column in the output. The countfield option will rename the count column to status_code_count2.

Question 4 Single choice

Which command will rename action to Customer Action?

  1. A

    | rename action = CustomerAction

  2. B

    | rename Action as "Customer Action"

  3. C

    | rename Action to "Customer Action"

  4. D

    | rename action as "Customer Action"

Show answer and explanation

Correct answer: D

Explanation

References:
https://answers.splunk.com/answers/610038/understanding-command-in-search.html

Question 5 Single choice

This is what Splunk uses to categorize the data that is being indexed.

  1. A

    Host

  2. B

    Sourcetype

  3. C

    Index

  4. D

    Source

Show answer and explanation

Correct answer: B

Question 6 Single choice

Put query into separate lines where | (Pipes) are used by selecting following options.

  1. A

    CTRL + Enter

  2. B

    Shift + Enter

  3. C

    Space + Enter

  4. D

    ALT + Enter

Show answer and explanation

Correct answer: B

Question 7 Single choice

How are events displayed after a search is executed?

  1. A

    In chronological order.

  2. B

    Randomly by default.

  3. C

    In reverse chronological order.

  4. D

    Alphabetically according to field name.

Show answer and explanation

Correct answer: C

Question 8 Single choice

Which of the following can be used as wildcard search in Splunk?

  1. A

    =

  2. B

    >

  3. C

    !

  4. D

    *

Show answer and explanation

Correct answer: D

Question 9 Single choice

What are the three main Splunk components?

  1. A

    Search head, GPU, streamer

  2. B

    Search head, indexer, forwarder

  3. C

    Search head, SQL database, forwarder

  4. D

    Search head, SSD, heavy weight agent

Show answer and explanation

Correct answer: B

Explanation

References:
https://www.edureka.co/blog/splunk-architecture/

Question 10 Single choice

Which search matches the events containing the terms "error" and "fail"?

  1. A

    index=security Error Fail

  2. B

    index=security error OR fail

  3. C

    index=security "error failure"

  4. D

    index=security NOT error NOT fail

Show answer and explanation

Correct answer: A

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Search