Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 201:

  Interesting fields are the fields that have at least 20% of resulting fields.

  A. True

  B. False

  Correct Answer: A

• Question 202:

  When using the top command in the following search, which of the following will be true about the results?

  index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f countfield=status_code_count

  A. The search will fail. The proper top command format is top limit=3 instead of top 3.

  B. The top three most common values in statusCode will be displayed for each user.

  C. Only the top three overall most common values in statusCode will be displayed.

  D. The percentage field will be displayed in the results.

  Correct Answer: B

  The top command returns the most common values of a field and their count. By using the by clause, you can group the results by another field. In this case, the top command will return the top three most common values in statusCode for each user. The showperc=f option will suppress the percentage column in the output. The countfield option will rename the count column to status_code_count2.

• Question 203:

  Log filtering/parsing can be done from _____________.

  A. Index Forwarders (IF)

  B. Universal Forwarders (UF)

  C. Super Forwarder (SF)

  D. Heavy Forwarders (HF)

  Correct Answer: D

• Question 204:

  Select the correct option that applies to Index time processing (Choose three.).

  A. Indexing

  B. Searching

  C. Parsing

  D. Settings

  E. Input

  Correct Answer: ACE

• Question 205:

  When an alert action is configured to run a script, Splunk must be able to locate the script. Which is one of the directories Splunk will look in to find the script?

  A. $SPLUNK_HOME/bin/scripts

  B. $SPLUNK_HOME/etc/scripts

  C. $SPLUNK_HOME/bin/etc/scripts

  D. $SPLUNK_HOME/etc/scripts/bin

  Correct Answer: A

• Question 206:

  Which search matches the events containing the terms "error" and "fail"?

  A. index=security Error Fail

  B. index=security error OR fail

  C. index=security "error failure"

  D. index=security NOT error NOT fail

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Search

• Question 207:

  You can on-board data to Splunk using following means (Choose four.):

  A. Props

  B. CLI

  C. Splunk Web

  D. savedsearches.conf

  E. Splunk apps and add-ons

  F. indexes.conf

  G. inputs.conf

  H. metadata.conf

  Correct Answer: BCEG

• Question 208:

  Splunk index time process can be broken down into __________ phases.

  A. 3

  B. 2

  C. 4

  D. 1

  Correct Answer: A

• Question 209:

  How many minutes, by default, is the time to live (ttl) for an ad-hoc search job?

  A. 5 minutes

  B. 1 minute

  C. 10 minutes

  D. 60 minutes

  Correct Answer: C

  The default time to live (ttl) for an ad-hoc search job is 10 minutes. This means that if no one views the results of a search within 10 minutes, the search job is canceled and the results are deleted. You can change this setting in the limits.conf file1.

• Question 210:

  Which is the default app for Splunk Enterprise?

  A. Splunk Enterprise Security Suite

  B. Searching and Reporting

  C. Reporting and Searching

  D. Splunk apps for Security

  Correct Answer: B