Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 1:

  Which Field/Value pair will return only events found in the index named security?

  A. Index=Security

  B. index=Security

  C. Index=security

  D. index!=Security

  Correct Answer: B

• Question 2:

  How can results from a specified static lookup file be displayed?

  A. lookup command

  B. inputlookup command

  C. Settings > Lookups > Input

  D. Settings > Lookups > Upload

  Correct Answer: B

• Question 3:

  In the Fields sidebar, what does the number directly to the right of the field name indicate?

  A. The value of the field

  B. The number of values for the field

  C. The number of unique values for the field

  D. The numeric non-unique values of the field

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchTutorial/Usefieldstosearch

• Question 4:

  What is the default lifetime of every Splunk search job?

  A. All search jobs are saved for 10 days

  B. All search jobs are saved for 10 hours

  C. All search jobs are saved for 10 weeks D. All search jobs are saved for 10 minutes

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Extendjoblifetimes

• Question 5:

  Which search will return the 15 least common field values for the dest_ip field?

  A. sourcetype=firewall | rare num=15 dest_ip

  B. sourcetype=firewall | rare last=15 dest_ip

  C. sourcetype=firewall | rare count=15 dest_ip

  D. sourcetype=firewall | rare limit=15 dest_ip

  Correct Answer: C

  Reference: https://answers.splunk.com/answers/41928/add-a-lookup-csv-colum-information-to-the-results-ofainputlookup-search.html

• Question 6:

  When is an alert triggered?

  A. When Splunk encounters a syntax error in a search

  B. When a trigger action meets the predefined conditions

  C. When an event in a search matches up with a data model

  D. When results of a search meet a specifically defined condition

  Correct Answer: D

  Reference: https://books.google.com.pk/books?id=sNwkBQAAQBAJandpg=PT525andlpg=PT525anddq=splunk+alert +triggered+When+results+of+a+search+meet+a+specifically+defined +conditionandsource=blandots=avtEx5luxoandsig=ACfU3U1ZVob_j9nU243Te2vhqwxI3YvJuAandhl=enandsa=X andved=2a hUKEwjm48rmkfXoAhUlMewKHb_FAbkQ6AEwB3oECBYQJg

• Question 7:

  What are the three main Splunk components?

  A. Search head, GPU, streamer

  B. Search head, indexer, forwarder

  C. Search head, SQL database, forwarder

  D. Search head, SSD, heavy weight agent

  Correct Answer: B

  Reference: https://www.edureka.co/blog/splunk-architecture/

• Question 8:

  Which statement describes field discovery at search time?

  A. Splunk automatically discovers only numeric fields

  B. Splunk automatically discovers only alphanumeric fields

  C. Splunk automatically discovers only manually configured fields

  D. Splunk automatically discovers only fields directly related to the search results

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Changethesearchmode

• Question 9:

  Which of the following is a metadata field assigned to every event in Splunk?

  A. host

  B. owner

  C. bytes

  D. action

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Assignmetadatatoeventsdynamically

• Question 10:

  What are the two most efficient search filters?

  A. _time and host

  B. _time and index

  C. host and sourcetype

  D. index and sourcetype

  Correct Answer: B