Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 161:

  You are able to create new Index in Data Input settings.

  A. No

  B. Yes

  Correct Answer: B

• Question 162:

  At the time of searching the start time is 03:35:08.

  Will it look back to 03:00:00 if we use -30m@h in searching?

  A. Yes

  B. No

  Correct Answer: A

• Question 163:

  Selected fields are a set of configurable fields displayed for each event.

  A. True

  B. False

  Correct Answer: A

• Question 164:

  When a search returns __________, you can view the results as a list.

  A. a list of events

  B. transactions

  C. statistical values

  Correct Answer: C

• Question 165:

  What does the stats command do?

  A. Automatically correlates related fields

  B. Converts field values into numerical values

  C. Calculates statistics on data that matches the search criteria

  D. Analyzes numerical fields for their ability to predict another discrete field

  Correct Answer: C

• Question 166:

  Parsing of data can happen both in HF and UF.

  A. Yes

  B. No

  Correct Answer: B

• Question 167:

  Which of the following statements describes a search job?

  A. Once a search job begins, it cannot be stopped

  B. A search job can only be paused when less than 50% of events are returned

  C. A search job can only be stopped when less than 50% of events are returned

  D. Once a search job begins, it can be stopped or paused at any point in time

  Correct Answer: D

  Reference: https://answers.splunk.com/answers/329699/why-does-my-search-head- cluster-captain-start-dele-1.html

• Question 168:

  This function of the stats command allows you to return the middle-most value of field X.

  A. Median(X)

  B. Eval by X

  C. Fields(X)

  D. Values(X)

  Correct Answer: A

• Question 169:

  Which of the following reports is available in the Fields window?

  A. Top values by time

  B. Rare values by time

  C. Events with top value fields

  D. Events with rare value fields

  Correct Answer: C

• Question 170:

  Select the statements that are true for timeline in Splunk (Choose four.):

  A. Timeline shows distribution of events specified in the time range in the form of bars.

  B. Single click to see the result for particular time period.

  C. You can click and drag across the bar for selecting the range.

  D. This is default view and you can't make any changes to it.

  E. You can hover your mouse for details like total events, time and date.

  Correct Answer: ABCE