Splunk SPLK-2001 Online Practice Questions and Exam Preparation

Splunk SPLK-2001 Online Questions & Answers

• Question 1:

  Which of the following are valid parent elements for the event action shown below? (Select all that apply.) sourcetype=$click.value|s$

  AC

• Question 2:

  Which Splunk REST endpoint is used to create a KV store collection?

  A. /storage/collections
  B. /storage/kvstore/create
  C. /storage/collections/config
  D. /storage/kvstore/collections
  A. /storage/collections

  ---

  Reference: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/

• Question 3:

  There is a global search named "global_search" defined on a form as shown below:

  index-_internal source-*splunkd.log | stats count by component, log_level

  Which of the following would be a valid post-processing search? (Select all that apply.)

  A. | tstats count
  B. sourcetype=mysourcetype
  C. stats sum(count) AS count by log level
  D. search log_level=error | stats sum(count) AS count by component
  C. stats sum(count) AS count by log level
  D. search log_level=error | stats sum(count) AS count by component

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/Savedsearches

• Question 4:

  Which of the following formats are valid for a Splunk REST URI?

  A. host:port/endpoint
  B. scheme://host/servicesNS/*/
  C. $SPLUNK HOME/services/endpoint
  D. scheme://host:port/services/endpoint
  D. scheme://host:port/services/endpoint

• Question 5:

  Place content to set on page load inside which of the following Simple XML tags?

  C

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/tokens

• Question 6:

  Which of the following search commands can be used to perform statistical queries on indexed fields in TSIDX files?

  A. stats
  B. tstats
  C. tscollect
  D. transaction
  B. tstats

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Tstats

• Question 7:

  Which of the following will unset a token named my_token?

  A. $my_token$
  C. false
  D. disabled
  B

  ---

  Reference: https://community.splunk.com/t5/Dashboards-Visualizations/Unset-a-token-if-it-is-equal-to-a-value/m-p/353512

• Question 8:

  Which type of command is tstats?

  A. Generating
  B. Transforming
  C. Centralized streaming
  D. Distributable streaming
  A. Generating

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Tstats

• Question 9:

  Which of the following is a security best practice?

  A. Enable XSS.
  B. Eliminate all escape characters.
  C. Ensure the app passes App Certification.
  D. Ensure components have no Common Vulnerabilities and Exposures (CVE) vulnerabilities.
  D. Ensure components have no Common Vulnerabilities and Exposures (CVE) vulnerabilities.

• Question 10:

  Using Splunk Web to modify config settings for a shared object, a revised config file with those changes is placed in which directory?

  A. $SPLUNK_HOME/etc/apps/myApp/local
  B. $SPLUNK_HOME/etc/system/default/
  C. $SPLUNK_HOME/etc/system/local
  D. $SPLUNK_HOME/etc/apps/myApp/default
  A. $SPLUNK_HOME/etc/apps/myApp/local

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Howtoeditaconfigurationfile