Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 211:

  Which command is used to validate a lookup file?

  A. | lookup products.csv

  B. inputlookup products.csv

  C. I inputlookup products.csv

  D. | lookup definition products.csv

  Correct Answer: C

• Question 212:

  All components are installed and administered in Splunk Enterprise on-premise.

  A. True

  B. False

  Correct Answer: A

• Question 213:

  You can also specify a time range in the search bar. You can use the following for beginning and ending for a time range (Choose two.):

  A. Not possible to specify time manually in Search query

  B. end=

  C. start=

  D. earliest=

  E. latest=

  Correct Answer: DE

• Question 214:

  What is a quick, comprehensive way to learn what data is present in a Splunk deployment?

  A. Review Splunk reports

  B. Run ./splunk show

  C. Click Data Summary in Splunk Web

  D. Search index=* sourcetype=* host=*

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/InheritedDeployment/Yourdata

• Question 215:

  Which is not a comparison operator in Splunk

  A. <=

  B. =

  C. !=

  D. >

  E. ?=

  Correct Answer: E

• Question 216:

  Which of the following are Splunk premium enhanced solutions? (Choose three.)

  A. Splunk User Behavior Analytics (UBA)

  B. Splunk IT Service Intelligence (ITSI)

  C. Splunk Enterprise Security (ES)

  D. Splunk Analytics Security (AS)

  Correct Answer: ABC

• Question 217:

  Which component of Splunk is primarily responsible for saving data?

  A. Search Head

  B. Heavy Forwarder

  C. Indexer

  D. Universal Forwarder

  Correct Answer: C

• Question 218:

  Which is a primary function of the timeline located under the search bar?

  A. To differentiate between structured and unstructured events in the data

  B. To sort the events returned by the search command in chronological order

  C. To zoom in and zoom out. although this does not change the scale of the chart

  D. To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime

  Correct Answer: D

• Question 219:

  36. Lookups can be private for a user.

  A. True

  B. False

  Correct Answer: A

• Question 220:

  Which statement describes field discovery at search time?

  A. Splunk automatically discovers only numeric fields

  B. Splunk automatically discovers only alphanumeric fields

  C. Splunk automatically discovers only manually configured fields

  D. Splunk automatically discovers only fields directly related to the search results

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Changethesearchmode