Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 11:

  Which of the following is a correct way to limit search results to display the 5 most common values of a field?

  A. | rare top=5

  B. | top rare=5

  C. | top limit=5

  D. | rare limit=5

  Correct Answer: C

• Question 12:

  Which search string is the most efficient?

  A. "failed password"

  B. ''failed password"*

  C. index=* "failed password"

  D. index=security "failed password"

  Correct Answer: D

• Question 13:

  Which Boolean operator is implied between search terms, unless otherwise specified?

  A. OR

  B. AND

  C. NOT

  D. NAND

  Correct Answer: B

• Question 14:

  Put query into separate lines where | (Pipes) are used by selecting following options.

  A. CTRL + Enter

  B. Shift + Enter

  C. Space + Enter

  D. ALT + Enter

  Correct Answer: B

• Question 15:

  Field values are case sensitive.

  A. True

  B. False

  Correct Answer: B

• Question 16:

  Which search would return events from the access_combined sourcetype?

  A. Sourcetype=access_combined

  B. Sourcetype=Access_Combined

  C. sourcetype=Access_Combined

  D. SOURCETYPE=access_combined

  Correct Answer: A

  The search query sourcetype=access_combined would return events from the access_combined sourcetype, which is a predefined sourcetype in Splunk that matches the access-common or access-combined Apache logging formats. The sourcetype field is case-sensitive, so using different capitalization such as Access_Combined or ACCESS_COMBINED would not match the exact sourcetype name. The sourcetype field is also a default field that is added by the indexer when it indexes the data, so it does not need to be enclosed in quotation marks.

• Question 17:

  Events in Splunk are automatically segregated using data and time.

  A. Yes

  B. No

  Correct Answer: A

• Question 18:

  Three basic components of Splunk are (Choose three.):

  A. Forwarders

  B. Deployment Server

  C. Indexer

  D. Knowledge Objects

  E. Index

  F. Search Head

  Correct Answer: ACF

• Question 19:

  Zoom Out and Zoom to Selection re-executes the search.

  A. No

  B. Yes

  Correct Answer: B

• Question 20:

  Which of the following statements are correct about Search and Reporting App? (Choose three.)

  A. Can be accessed by Apps > Search and Reporting.

  B. Provides default interface for searching and analyzing logs.

  C. Enables the user to create knowledge object, reports, alerts and dashboards.

  D. It only gives us search functionality.

  Correct Answer: ABC