Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 241:

  Which of the following is the appropriately formatted SPL search?

  A. index=security sourcetype=linux secure (invalid OR failed) | stats count as "Potential Issues"

  B. index=security sourcetype=linux secure (invalid OR failed) | stats as "Potential Issues"

  C. index--security sourcetype=linux secure (invalid OR failed) | count stats as "Potential Issues"

  D. index--security sourcetype=linux secure (invalid OR failed) | count as "Potential Issues"

  Correct Answer: A

  This is the appropriately formatted SPL search because it follows the SPL syntax rules12, such as:

  Using the = operator to specify field-value pairs, such as index=security and sourcetype=linux.

  Using the OR operator to combine multiple values for the same field, such as (invalid OR failed).

  Using the | character to separate commands, such as stats count as "Potential Issues".

  Using the as keyword to rename fields, such as count as "Potential Issues".

• Question 242:

  What is Splunk?

  A. Splunk is a software platform to search, analyze and visualize the machine-generated data.

  B. Database management tool.

  C. Security Information and Event Management (SIEM).

  D. Cloud based application that help in analyzing logs.

  Correct Answer: A

• Question 243:

  When writing searches in Splunk, which of the following is true about Booleans?

  A. They must be lowercase.

  B. They must be uppercase.

  C. They must be in quotations.

  D. They must be in parentheses.

  Correct Answer: B

• Question 244:

  When displaying results of a search, which of the following is true about line charts?

  A. Line charts are optimal for single and multiple series.

  B. Line charts are optimal for single series when using Fast mode.

  C. Line charts are optimal for multiple series with 3 or more columns.

  D. Line charts are optimal for multiseries searches with at least 2 or more columns.

  Correct Answer: C