Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 91:

  Which time range picker configuration would return real-time events for the past 30 seconds?

  A. Preset - Relative: 30-seconds ago

  B. Relative - Earliest: 30-seconds ago, Latest: Now

  C. Real-time - Earliest: 30-seconds ago, Latest: Now

  D. Advanced - Earliest: 30-seconds ago, Latest: Now

  Correct Answer: C

• Question 92:

  Field names are case sensitive and field value are not.

  A. True

  B. False

  Correct Answer: A

• Question 93:

  Which of the statements is correct regarding click and drag option in timeline?

  A. The new result after selecting the range by dragging filters the events and displays the most recent first.

  B. There is no functionality like click and drag in Splunk's timeline.

  C. Using this option executes a new query.

  D. This doesn't execute a new query

  Correct Answer: A

• Question 94:

  Splunk automatically determines the source type for major data types.

  A. False

  B. True

  Correct Answer: B

• Question 95:

  What is the result of the following search?

  index=myindex source=c: \mydata. txt NOT error=*

  A. Only data where the error field is present and does not contain a value will be displayed.

  B. Only data with a value in the field error will be displayed.

  C. Only data that does not contain the error field will be displayed.

  D. Only data where the value of the field error does not equal an asterisk (*) will be displayed.

  Correct Answer: C

  The search query index=myindex source=c: \mydata. txt NOT error=* specifies three criteria for the events to be returned:

  The index must be myindex, which is a user-defined index that contains the data from a specific source or sources.

  The source must be c: \mydata. txt, which is the name of the file or directory where the data came from.

  The error field must not exist in the events, which is indicated by the NOT operator and the wildcard character (*).

  The NOT operator negates the following expression, which means that it returns the events that do not match the expression. The wildcard character () matches any value, including an empty value or a null value. Therefore, the expression

  NOT error= means that the events must not have an error field at all, regardless of its value. The search query does not use quotation marks around the source value, which means that it is case-sensitive and exact. If there are any variations

  in the source name, such as capitalization or spacing, they will not match the query.

• Question 96:

  Keywords are highlighted when you mouse over search results and you can click this search result to (Choose three.):

  A. Open new search.

  B. Exclude the item from search.

  C. None of the above.

  D. Add the item to search

  Correct Answer: ABD

• Question 97:

  What is the correct order of steps for creating a new lookup?

  1.

  Configure the lookup to run automatically

  2.

  Create the lookup table

  3.

  Define the lookup

  A. 2, 1, 3

  B. 1, 2, 3

  C. 2, 3, 1

  D. 3, 2, 1

  Correct Answer: C

• Question 98:

  How can search results be kept longer than 7 days?

  A. By scheduling a report.

  B. By creating a link to the job.

  C. By changing the job settings.

  D. By changing the time range picker to more than 7 days.

  Correct Answer: A

• Question 99:

  Universal forwarder is recommended for forwarding the logs to indexers.

  A. False

  B. True

  Correct Answer: B

• Question 100:

  By default, which of the following is a Selected Field?

  A. action

  B. clientip

  C. categoryld

  D. sourcetype

  Correct Answer: D