Splunk SPLK-1001 Online Practice Questions and Exam Preparation

Splunk SPLK-1001 Online Questions & Answers

• Question 131:

  What is the default lifetime of every Splunk search job?

  A. All search jobs are saved for 10 days
  B. All search jobs are saved for 10 hours
  C. All search jobs are saved for 10 weeks
  D. All search jobs are saved for 10 minutes
  D. All search jobs are saved for 10 minutes

  ---

  Explanation/Reference:

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Extendjoblifetimes

• Question 132:

  When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

  A. Cloned panel
  B. Inline panel
  C. Report panel
  D. Prebuilt panel
  C. Report panel

• Question 133:

  Lookups allow you to overwrite your raw event.

  A. True
  B. False
  A. True

• Question 134:

  Which of the following is an accurate definition of fields within Splunk?

  A. Inherent entities that exist in event data.
  B. A searchable key/value pair in event data.
  C. Values pulled exclusively from lookup tables.
  D. A non-searchable name/value pair used while indexing data.
  A. Inherent entities that exist in event data.

  ---

  Explanation/Reference:

  Fields are searchable key/value pairs in event data. They allow you to specify criteria for your searches and filter out unwanted events. Fields can be extracted automatically by Splunk software during indexing or searching, or manually by users using various methods. Fields are not inherent entities that exist in event data, but rather interpretations of data by Splunk software or users. Fields are not values pulled exclusively from lookup tables, although lookup tables can be used to add fields to events based on existing fields. Fields are not non-searchable name/value pairs used while indexing data, but rather searchable attributes that can be used to refine searches5.

• Question 135:

  Put query into separate lines where | (Pipes) are used by selecting following options.

  A. CTRL + Enter
  B. Shift + Enter
  C. Space + Enter
  D. ALT + Enter
  B. Shift + Enter

• Question 136:

  Selected fields are a set of configurable fields displayed for each event.

  A. True
  B. False
  A. True

• Question 137:

  What does the stats command do?

  A. Automatically correlates related fields
  B. Converts field values into numerical values
  C. Calculates statistics on data that matches the search criteria
  D. Analyzes numerical fields for their ability to predict another discrete field
  C. Calculates statistics on data that matches the search criteria

• Question 138:

  By default, all users have DELETE permission to ALL knowledge objects.

  A. True
  B. False
  B. False

• Question 139:

  In automatic lookup definitions, the _____ fields are those that are not in the event data.

  A. input
  B. output
  B. output

• Question 140:

  Which of the following reports is available in the Fields window?

  A. Top values by time
  B. Rare values by time
  C. Events with top value fields
  D. Events with rare value fields
  C. Events with top value fields