Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 101:

  Splunk internal fields contains general information about events and starts from underscore

  A. e. _ .

  B. True

  C. False

  Correct Answer: A

• Question 102:

  Which search will return the 15 least common field values for the dest_ip field?

  A. sourcetype=firewall | rare num=15 dest_ip

  B. sourcetype=firewall | rare last=15 dest_ip

  C. sourcetype=firewall | rare count=15 dest_ip

  D. sourcetype=firewall | rare limit=15 dest_ip

  Correct Answer: C

  Reference: https://answers.splunk.com/answers/41928/add-a-lookup-csv-colum- information-to-the-results-ofa-inputlookup-search.html

• Question 103:

  What options do you get after selecting timeline? (Choose four.)

  A. Zoom to selection

  B. Format Timeline

  C. Deselect

  D. Delete

  E. Zoom Out

  Correct Answer: ABCE

• Question 104:

  When looking at a dashboard panel that is based on a report, which of the following is true?

  A. You can modify the search string in the panel, and you can change and configure the visualization.

  B. You can modify the search string in the panel, but you cannot change and configure the visualization.

  C. You cannot modify the search string in the panel, but you can change and configure the visualization.

  D. You cannot modify the search string in the panel, and you cannot change and configure the visualization.

  Correct Answer: C

  When looking at a dashboard panel that is based on a report, you cannot modify the search string in the panel, but you can change and configure the visualization. This is because the dashboard panel inherits the search string from the report, and any changes to the search string will affect the report as well. However, you can customize the visualization settings for the dashboard panel without affecting the report. References: Splunk Core User Certification Exam Study Guide, page 37.

• Question 105:

  It is no possible for a single instance of Splunk to manage the input, parsing and indexing of machine data.

  A. True

  B. False

  Correct Answer: B

• Question 106:

  Which of the following statements about case sensitivity is true?

  A. Both field names and field values ARE case sensitive.

  B. Field names ARE case sensitive; field values are NOT.

  C. Field values ARE case sensitive; field names ARE NOT.

  D. Both field names and field values ARE NOT case sensitive.

  Correct Answer: B

• Question 107:

  Which of the following Splunk components typically resides on the machines where data originates?

  A. Indexer

  B. Forwarder

  C. Search head

  D. Deployment server

  Correct Answer: B

• Question 108:

  Which of the following searches will return results where fail, 400, and error exist in every event?

  A. error AND (fail AND 400)

  B. error OR (fail and 400)

  C. error AND (fail OR 400)

  D. error OR fail OR 400

  Correct Answer: C

• Question 109:

  It is not possible for a single instance of Splunk to manage the input, parsing and indexing of machine.

  A. True

  B. False

  Correct Answer: B

• Question 110:

  The new data uploaded in Splunk are shown in ________________.

  A. Real-time

  B. 10 Minutes

  C. Overnight Download

  D. 30 Minutes

  Correct Answer: A