Free SPLK-1001 Exam Dumps Preview

Question 1

Single choice

Which command is used to validate a lookup file?

1. A

   | lookup products.csv

2. B

   inputlookup products.csv

3. C

   I inputlookup products.csv

4. D

   | lookup definition products.csv

Reveal answer details Close answer details

Correct answerC

Question 2

Single choice

How are events displayed after a search is executed?

1. A

   In chronological order.

2. B

   Randomly by default.

3. C

   In reverse chronological order.

4. D

   Alphabetically according to field name.

Reveal answer details Close answer details

Correct answerC

Question 3

Single choice

Splunk indexes the data on the basis of timestamps.

1. A

   True

2. B

   False

Reveal answer details Close answer details

Correct answerA

Question 4

Single choice

Which Field/Value pair will return only events found in the index named security?

1. A

   Index=Security

2. B

   index=Security

3. C

   Index=security

4. D

   index!=Security

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://answers.splunk.com/answers/712164/why-are-the-wineventlogssecurity-indexing-indiffe.html

Question 5

Single choice

Splunk index time process can be broken down into __________ phases.

1. A

   3

2. B

   2

3. C

   4

4. D

   1

Reveal answer details Close answer details

Correct answerA

Question 6

Single choice

Which stats command function provides a count of how many unique values exist for a given field in the result set?

1. A

   dc(field)

2. B

   count(field)

3. C

   count-by(field)

4. D

   distinct-count(field)

Reveal answer details Close answer details

Correct answerA

Question 7

Single choice

When is the pipe character, I, used in search strings?

1. A

   Before clauses. For example: stats sum(bytes) | by host

2. B

   Before commands. For example: | stats sum(bytes) by host

3. C

   Before arguments. For example: stats sum| (bytes) by host

4. D

   Before functions. For example: stats |sum(bytes) by host

Reveal answer details Close answer details

Correct answerB

Question 8

Single choice

How are the results of the following search sorted?

... | sort action, --file, +bytes

1. A

   In descending order by action, then descending order by file, and lastly by ascending order of bytes.

2. B

   In ascending order by action, then descending order by file, and lastly by ascending order of bytes.

3. C

   In descending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

4. D

   In ascending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

Reveal answer details Close answer details

Correct answerB

Explanation

Using a minus sign (-) for descending order and a plus sign (+) for ascending order. If no sign is specified, the default order is ascending. Sorting by multiple fields in the order they are specified. If there are duplicate values in one field, the next field is used to break the tie. Sorting by field values according to their types. If the field type is not specified, the sort command tries to automatically determine it.

Question 9

Single choice

When running searches command modifiers in the search string are displayed in what color?

1. A

   Red

2. B

   Blue

3. C

   Orange

4. D

   Highlighted

Reveal answer details Close answer details

Correct answerB

Question 10

Single choice

How many main user roles do you have in Splunk?

1. A

   2

2. B

   4

3. C

   1

4. D

   3

Reveal answer details Close answer details

Correct answerD

Question 11

Single choice

Which of the following searches would return only events that match the following criteria?

1. Events are inside the main index
2. The field status exists in the event
3. The value in the status field does not equal 200

1. A

   index==main status!==200

2. B

   index=main NOT status=200

3. C

   index==main NOT status==200

4. D

   index-main status!=200

Reveal answer details Close answer details

Correct answerC

Explanation

The Kusto Query Language (KQL) is the language you use to query data in Azure Data Explorer [1]. It's a powerful language that allows you to perform advanced queries and extract meaningful insights from your data. To query for events that match the criteria you specified, you would use the following KQL query:
index==main NOT status==200
This query will return all events that are inside the main index and have a status field, but the value of the status field does not equal 200. It is important to note that the "NOT" operator must be used in order to exclude events with a status value of 200. By using the "NOT" operator, the query will return only events that do not match the specified criteria. This is useful for narrowing down search results to only those events that are relevant to the query.

Question 12

Single choice

By default, how long does Splunk retain a search job?

1. A

   10 Minutes

2. B

   15 Minutes

3. C

   1 Day

4. D

   7 Days

Reveal answer details Close answer details

Correct answerA

Question 13

Single choice

Which of the following searches will return results where fail, 400, and error exist in every event?

