Splunk SPLK-1001 Online Practice Questions and Exam Preparation

Splunk SPLK-1001 Online Questions & Answers

• Question 121:

  Which of the following constraints can be used with the top command?

  A. limit
  B. useperc
  C. addtotals
  D. fieldcount
  A. limit

• Question 122:

  What determines the scope of data that appears in a scheduled report?

  A. All data accessible to the User role will appear in the report.
  B. All data accessible to the owner of the report will appear in the report.
  C. All data accessible to all users will appear in the report until the next time the report is run.
  D. The owner of the report can configure permissions so that the report uses either the User role or the owner's profile at run time.
  D. The owner of the report can configure permissions so that the report uses either the User role or the owner's profile at run time.

• Question 123:

  What is a primary function of a scheduled report?

  A. Auto-detect changes in performance
  B. Auto-generated PDF reports of overall data trends
  C. Regularly scheduled archiving to keep disk space use low
  D. Triggering an alert in your Splunk instance when certain conditions are met
  D. Triggering an alert in your Splunk instance when certain conditions are met

• Question 124:

  You can use the following options to specify start and end time for the query range:

  A. earliest=
  B. latest=
  C. beginning=
  D. ending=
  E. All the above
  F. Only 3rd and 4th
  F. Only 3rd and 4th

• Question 125:

  What are the two most efficient search filters?

  A. _time and host
  B. _time and index
  C. host and sourcetype
  D. index and sourcetype
  B. _time and index

  ---

  Explanation/Reference:

  This is the correct answer because these two filters can help you limit the amount of data that Splunk retrieves from disk, which is the key to fast searching1. The _time filter allows you to specify a narrow time window for your search, which reduces the number of buckets that Splunk scans2. The index filter allows you to specify which index or indexes contain the data that you want to search, which reduces the number of files that Splunk reads3.

• Question 126:

  Zoom Out and Zoom to Selection re-executes the search.

  A. No
  B. Yes
  B. Yes

• Question 127:

  Machine data can be in structured and unstructured format.

  A. False
  B. True
  B. True

• Question 128:

  When is an alert triggered?

  A. When Splunk encounters a syntax error in a search
  B. When a trigger action meets the predefined conditions
  C. When an event in a search matches up with a data model
  D. When results of a search meet a specifically defined condition
  D. When results of a search meet a specifically defined condition

• Question 129:

  Prefix wildcards might cause performance issues.

  A. False
  B. True
  B. True

• Question 130:

  When viewing the results of a search, what is an Interesting Field?

  A. A field that appears in any event
  B. A field that appears in every event
  C. A field that appears in the top 10 events
  D. A field that appears in at least 20% of the events
  D. A field that appears in at least 20% of the events