Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 181:

  The stats command will create a _____________ by default.

  A. Table

  B. Report

  C. Pie chart

  Correct Answer: A

• Question 182:

  What is the primary use for the rare command?

  A. To sort field values in descending order.

  B. To return only fields containing five of fewer values.

  C. To find the least common values of a field in a dataset.

  D. To find the fields with the fewest number of values across a dataset.

  Correct Answer: C

• Question 183:

  All users by default have WRITE permission to ALL knowledge objects.

  A. True

  B. False

  Correct Answer: B

• Question 184:

  Beginning parentheses is automatically highlighted to guide you on the presence of complimenting parentheses.

  A. No

  B. Yes

  Correct Answer: B

• Question 185:

  Data sources being opened and read applies to:

  A. None of the above

  B. Indexing Phase

  C. Parsing Phase

  D. Input Phase

  E. License Metering

  Correct Answer: D

• Question 186:

  Which of the following constraints can be used with the top command?

  A. limit

  B. useperc

  C. addtotals

  D. fieldcount

  Correct Answer: A

• Question 187:

  By default, which role contains the minimum permissions required to have write access to Splunk alerts?

  A. User

  B. Alerting

  C. Power

  D. Admin

  Correct Answer: C

  The Power role contains the minimum permissions required to have write access to Splunk alerts. The User role can only view alerts created by others, but cannot create or modify them. The Alerting role is not a default role in Splunk, but a custom one that can be created by an administrator. The Admin role has write access to Splunk alerts, but also has many other permissions that are not necessary for alerting3.

• Question 188:

  Which search string only returns events from hostWWW3?

  A. B. host=WWW3

  B. C. host=WWW*

  C. D. Host=WWW3

  Correct Answer: B

• Question 189:

  Creating Data Models:

  Object ATTRIBUTES do not define ___________.

  A. a base search for the object

  B. fields for the object

  Correct Answer: A

• Question 190:

  Splunk indexes the data on the basis of timestamps.

  A. True

  B. False

  Correct Answer: A