Splunk SPLK-1001 Online Practice Questions and Exam Preparation

Splunk SPLK-1001 Online Questions & Answers

• Question 151:

  Given the following SPL search, how many rows of results would you expect to be returned by default? index=security sourcetype=linux_secure (fail* OR invalid) I top src__ip

  A. 10
  B. 50
  C. 100
  D. 20
  A. 10

  ---

  Explanation/Reference:

  The SPL search specified above will return 10 rows of results by default, as the "top" command specifies a limit of 10 results. The query will search for all events in the security index with a sourcetype of linuxsecure that contain either the terms fail* or invalid and will display the top 10 results according to the src_ip field.

• Question 152:

  A collection of items containing things such as data inputs, UI elements, and knowledge objects is known as what?

  A. An app
  B. JSON
  C. A role
  D. An enhanced solution
  A. An app

• Question 153:

  Field names are case sensitive and field value are not.

  A. True
  B. False
  A. True

• Question 154:

  Which statement describes field discovery at search time?

  A. Splunk automatically discovers only numeric fields
  B. Splunk automatically discovers only alphanumeric fields
  C. Splunk automatically discovers only manually configured fields
  D. Splunk automatically discovers only fields directly related to the search results
  D. Splunk automatically discovers only fields directly related to the search results

  ---

  Explanation/Reference:

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Changethesearchmode

• Question 155:

  When looking at a dashboard panel that is based on a report, which of the following is true?

  A. You can modify the search string in the panel, and you can change and configure the visualization.
  B. You can modify the search string in the panel, but you cannot change and configure the visualization.
  C. You cannot modify the search string in the panel, but you can change and configure the visualization.
  D. You cannot modify the search string in the panel, and you cannot change and configure the visualization.
  C. You cannot modify the search string in the panel, but you can change and configure the visualization.

  ---

  Explanation/Reference:

  When looking at a dashboard panel that is based on a report, you cannot modify the search string in the panel, but you can change and configure the visualization. This is because the dashboard panel inherits the search string from the report, and any changes to the search string will affect the report as well. However, you can customize the visualization settings for the dashboard panel without affecting the report. References: Splunk Core User Certification Exam Study Guide, page 37.

• Question 156:

  Which statement is true about the top command?

  A. It returns the top 10 results
  B. It displays the output in table format
  C. It returns the count and percent columns per row
  D. All of the above
  D. All of the above

• Question 157:

  Which time range picker configuration would return real-time events for the past 30 seconds?

  A. Preset - Relative: 30-seconds ago
  B. Relative - Earliest: 30-seconds ago, Latest: Now
  C. Real-time - Earliest: 30-seconds ago, Latest: Now
  D. Advanced - Earliest: 30-seconds ago, Latest: Now
  C. Real-time - Earliest: 30-seconds ago, Latest: Now

• Question 158:

  By default, how long does Splunk retain a search job?

  A. 10 Minutes
  B. 15 Minutes
  C. 1 Day
  D. 7 Days
  A. 10 Minutes

• Question 159:

  Forward Option gather and forward data to indexers over a receiving port from remote machines.

  A. False
  B. True
  B. True

• Question 160:

  When a search returns __________, you can view the results as a list.

  A. a list of events
  B. transactions
  C. statistical values
  C. statistical values