Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 221:

  What user interface component allows for time selection?

  A. Time summary

  B. Time range picker

  C. Search time picker

  D. Data source time statistics

  Correct Answer: B

• Question 222:

  In the Search and Reporting app, which tab displays timecharts and bar charts?

  A. Events

  B. Patterns

  C. Statistics

  D. Visualization

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Aboutreportingcommands

• Question 223:

  Clicking a SEGMENT on a chart, ________.

  A. drills down for that value

  B. highlights the field value across the chart

  C. adds the highlighted value to the search criteria

  Correct Answer: C

• Question 224:

  Which of the following is the recommended way to create multiple dashboards displaying data from the same search?

  A. Save the search as a report and use it in multiple dashboards as needed

  B. Save the search as a dashboard panel for each dashboard that needs the data

  C. Save the search as a scheduled alert and use it in multiple dashboards as needed

  D. Export the results of the search to an XML file and use the file as the basis of the dashboards

  Correct Answer: A

• Question 225:

  This is what Splunk uses to categorize the data that is being indexed.

  A. sourcetype

  B. index

  C. source

  D. host

  Correct Answer: A

• Question 226:

  In the Search and Reporting app, which is a default selected field?

  A. index

  B. action

  C. _time

  D. host

  Correct Answer: C

  In the Search and Reporting app, _time is a default selected field. This means that it is always displayed in the events list and table views, unless explicitly deselected. Other default selected fields are host, source, and sourcetype. Index and action are not default selected fields, but they can be added to the list of selected fields by clicking on All Fields4.

• Question 227:

  What is a primary function of a scheduled report?

  A. Auto-detect changes in performance

  B. Auto-generated PDF reports of overall data trends

  C. Regularly scheduled archiving to keep disk space use low

  D. Triggering an alert in your Splunk instance when certain conditions are met

  Correct Answer: D

• Question 228:

  Query - status != 100:

  A. Will return event where status field exist but value of that field is not 100.

  B. Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

  C. Will get different results depending on data

  Correct Answer: A

• Question 229:

  When placed early in a search, which command is most effective at reducing search execution time?

  A. dedup

  B. rename

  C. sort

  D. fields +

  Correct Answer: A

• Question 230:

  Which search string matches only events with the status_code of 4:4?

  A. status_code !=404

  B. status_code>=400

  C. status_code<=404

  D. status code>403 status_code<405

  Correct Answer: D