Splunk SPLK-1001 Online Practice Questions and Exam Preparation

Splunk SPLK-1001 Online Questions & Answers

• Question 1:

  Which of the following is a metadata field assigned to every event in Splunk?

  A. host
  B. owner
  C. bytes
  D. action
  A. host

  ---

  Explanation/Reference:

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Assignmetadatatoeventsdynami cally

• Question 2:

  Which of the following are Splunk premium enhanced solutions? (Choose three.)

  A. Splunk User Behavior Analytics (UBA)
  B. Splunk IT Service Intelligence (ITSI)
  C. Splunk Enterprise Security (ES)
  D. Splunk Analytics Security (AS)
  A. Splunk User Behavior Analytics (UBA)
  B. Splunk IT Service Intelligence (ITSI)
  C. Splunk Enterprise Security (ES)

• Question 3:

  _______________ transforms raw data into events and distributes the results into an index.

  A. Index
  B. Search Head
  C. Indexer
  D. Forwarder
  C. Indexer

• Question 4:

  In the fields sidebar, which character denotes alphanumeric field values?

  A. #
  B. %
  C. a
  D. a#
  B. %

• Question 5:

  Which of the following is true about user account settings and preferences?

  A. Search and Reporting is the only app that can be set as the default application.
  B. Full names can only be changed by accounts with a Power User or Admin role.
  C. Time zones are automatically updated based on the setting of the computer accessing Splunk.
  D. Full name, time zone, and default app can be defined by clicking the login name in the Splunk bar.
  D. Full name, time zone, and default app can be defined by clicking the login name in the Splunk bar.

• Question 6:

  How does Splunk determine which fields to extract from data?

  A. Splunk only extracts the most interesting data from the last 24 hours.
  B. Splunk only extracts fields users have manually specified in their data.
  C. Splunk automatically extracts any fields that generate interesting visualizations.
  D. Splunk automatically discovers many fields based on source type and key/value pairs found in the data.
  D. Splunk automatically discovers many fields based on source type and key/value pairs found in the data.

• Question 7:

  NOT status = 100:

  A. Will display result depending on the data.
  B. Will return event where status field exist but value of that field is not 100.
  C. Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.
  C. Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

• Question 8:

  Which of the following can be used as wildcard search in Splunk?

  A. =
  B. >
  C. !
  D. *
  D. *

• Question 9:

  What user interface component allows for time selection?

  A. Time summary
  B. Time range picker
  C. Search time picker
  D. Data source time statistics
  B. Time range picker

• Question 10:

  The better way of writing search query for index is:

  A. index=a index=b
  B. (index=a OR index=b)
  C. index=(a and b)
  D. index = a, b
  B. (index=a OR index=b)