Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 171:

  Uploading local files though Upload options index the file only once.

  A. No

  B. Yes

  Correct Answer: B

• Question 172:

  Which of the following is a Splunk search best practice?

  A. Filter as early as possible.

  B. Never specify more than one index.

  C. Include as few search terms as possible.

  D. Use wildcards to return more search results.

  Correct Answer: A

• Question 173:

  By default, how long does Splunk retain a search job?

  A. 10 Minutes

  B. 15 Minutes

  C. 1 Day

  D. 7 Days

  Correct Answer: A

• Question 174:

  When refining search results, what is the difference in the time picker between real-time and relative time ranges?

  A. Real-time searches happen instantly, while relative searches happen at a scheduled time.

  B. Real-time searches display results from a rolling time window, while relative searches display results from a set length of time.

  C. Real-time searches run constantly in the background, while relative searches only run when certain criteria are met.

  D. Real-time represents events that have happened in a set time window, while relative will display results from a rolling time window.

  Correct Answer: B

  The difference between real-time and relative time ranges in the time picker is that real-time searches display results from a rolling time window, such as the last 15 minutes, while relative searches display results from a set length of time, such as yesterday or last week. Real-time searches do not happen instantly, but rather update periodically based on the refresh interval. Relative searches do not happen at a scheduled time, but rather when the user runs them. Real-time searches do not run constantly in the background, but rather when the user starts them. Real-time searches do not represent events that have happened in a set time window, but rather events that are happening now.

• Question 175:

  Which of the following searches would return only events that match the following criteria?

  1.

  Events are inside the main index

  2.

  The field status exists in the event

  3.

  The value in the status field does not equal 200

  A. index==main status!==200

  B. index=main NOT status=200

  C. index==main NOT status==200

  D. index-main status!=200

  Correct Answer: C

  The Kusto Query Language (KQL) is the language you use to query data in Azure Data Explorer [1]. It's a powerful language that allows you to perform advanced queries and extract meaningful insights from your data. To query for events that match the criteria you specified, you would use the following KQL query:

  index==main NOT status==200 This query will return all events that are inside the main index and have a status field, but the value of the status field does not equal 200. It is important to note that the "NOT" operator must be used in order to exclude events with a status value of 200. By using the "NOT" operator, the query will return only events that do not match the specified criteria. This is useful for narrowing down search results to only those events that are relevant to the query.

• Question 176:

  Which search string returns a filed containing the number of matching events and names that field Event Count?

  A. index=security failure | stats sum as "Event Count"

  B. index=security failure | stats count as "Event Count"

  C. index=security failure | stats count by "Event Count"

  D. index=security failure | stats dc(count) as "Event Count"

  Correct Answer: B

• Question 177:

  What determines the scope of data that appears in a scheduled report?

  A. All data accessible to the User role will appear in the report.

  B. All data accessible to the owner of the report will appear in the report.

  C. All data accessible to all users will appear in the report until the next time the report is run.

  D. The owner of the report can configure permissions so that the report uses either the User role or the owner's profile at run time.

  Correct Answer: D

• Question 178:

  At index time, in which field does Splunk store the timestamp value?

  A. time

  B. _time

  C. EventTime

  D. timestamp

  Correct Answer: B

• Question 179:

  When looking at a statistics table, what is one way to drill down to see the underlying events?

  A. Creating a pivot table.

  B. Clicking on the visualizations tab.

  C. Viewing your report in a dashboard.

  D. Clicking on any field value in the table.

  Correct Answer: B

• Question 180:

  Lookups allow you to overwrite your raw event.

  A. True

  B. False

  Correct Answer: A