Splunk SPLK-1001 Online Practice Questions and Exam Preparation

Splunk SPLK-1001 Online Questions & Answers

• Question 1:

  When displaying results of a search, which of the following is true about line charts?

  A. Line charts are optimal for single and multiple series.
  B. Line charts are optimal for single series when using Fast mode.
  C. Line charts are optimal for multiple series with 3 or more columns.
  D. Line charts are optimal for multiseries searches with at least 2 or more columns.
  C. Line charts are optimal for multiple series with 3 or more columns.

• Question 2:

  When writing searches in Splunk, which of the following is true about Booleans?

  A. They must be lowercase.
  B. They must be uppercase.
  C. They must be in quotations.
  D. They must be in parentheses.
  B. They must be uppercase.

• Question 3:

  What is Splunk?

  A. Splunk is a software platform to search, analyze and visualize the machine-generated data.
  B. Database management tool.
  C. Security Information and Event Management (SIEM).
  D. Cloud based application that help in analyzing logs.
  A. Splunk is a software platform to search, analyze and visualize the machine-generated data.

• Question 4:

  Which of the following is the appropriately formatted SPL search?

  A. index=security sourcetype=linux secure (invalid OR failed) | stats count as "Potential Issues"
  B. index=security sourcetype=linux secure (invalid OR failed) | stats as "Potential Issues"
  C. index--security sourcetype=linux secure (invalid OR failed) | count stats as "Potential Issues"
  D. index--security sourcetype=linux secure (invalid OR failed) | count as "Potential Issues"
  A. index=security sourcetype=linux secure (invalid OR failed) | stats count as "Potential Issues"

  ---

  explanation:

  Explanation/Reference:

  This is the appropriately formatted SPL search because it follows the SPL syntax rules12, such as:

  Using the = operator to specify field-value pairs, such as index=security and sourcetype=linux.

  Using the OR operator to combine multiple values for the same field, such as (invalid OR failed).

  Using the | character to separate commands, such as stats count as "Potential Issues".

  Using the as keyword to rename fields, such as count as "Potential Issues".

• Question 5:

  Which stats command function provides a count of how many unique values exist for a given field in the result set?

  A. dc(field)
  B. count(field)
  C. count-by(field)
  D. distinct-count(field)
  A. dc(field)

• Question 6:

  Search Assistant is enabled by default in the SPL editor with compact settings.

  A. No
  B. Yes
  B. Yes

• Question 7:

  Which Boolean operator is always implied between two search terms, unless otherwise specified?

  A. OR
  B. NOT
  C. AND
  D. XOR
  C. AND

• Question 8:

  What syntax is used to link key/value pairs in search strings?

  A. Parentheses
  B. @ or # symbols
  C. Quotation marks
  D. Relational operators such as =,
  D. Relational operators such as =,

• Question 9:

  This clause is used to group the output of a stats command by a specific name.

  A. Rex
  B. As
  C. List
  D. By
  D. By

• Question 10:

  When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

  A. Cloned panel
  B. Inline panel
  C. Report panel
  D. Prebuilt panel
  C. Report panel