1. A

   error AND (fail AND 400)

2. B

   error OR (fail and 400)

3. C

   error AND (fail OR 400)

4. D

   error OR fail OR 400

Reveal answer details Close answer details

Correct answerC

Question 14

Multiple choice

What options do you get after selecting timeline? (Choose four.)

1. A

   Zoom to selection

2. B

   Format Timeline

3. C

   Deselect

4. D

   Delete

5. E

   Zoom Out

Reveal answer details Close answer details

Correct answersA, B, C, E

Question 15

Single choice

In automatic lookup definitions, the _____ fields are those that are not in the event data.

1. A

   input

2. B

   output

Reveal answer details Close answer details

Correct answerB

Question 16

Single choice

When looking at a dashboard panel that is based on a report, which of the following is true?

1. A

   You can modify the search string in the panel, and you can change and configure the visualization.

2. B

   You can modify the search string in the panel, but you cannot change and configure the visualization.

3. C

   You cannot modify the search string in the panel, but you can change and configure the visualization.

4. D

   You cannot modify the search string in the panel, and you cannot change and configure the visualization.

Reveal answer details Close answer details

Correct answerC

Explanation

When looking at a dashboard panel that is based on a report, you cannot modify the search string in the panel, but you can change and configure the visualization. This is because the dashboard panel inherits the search string from the report, and any changes to the search string will affect the report as well.
However, you can customize the visualization settings for the dashboard panel without affecting the report.
References:
Splunk Core User Certification Exam Study Guide, page 37.

Question 17

Single choice

When using the top command in the following search, which of the following will be true about the results?

index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f
countfield=status_code_count

1. A

   The search will fail. The proper top command format is top limit=3 instead of top 3.

2. B

   The top three most common values in statusCode will be displayed for each user.

3. C

   Only the top three overall most common values in statusCode will be displayed.

4. D

   The percentage field will be displayed in the results.

Reveal answer details Close answer details

Correct answerB

Explanation

The top command returns the most common values of a field and their count. By using the by clause, you can group the results by another field. In this case, the top command will return the top three most common values in statusCode for each user. The showperc=f option will suppress the percentage column in the output. The countfield option will rename the count column to status_code_count2.

Question 18

Single choice

What does the stats command do?

1. A

   Automatically correlates related fields

2. B

   Converts field values into numerical values

3. C

   Calculates statistics on data that matches the search criteria

4. D

   Analyzes numerical fields for their ability to predict another discrete field

Reveal answer details Close answer details

Correct answerC

Question 19

Single choice

Which of the following file types is an option for exporting Splunk search results?

1. A

   PDF

2. B

   JSON

3. C

   XLS

4. D

   RTF

Reveal answer details Close answer details

Correct answerB

Question 20

Single choice

36. Lookups can be private for a user.

1. A

   True

2. B

   False

Reveal answer details Close answer details

Correct answerA

Question 21

Single choice

Which of the following can be used as wildcard search in Splunk?

1. A

   =

2. B

   >

3. C

   !

4. D

   *

Reveal answer details Close answer details

Correct answerD

Question 22

Single choice

@ Symbol can be used in advanced time unit option.

1. A

   No

2. B

   Yes

Reveal answer details Close answer details

Correct answerB

Question 23

Single choice

When displaying results of a search, which of the following is true about line charts?

1. A

   Line charts are optimal for single and multiple series.

2. B

   Line charts are optimal for single series when using Fast mode.

3. C

   Line charts are optimal for multiple series with 3 or more columns.

4. D

   Line charts are optimal for multiseries searches with at least 2 or more columns.

Reveal answer details Close answer details

Correct answerC

Question 24

Single choice

When refining search results, what is the difference in the time picker between real-time and relative time ranges?

1. A

   Real-time searches happen instantly, while relative searches happen at a scheduled time.

2. B

   Real-time searches display results from a rolling time window, while relative searches display results from a set length of time.

3. C

   Real-time searches run constantly in the background, while relative searches only run when certain criteria are met.

4. D

   Real-time represents events that have happened in a set time window, while relative will display results from a rolling time window.

Reveal answer details Close answer details

Correct answerB

Explanation

The difference between real-time and relative time ranges in the time picker is that real-time searches display results from a rolling time window, such as the last 15 minutes, while relative searches display results from a set length of time, such as yesterday or last week. Real-time searches do not happen instantly, but rather update periodically based on the refresh interval. Relative searches do not happen at a scheduled time, but rather when the user runs them. Real-time searches do not run constantly in the background, but rather when the user starts them. Real-time searches do not represent events that have happened in a set time window, but rather events that are happening now.

