Splunk SPLK-1001 Online Practice Questions and Exam Preparation

Splunk SPLK-1001 Online Questions & Answers

• Question 161:

  What is the primary use for the rare command?

  A. To sort field values in descending order.
  B. To return only fields containing five of fewer values.
  C. To find the least common values of a field in a dataset.
  D. To find the fields with the fewest number of values across a dataset.
  C. To find the least common values of a field in a dataset.

• Question 162:

  Splunk Parses data into individual events, extracts time, and assigns metadata.

  A. False
  B. True
  B. True

• Question 163:

  Splunk Enterprise is used as a Scalable service in Splunk Cloud.

  A. True
  B. False
  A. True

• Question 164:

  Where does Licensing meter happen?

  A. Indexer
  B. Parsing
  C. Heavy Forwarder
  D. Input
  A. Indexer

• Question 165:

  Which of the following is the appropriately formatted SPL search?

  A. index=security sourcetype=linux secure (invalid OR failed) | stats count as "Potential Issues"
  B. index=security sourcetype=linux secure (invalid OR failed) | stats as "Potential Issues"
  C. index--security sourcetype=linux secure (invalid OR failed) | count stats as "Potential Issues"
  D. index--security sourcetype=linux secure (invalid OR failed) | count as "Potential Issues"
  A. index=security sourcetype=linux secure (invalid OR failed) | stats count as "Potential Issues"

  ---

  Explanation/Reference:

  This is the appropriately formatted SPL search because it follows the SPL syntax rules12, such as:

  Using the = operator to specify field-value pairs, such as index=security and sourcetype=linux.

  Using the OR operator to combine multiple values for the same field, such as (invalid OR failed).

  Using the | character to separate commands, such as stats count as "Potential Issues".

  Using the as keyword to rename fields, such as count as "Potential Issues".

• Question 166:

  Query - status != 100:

  A. Will return event where status field exist but value of that field is not 100.
  B. Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.
  C. Will get different results depending on data
  A. Will return event where status field exist but value of that field is not 100.

• Question 167:

  Which of the following searches would return events with failure in index netfw or warn or critical in index netops?

  A. (index=netfw failure) AND index=netops warn OR critical
  B. (index=netfw failure) OR (index=netops (warn OR critical))
  C. (index=netfw failure) AND (index=netops (warn OR critical))
  D. (index=netfw failure) OR index=netops OR (warn OR critical)
  B. (index=netfw failure) OR (index=netops (warn OR critical))

• Question 168:

  All users by default have WRITE permission to ALL knowledge objects.

  A. True
  B. False
  B. False

• Question 169:

  Select the best options for "search best practices" in Splunk: (Choose five.)

  A. Select the time range always.
  B. Try to specify index values.
  C. Include as many search terms as possible.
  D. Never select time range.
  E. Try to use * with every search term.
  F. Inclusion is generally better than exclusion.
  G. Try to keep specific search terms.
  A. Select the time range always.
  B. Try to specify index values.
  C. Include as many search terms as possible.
  F. Inclusion is generally better than exclusion.
  G. Try to keep specific search terms.

  ---

  Explanation/Reference:

  A,B,C,F,G

• Question 170:

  Splunk extracts fields from event data at index time and at search time.

  A. True
  B. False
  A. True

  ---

  Explanation/Reference:

  Reference: https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchTutorial/Usefieldstosearch