Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 231:

  How does Splunk determine which fields to extract from data?

  A. Splunk only extracts the most interesting data from the last 24 hours.

  B. Splunk only extracts fields users have manually specified in their data.

  C. Splunk automatically extracts any fields that generate interesting visualizations.

  D. Splunk automatically discovers many fields based on source type and key/value pairs found in the data.

  Correct Answer: D

• Question 232:

  Which of the following is the most efficient filter for running searches in Splunk?

  A. Time

  B. Fast mode

  C. Sourcetype

  D. Selected Fields

  Correct Answer: A

• Question 233:

  How can another user gain access to a saved report?

  A. The owner of the report can edit permissions from the Edit dropdown

  B. Only users with an Admin or Power User role can access other users' reports

  C. Anyone can access any reports marked as public within a shared Splunk deployment

  D. The owner of the report must clone the original report and save it to their user account

  Correct Answer: A

• Question 234:

  What does the values function of the stats command do?

  A. Lists all values of a given field.

  B. Lists unique values of a given field.

  C. Returns a count of unique values for a given field.

  D. Returns the number of events that match the search.

  Correct Answer: B

• Question 235:

  When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

  A. Cloned panel

  B. Inline panel

  C. Report panel

  D. Prebuilt panel

  Correct Answer: C

• Question 236:

  This clause is used to group the output of a stats command by a specific name.

  A. Rex

  B. As

  C. List D. By

  Correct Answer: D

• Question 237:

  What syntax is used to link key/value pairs in search strings?

  A. Parentheses

  B. @ or # symbols

  C. Quotation marks

  D. Relational operators such as =, <, or >

  Correct Answer: D

• Question 238:

  Which Boolean operator is always implied between two search terms, unless otherwise specified?

  A. OR

  B. NOT

  C. AND

  D. XOR

  Correct Answer: C

• Question 239:

  Search Assistant is enabled by default in the SPL editor with compact settings.

  A. No

  B. Yes

  Correct Answer: B

• Question 240:

  Which stats command function provides a count of how many unique values exist for a given field in the result set?

  A. dc(field)

  B. count(field)

  C. count-by(field)

  D. distinct-count(field)

  Correct Answer: A