Question 25

Single choice

Creating Data Models:

Object ATTRIBUTES do not define ___________.

1. A

   a base search for the object

2. B

   fields for the object

Reveal answer details Close answer details

Correct answerA

Question 26

Single choice

What does the following specified time range do?

earliest=-72h@h latest=@d

1. A

   Look back 3 days ago and prior

2. B

   Look back 72 hours up to one day ago

3. C

   Look back 72 hours, up to the end of today

4. D

   Look back from 3 days ago up to the beginning of today

Reveal answer details Close answer details

Correct answerD

Question 27

Single choice

How can results from a specified static lookup file be displayed?

1. A

   lookup command

2. B

   inputlookup command

3. C

   Settings > Lookups > Input

4. D

   Settings > Lookups > Upload

Reveal answer details Close answer details

Correct answerB

Question 28

Single choice

Universal forwarder is recommended for forwarding the logs to indexers.

1. A

   False

2. B

   True

Reveal answer details Close answer details

Correct answerB

Question 29

Single choice

How to make Interesting field into a selected field?

1. A

   Click field in field sidebar -> click YES on the pop-up dialog on upper right side -> check now field
   should be visible in the list of selected fields.

2. B

   Not possible.

3. C

   Only CLI changes will enable it.

4. D

   Click Settings -> Find field option -> Drop down select field -> enable selected field -> check now field
   should be visible in the list of selected fields.

Reveal answer details Close answer details

Correct answerA

Question 30

Single choice

When viewing the results of a search, what is an Interesting Field?

1. A

   A field that appears in any event

2. B

   A field that appears in every event

3. C

   A field that appears in the top 10 events

4. D

   A field that appears in at least 20% of the events

Reveal answer details Close answer details

Correct answerD

Question 31

Single choice

Which of the following are not true about lookups? (Select all that apply.)

1. A

   Lookups can be time based

2. B

   Search results can be used to populate a lookup table

3. C

   Splunk DB Connect can be used to populate a lookup table from relational databases

4. D

   Output from a script can be used to populate a lookup table

5. E

   Lookup have a 10mg maximum size limit

Reveal answer details Close answer details

Correct answerE

Question 32

Single choice

Log filtering/parsing can be done from _____________.

1. A

   Index Forwarders (IF)

2. B

   Universal Forwarders (UF)

3. C

   Super Forwarder (SF)

4. D

   Heavy Forwarders (HF)

Reveal answer details Close answer details

Correct answerD

Question 33

Single choice

What is the default lifetime of every Splunk search job?

1. A

   All search jobs are saved for 10 days

2. B

   All search jobs are saved for 10 hours

3. C

   All search jobs are saved for 10 weeks

4. D

   All search jobs are saved for 10 minutes

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Extendjoblifetimes

Question 34

Single choice

You are able to create new Index in Data Input settings.

1. A

   No

2. B

   Yes

Reveal answer details Close answer details

Correct answerB

Question 35

Single choice

What does the rare command do?

1. A

   Returns the least common field values of a given field in the results.

2. B

   Returns the most common field values of a given field in the results.

3. C

   Returns the top 10 field values of a given field in the results.

4. D

   Returns the lowest 10 field values of a given field in the results.

Reveal answer details Close answer details

Correct answerA

Question 36

Single choice

What result will you get with following search index=test sourcetype="The_Questionnaire_P*" ?

1. A

   the_questionnaire_pedia

2. B

   the_questionnaire pedia

3. C

   the_questionnaire_pedia

4. D

   the_questionnaire Pedia

Reveal answer details Close answer details

Correct answerC

Question 37

Single choice

Which search will return the 15 least common field values for the dest_ip field?

1. A

   sourcetype=firewall | rare num=15 dest_ip

2. B

   sourcetype=firewall | rare last=15 dest_ip

3. C

   sourcetype=firewall | rare count=15 dest_ip

4. D

   sourcetype=firewall | rare limit=15 dest_ip

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://answers.splunk.com/answers/41928/add-a-lookup-csv-colum-information-to-the-results-ofa-inputlookup-search.html