Splunk SPLK-1001 Online Practice Questions and Exam Preparation

Splunk SPLK-1001 Online Questions & Answers

• Question 141:

  By default, which of the following fields would be listed in the fields sidebar under interesting Fields?

  A. host
  B. index
  C. source
  D. sourcetype
  D. sourcetype

  ---

  Explanation/Reference:

  The fields sidebar in Splunk shows the default fields and the interesting fields for the events that match your search. The default fields are host, source, and sourcetype, which are extracted for every event at index time. The interesting fields are fields that appear in at least 20% of the events in your search results. You can also select additional fields to display in the fields sidebar. By default, the index field is not listed in the fields sidebar, because it is not a default field nor an interesting field. The index field is a metadata field that indicates which index the event belongs to. Metadata fields are not extracted from the event data, but are added by the indexer as part of the indexing process. Metadata fields are not shown in the fields sidebar, but you can use them in your search queries. Therefore, among the four options, only sourcetype would be listed in the fields sidebar under interesting fields by default.

• Question 142:

  Which symbol is used to snap the time?

  A. @
  B. and
  C. *
  D. #
  A. @

• Question 143:

  Splunk apps are used for following (Choose three.):

  A. Designed to cater numerous use cases and empower Splunk.
  B. We can not install Splunk App.
  C. Allows multiple workspaces for different use cases/user roles.
  D. It is collection of different Splunk config files like data inputs, UI and Knowledge Object.
  A. Designed to cater numerous use cases and empower Splunk.
  C. Allows multiple workspaces for different use cases/user roles.
  D. It is collection of different Splunk config files like data inputs, UI and Knowledge Object.

• Question 144:

  In the Fields sidebar, what does the number directly to the right of the field name indicate?

  A. The value of the field
  B. The number of values for the field
  C. The number of unique values for the field
  D. The numeric non-unique values of the field
  C. The number of unique values for the field

  ---

  Explanation/Reference:

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchTutorial/Usefieldstosearch

• Question 145:

  What is the purpose of using a by clause with the stats command?

  A. To group the results by one or more fields.
  B. To compute numerical statistics on each field.
  C. To specify how the values in a list are delimited.
  D. To partition the input data based on the split-by fields.
  A. To group the results by one or more fields.

• Question 146:

  Matching of parentheses is a feature of Splunk Assistant.

  A. No
  B. Yes
  B. Yes

• Question 147:

  Which command automatically returns percent and count columns when executing searches?

  A. top
  B. stats
  C. table
  D. percent
  A. top

• Question 148:

  All components are installed and administered in Splunk Enterprise on-premise.

  A. True
  B. False
  A. True

• Question 149:

  Which of the following statements describes a search job?

  A. Once a search job begins, it cannot be stopped
  B. A search job can only be paused when less than 50% of events are returned
  C. A search job can only be stopped when less than 50% of events are returned
  D. Once a search job begins, it can be stopped or paused at any point in time
  D. Once a search job begins, it can be stopped or paused at any point in time

  ---

  Explanation/Reference:

  Reference: https://answers.splunk.com/answers/329699/why-does-my-search-head- cluster-captain-start-dele-1.html

• Question 150:

  What does the values function of the stats command do?

  A. Lists all values of a given field.
  B. Lists unique values of a given field.
  C. Returns a count of unique values for a given field.
  D. Returns the number of events that match the search.
  B. Lists unique values of a given field.