Splunk SPLK-2001 Online Practice Questions and Exam Preparation

Splunk SPLK-2001 Online Questions & Answers

• Question 1:

  For a KV store, a lookup stanza in the transforms.conf file must contain which of the following? (Select all that apply.)

  A. collection
  B. fields_list
  C. external_type
  D. internal_type
  A. collection
  B. fields_list

  ---

  explanation:

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/ConfigureKVstorelookups

• Question 2:

  Data can be added to a KV store collection in which of the following format(s)?

  A. JSON
  B. JSON, XML
  C. JSON, XML, CSV
  D. JSON, XML, CSV, TXT
  A. JSON

  ---

  explanation:

  Reference: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles/

• Question 3:

  Which of the following will unset a token named my_token?

  A. $my_token$
  C. false
  D. disabled
  B

  ---

  explanation:

  Reference: https://community.splunk.com/t5/Dashboards-Visualizations/Unset-a-token-if-it-is-equal-to-a-value/m-p/353512

• Question 4:

  Which of the following search commands can be used to perform statistical queries on indexed fields in TSIDX files?

  A. stats
  B. tstats
  C. tscollect
  D. transaction
  B. tstats

  ---

  explanation:

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Tstats

• Question 5:

  A dashboard is taking too long to load. Several searches start with the same SPL. How can the searches be optimized in this dashboard? (Select all that apply.)

  A. Convert searches to include NOT expressions.
  B. Restrict the time range of the search as much as possible.
  C. Replace | stats command with | transaction command wherever possible.
  D. Convert the common SPL into a Global Search and convert the other searches to post-processing searches.
  C. Replace | stats command with | transaction command wherever possible.
  D. Convert the common SPL into a Global Search and convert the other searches to post-processing searches.

• Question 6:

  When using the Splunk Web Framework to create a global search, which is the correct post-process syntax for the base search shown below?

  var searchmain = new SearchManager{{

  id: "base-search",

  search: "index= internal | head 10 | fields "*",

  preview: true,

  cache: true

  }};

  A. var mypostproc1 = new PostProcessManager {{ id: "post1", managerid: "base-search", search: "| stats count by sourcetype" }};
  B. var mypostproc1 = new PostProcessManager{{ id: "post1", managerid: "base", search: "| stats count by sourcetype" }};
  C. var mypostproc1 = new PostProcess{{ id: "post1", managerid: "base-search", search: "| search stats count by sourcetype" }};
  D. You cannot create global searches in the Splunk Web Framework.
  A. var mypostproc1 = new PostProcessManager {{ id: "post1", managerid: "base-search", search: "| stats count by sourcetype" }};

• Question 7:

  Which files within an app contain permissions information? (Select all that apply.)

  A. local/metadata.conf
  B. metadata/local.meta
  C. default/metadata.conf
  D. metadata/default.meta
  C. default/metadata.conf
  D. metadata/default.meta

  ---

  explanation:

  Reference: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/manageaccesstocustom/

• Question 8:

  Which of the following is a way to monitor app performance? (Select all that apply.)

  A. Using Splunk logs.
  B. Using the search job inspector.
  C. Using the Monitoring Console.
  D. Using the storage/collections/config REST endpoint.
  A. Using Splunk logs.
  C. Using the Monitoring Console.

• Question 9:

  In a DELETE request, what would omitting the value of _key from the REST endpoint do?

  A. Clean the KV store, deleting all content.
  B. Produce the syntax error "Key value missing".
  C. Cause all records in a collection to be deleted.
  D. Mean that the _key value must be passed as an argument.
  C. Cause all records in a collection to be deleted.

• Question 10:

  Which of the following are valid parent elements for the event action shown below? (Select all that apply.) sourcetype=$click.value|s$

  AC