Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 121:

  How to make Interesting field into a selected field?

  A. Click field in field sidebar -> click YES on the pop-up dialog on upper right side -> check now field should be visible in the list of selected fields.

  B. Not possible.

  C. Only CLI changes will enable it.

  D. Click Settings -> Find field option -> Drop down select field -> enable selected field -> check now field should be visible in the list of selected fields.

  Correct Answer: A

• Question 122:

  Snapping rounds down to the nearest specified unit.

  A. Yes

  B. No

  Correct Answer: A

• Question 123:

  What must be done before an automatic lookup can be created? (select all that apply)

  A. The lookup command must be used.

  B. The lookup definition must be created.

  C. The lookup file must be uploaded to Splunk.

  D. The lookup file must be verified using the inputlookup command.

  Correct Answer: B

• Question 124:

  This is what Splunk uses to categorize the data that is being indexed.

  A. Host

  B. Sourcetype

  C. Index

  D. Source

  Correct Answer: B

• Question 125:

  Which of the following are functions of the stats command?

  A. count, sum, add

  B. count, sum, less

  C. sum, avg, values

  D. sum, values, table

  Correct Answer: C

• Question 126:

  In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?

  A. No events will be returned.

  B. Splunk will prompt you to specify an index.

  C. All non-indexed events to which the user has access will be returned.

  D. Events from every index searched by default to which the user has access will be returned.

  Correct Answer: D

• Question 127:

  What is the purpose of using a by clause with the stats command?

  A. To group the results by one or more fields.

  B. To compute numerical statistics on each field.

  C. To specify how the values in a list are delimited.

  D. To partition the input data based on the split-by fields.

  Correct Answer: A

• Question 128:

  When running searches command modifiers in the search string are displayed in what color?

  A. Red

  B. Blue

  C. Orange

  D. Highlighted

  Correct Answer: B

• Question 129:

  What syntax is used to link key/value pairs in search strings?

  A. action+purchase

  B. action=purchase

  C. action | purchase

  D. action equal purchase

  Correct Answer: B

• Question 130:

  Which of the following searches will show the number of categoryld used by each host?

  A. Sourcetype=access_* |sum bytes by host

  B. Sourcetype=access_* |stats sum(categorylD) by host

  C. Sourcetype=access_* |sum(bytes) by host

  D. Sourcetype=access_* |stats sum by host

  Correct Answer: B