Splunk Splunk Core Certified User SPLK-1001 Questions & Answers

• Question 1:

  In the fields sidebar, what indicates that a field is numeric?

  A. A number to the right of the field name.

  B. A # symbol to the left of the field name.

  C. A lowercase n to the left of the field name.

  D. A lowercase n to the right of the field name.

  Correct Answer: B

• Question 2:

  By default, which of the following fields would be listed in the fields sidebar under interesting Fields?

  A. host

  B. index

  C. source

  D. sourcetype

  Correct Answer: D

  The fields sidebar in Splunk shows the default fields and the interesting fields for the events that match your search. The default fields are host, source, and sourcetype, which are extracted for every event at index time. The interesting fields are fields that appear in at least 20% of the events in your search results. You can also select additional fields to display in the fields sidebar. By default, the index field is not listed in the fields sidebar, because it is not a default field nor an interesting field. The index field is a metadata field that indicates which index the event belongs to. Metadata fields are not extracted from the event data, but are added by the indexer as part of the indexing process. Metadata fields are not shown in the fields sidebar, but you can use them in your search queries. Therefore, among the four options, only sourcetype would be listed in the fields sidebar under interesting fields by default.

• Question 3:

  What is a suggested Splunk best practice for naming reports?

  A. Reports are best named using many numbers so they can be more easily sorted.

  B. Use a consistent naming convention so they are easily separated by characteristics such as group and object.

  C. Name reports as uniquely as possible with no overlap to differentiate them from one another.

  D. Any naming convention is fine as long as you keep an external spreadsheet to keep track.

  Correct Answer: B

• Question 4:

  What is the primary use for the rare command1?

  A. To sort field values in descending order

  B. To return only fields containing five or fewer values

  C. To find the least common values of a field in a dataset

  D. To find the fields with the fewest number of values across a dataset

  Correct Answer: C

• Question 5:

  The four types of Lookups that Splunk provides out-of-the-box are External, KV Store, Geospatial and which of the following?

  A. Correlated

  B. File-based

  C. Total

  D. Segmented

  Correct Answer: B

  The four types of lookups that Splunk provides out-of-the-box are file-based, external, KV Store, and geospatial. File-based lookups use CSV files to map fields from your data to fields in the external table. External lookups use Python scripts or binary executables to populate your events with field values from an external source. KV Store lookups use a key-value store to map fields from your data to fields in the external table. Geospatial lookups use KMZ or KML files to match location coordinates in your events to geographic feature collections1.

• Question 6:

  Which of the following commands will show the maximum bytes?

  A. sourcetype=access_* | maximum totals by bytes

  B. sourcetype=access_* | avg (bytes)

  C. sourcetype=access_* | stats max(bytes)

  D. sourcetype=access_* | max(bytes)

  Correct Answer: C

• Question 7:

  Documentations for Splunk can be found at docs.splunk.com

  A. True

  B. False

  Correct Answer: A

• Question 8:

  This function of the stats command allows you to return the sample standard deviation of a field.

  A. stdev

  B. dev

  C. count deviation

  D. by standarddev

  Correct Answer: A

• Question 9:

  What are the three main Splunk components?

  A. Search head, GPU, streamer

  B. Search head, indexer, forwarder

  C. Search head, SQL database, forwarder

  D. Search head, SSD, heavy weight agent

  Correct Answer: B

  Reference: https://www.edureka.co/blog/splunk-architecture/

• Question 10:

  In monitor option you can select the following options in GUI.

  A. Only HTTP Event Collector (HEC) and TCP/UDP

  B. None of the above

  C. Only TCP/UDP

  D. Only Scripts

  E. Filed and Directories, HTTP Event Collector (HEC), TCP/UDP and Scripts

  Correct Answer: E