Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 141:

  Given the following SPL search, how many rows of results would you expect to be returned by default? index=security sourcetype=linux_secure (fail* OR invalid) I top src__ip

  A. 10

  B. 50

  C. 100

  D. 20

  Correct Answer: A

  The SPL search specified above will return 10 rows of results by default, as the "top" command specifies a limit of 10 results. The query will search for all events in the security index with a sourcetype of linuxsecure that contain either the terms fail* or invalid and will display the top 10 results according to the src_ip field.

• Question 142:

  Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

  A. inputlookup

  B. lookup

  Correct Answer: B

• Question 143:

  Which of the following are common constraints of the top command?

  A. limit, count

  B. limit, showpercent

  C. limits, countfield

  D. showperc, countfield

  Correct Answer: B

• Question 144:

  What is the main requirement for creating visualizations using the Splunk UI?

  A. Your search must transform event data into Excel file format first.

  B. Your search must transform event data into XML formatted data first.

  C. Your search must transform event data into statistical data tables first.

  D. Your search must transform event data into JSON formatted data first.

  Correct Answer: C

• Question 145:

  Splunk Parses data into individual events, extracts time, and assigns metadata.

  A. False

  B. True

  Correct Answer: B

• Question 146:

  Which of the following is a metadata field assigned to every event in Splunk?

  A. host

  B. owner

  C. bytes

  D. action

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Assignmetadatatoeventsdynami cally

• Question 147:

  The better way of writing search query for index is:

  A. index=a index=b

  B. (index=a OR index=b)

  C. index=(a and b)

  D. index = a, b

  Correct Answer: B

• Question 148:

  The command shown here does witch of the following: Command: |outputlookup products.csv

  A. Writes search results to a file named products.csv

  B. Returns the contents of a file named products.csv

  Correct Answer: A

• Question 149:

  NOT status = 100:

  A. Will display result depending on the data.

  B. Will return event where status field exist but value of that field is not 100.

  C. Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

  Correct Answer: C

• Question 150:

  Fields are searchable key value pairs in your event data.

  A. True

  B. False

  Correct Answer: A