Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 191:

  What kind of logs can Splunk Index?

  A. Only A, B

  B. Router and Switch Logs

  C. Firewall and Web Server Logs

  D. Only C

  E. Database logs

  F. All firewall, web server, database, router and switch logs

  Correct Answer: F

• Question 192:

  Which component of Splunk let us write SPL query to find the required data?

  A. Forwarders

  B. Indexer

  C. Heavy Forwarders

  D. Search head

  Correct Answer: D

• Question 193:

  Which all time unit abbreviations can you include in Advanced time range picker? (Choose seven.)

  A. h

  B. day

  C. mon

  D. yr

  E. y

  F. w

  G. week

  H. d

  I. s

  J. m

  Correct Answer: ACEFHIJ

  A,C,E,F,H,I,J

• Question 194:

  What must be done in order to use a lookup table in Splunk?

  A. The lookup must be configured to run automatically.

  B. The contents of the lookup file must be copied and pasted into the search bar.

  C. The lookup file must be uploaded to Splunk and a lookup definition must be created.

  D. The lookup file must be uploaded to the etc/apps/lookups folder for automatic ingestion.

  Correct Answer: C

• Question 195:

  Which of the following can be used as wildcard search in Splunk?

  A. =

  B. >

  C. !

  D. *

  Correct Answer: D

• Question 196:

  Machine data can be in structured and unstructured format.

  A. False

  B. True

  Correct Answer: B

• Question 197:

  Prefix wildcards might cause performance issues.

  A. False

  B. True

  Correct Answer: B

• Question 198:

  Which of the following is the best way to create a report that shows the last 24 hours of events?

  A. Use earliest=-1d@d latest=@d

  B. Set a real-time search over a 24-hour window

  C. Use the time range picket to select "Yesterday"

  D. Use the time range picker to select "Last 24 hours"

  Correct Answer: D

• Question 199:

  What is the proper SPL terminology for specifying a particular index in a search?

  A. indexer--index_name

  B. indexer name--index_name

  C. index=index_name

  D. index name=index_name

  Correct Answer: C

  This means that you can use the index field to filter your search results by the name of the index that contains the events you want to see. For example, if you want to search for events in the index named "gcp_logs", you can use the following SPL: index=gcp_logs You can also specify multiple indexes by using the OR operator, such as: index=gcp_logs OR index=oswin

• Question 200:

  Select the best options for "search best practices" in Splunk:

  (Choose five.)

  A. Select the time range always.

  B. Try to specify index values.

  C. Include as many search terms as possible.

  D. Never select time range.

  E. Try to use * with every search term.

  F. Inclusion is generally better than exclusion.

  G. Try to keep specific search terms.

  Correct Answer: ABCFG

  A,B,C,F,G