Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 151:

  These users can create global knowledge objects. (Select all that apply.)

  A. users

  B. power users

  C. administrators

  Correct Answer: BC

• Question 152:

  What is the correct syntax to count the number of events containing a vendor_action field?

  A. count stats vendor_action

  B. count stats (vendor_action)

  C. stats count (vendor_action)

  D. stats vendor_action (count)

  Correct Answer: C

  The stats command calculates statistics based on fields in the events. The count function counts the number of events that match the criteria. The syntax is stats count (field_name), where field_name is the name of the field that contains the value to be counted. In this case, vendor_action is the field name, so stats count (vendor_action) is the correct syntax. References: Splunk Core User Certification Exam Study Guide, page 23.

• Question 153:

  What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?

  A. latest=-2h

  B. earliest=-2h

  C. latest=-2hour@d

  D. earliest=-2hour@d

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Specifytimemodifiersinyourse arch

• Question 154:

  You can view the search result in following format (Choose three.):

  A. Table

  B. Raw

  C. Pie Chart

  D. List

  Correct Answer: ABD

• Question 155:

  What can be configured using the Edit Job Settings menu?

  A. Export the results to CSV format

  B. Add the Job results to a dashboard

  C. Schedule the Job to re-run in 10 minutes

  D. Change Job Lifetime from 10 minutes to 7 days.

  Correct Answer: D

• Question 156:

  Which search will return only events containing the word "error" and display the results as a table that includes the fields named action, src, and dest?

  A. error | table action, src, dest

  B. error | tabular action, src, dest

  C. error | stats table action, src, dest

  D. error | table column=action column=src column=dest

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/search

• Question 157:

  Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by price

  A. index=security sourcetype=access_* status=200 stats | count by price

  B. index=security sourcetype=access_* status=200 | stats count by price

  C. index=security sourcetype=access_* status=200 | stats count | by price

  D. index=security sourcetype=access_* | status=200 | stats count by price

  Correct Answer: B

• Question 158:

  We should use heavy forwarder for sending event-based data to Indexers.

  A. False

  B. True

  Correct Answer: B

• Question 159:

  What are the steps to schedule a report?

  A. After saving the report, click Schedule.

  B. After saving the report, click Event Type.

  C. After saving the report, click Scheduling.

  D. After saving the report, click Dashboard Panel.

  Correct Answer: A

• Question 160:

  Matching of parentheses is a feature of Splunk Assistant.

  A. No

  B. Yes

  Correct Answer: B